Overview

overview

10

Static

static

3

MasonClien...ed.exe

windows10-2004-x64

10

MasonClien...ed.exe

windows10-ltsc_2021-x64

10

MasonClien...ed.exe

windows11-21h2-x64

10

MasonClien...ed.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    101s
  • max time network
    145s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    24/10/2026, 09:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MasonClient_protected.exe
  • Size 234KB
  • Sample261024-k87csays3j
  • SHA256 071b182afc551f116e0bad87839dd451673cb0e75f16cf1847fa66c4f15a9b71
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutiondonutloaderneptuneratloaderpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

  • neptunerat

C2

  • 193.161.193.99:45108

Attributes
  • filename

    USB.exe

  • group

    MasonGroup

  • key

    I3ujeNhtTGMSOz0g

  • rat_name

    MasonRAT

Signatures

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader
  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat
  • Detects DonutLoader 1 IoCs
    loader
  • Detects NeptuneRAT stealer 4 IoCs
  • Modifies visibility of hidden/system files in Explorer 2 TTPs 53 IoCs
    defense_evasion
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs
    defense_evasionprivilege_escalation
  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 56 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary 1 TTPs 12 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 56 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:396
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4624
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3348
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2760
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:3800
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:4024
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4624
    • C:\Users\Admin\AppData\Local\Temp\MasonClient_protected.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonClient_protected.exe"
      1⤵
      • Modifies visibility of hidden/system files in Explorer
      • Checks computer location settings
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lcmwxfho.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2744
    • C:\Users\Admin\AppData\Roaming\lcmwxfho.exe
      C:\Users\Admin\AppData\Roaming\lcmwxfho.exe
      1⤵
      • Modifies visibility of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\i0ahhcgx.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1240
    • C:\Users\Admin\AppData\Roaming\i0ahhcgx.exe
      C:\Users\Admin\AppData\Roaming\i0ahhcgx.exe
      1⤵
      • Modifies visibility of hidden/system files in Explorer
      • Checks computer location settings
      • Executes a file named after a Windows system binary
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ircidkie.exe"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4736
    • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      1⤵
      • Checks computer location settings
      • Executes a file named after a Windows system binary
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4528
    • C:\Users\Admin\AppData\Roaming\ircidkie.exe
      C:\Users\Admin\AppData\Roaming\ircidkie.exe
      1⤵
      • Modifies visibility of hidden/system files in Explorer
      • Checks computer location settings
      • Executes a file named after a Windows system binary
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1040
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2cvavhd4.exe"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4056
    • C:\Users\Admin\AppData\Roaming\2cvavhd4.exe
      C:\Users\Admin\AppData\Roaming\2cvavhd4.exe
      1⤵
      • Modifies visibility of hidden/system files in Explorer
      • Checks computer location settings
      • Executes a file named after a Windows system binary
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:3692
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iubsgfkp.exe"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2088
    • C:\Users\Admin\AppData\Roaming\iubsgfkp.exe
      C:\Users\Admin\AppData\Roaming\iubsgfkp.exe
      1⤵
      • Modifies visibility of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ylgiqcrf.exe"
        2⤵
          PID:1072
      • C:\Users\Admin\AppData\Roaming\ylgiqcrf.exe
        C:\Users\Admin\AppData\Roaming\ylgiqcrf.exe
        1⤵
        • Modifies visibility of hidden/system files in Explorer
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vexb1m21.exe"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1120
      • C:\Users\Admin\AppData\Roaming\vexb1m21.exe
        C:\Users\Admin\AppData\Roaming\vexb1m21.exe
        1⤵
        • Modifies visibility of hidden/system files in Explorer
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jzo2bjl3.exe"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1708
      • C:\Users\Admin\AppData\Roaming\jzo2bjl3.exe
        C:\Users\Admin\AppData\Roaming\jzo2bjl3.exe
        1⤵
        • Modifies visibility of hidden/system files in Explorer
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:1588
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qjpas5hr.exe"
          2⤵
            PID:2076
        • C:\Users\Admin\AppData\Roaming\qjpas5hr.exe
          C:\Users\Admin\AppData\Roaming\qjpas5hr.exe
          1⤵
          • Modifies visibility of hidden/system files in Explorer
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2600
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wh3y0tfq.exe"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3236
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          1⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4836
        • C:\Users\Admin\AppData\Roaming\wh3y0tfq.exe
          C:\Users\Admin\AppData\Roaming\wh3y0tfq.exe
          1⤵
          • Modifies visibility of hidden/system files in Explorer
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4108
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\22gw44fi.exe"
            2⤵
              PID:3156
          • C:\Users\Admin\AppData\Roaming\22gw44fi.exe
            C:\Users\Admin\AppData\Roaming\22gw44fi.exe
            1⤵
            • Modifies visibility of hidden/system files in Explorer
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of WriteProcessMemory
            PID:2500
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\om2ivatb.exe"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3148
          • C:\Users\Admin\AppData\Roaming\om2ivatb.exe
            C:\Users\Admin\AppData\Roaming\om2ivatb.exe
            1⤵
            • Modifies visibility of hidden/system files in Explorer
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of WriteProcessMemory
            PID:2304
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5hjkjwmf.exe"
              2⤵
                PID:4820
            • C:\Users\Admin\AppData\Roaming\5hjkjwmf.exe
              C:\Users\Admin\AppData\Roaming\5hjkjwmf.exe
              1⤵
              • Modifies visibility of hidden/system files in Explorer
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of WriteProcessMemory
              PID:4760
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pb4wdbpx.exe"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1524
            • C:\Users\Admin\AppData\Roaming\pb4wdbpx.exe
              C:\Users\Admin\AppData\Roaming\pb4wdbpx.exe
              1⤵
              • Modifies visibility of hidden/system files in Explorer
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:560
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\z4b3d440.exe"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:852
            • C:\Users\Admin\AppData\Roaming\z4b3d440.exe
              C:\Users\Admin\AppData\Roaming\z4b3d440.exe
              1⤵
              • Modifies visibility of hidden/system files in Explorer
              • Checks computer location settings
              • Executes a file named after a Windows system binary
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:2112
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xqpc5otj.exe"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3064
            • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
              "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
              1⤵
              • Checks computer location settings
              • Executes a file named after a Windows system binary
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3644
              • C:\Windows\System32\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
                2⤵
                • Scheduled Task/Job: Scheduled Task
                PID:4596
            • C:\Users\Admin\AppData\Roaming\xqpc5otj.exe
              C:\Users\Admin\AppData\Roaming\xqpc5otj.exe
              1⤵
              • Modifies visibility of hidden/system files in Explorer
              • Checks computer location settings
              • Executes a file named after a Windows system binary
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4564
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fqfxkzed.exe"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2680
            • C:\Users\Admin\AppData\Roaming\fqfxkzed.exe
              C:\Users\Admin\AppData\Roaming\fqfxkzed.exe
              1⤵
              • Modifies visibility of hidden/system files in Explorer
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of WriteProcessMemory
              PID:1456
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5lrdwzyw.exe"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1696
            • C:\Users\Admin\AppData\Roaming\5lrdwzyw.exe
              C:\Users\Admin\AppData\Roaming\5lrdwzyw.exe
              1⤵
              • Modifies visibility of hidden/system files in Explorer
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:548
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\a2tpjojd.exe"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:660
            • C:\Users\Admin\AppData\Roaming\a2tpjojd.exe
              C:\Users\Admin\AppData\Roaming\a2tpjojd.exe
              1⤵
              • Modifies visibility of hidden/system files in Explorer
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of WriteProcessMemory
              PID:2396
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\050x0eux.exe"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:740
            • C:\Users\Admin\AppData\Roaming\050x0eux.exe
              C:\Users\Admin\AppData\Roaming\050x0eux.exe
              1⤵
              • Modifies visibility of hidden/system files in Explorer
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:3180
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fxe35csy.exe"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4272
            • C:\Users\Admin\AppData\Roaming\fxe35csy.exe
              C:\Users\Admin\AppData\Roaming\fxe35csy.exe
              1⤵
              • Modifies visibility of hidden/system files in Explorer
              • Checks computer location settings
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of WriteProcessMemory
              PID:4468
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kddbhjc5.exe"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3460
            • C:\Users\Admin\AppData\Roaming\kddbhjc5.exe
              C:\Users\Admin\AppData\Roaming\kddbhjc5.exe
              1⤵
              • Modifies visibility of hidden/system files in Explorer
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of WriteProcessMemory
              PID:4320
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zui0ujzf.exe"
                2⤵
                  PID:1752
              • C:\Users\Admin\AppData\Roaming\zui0ujzf.exe
                C:\Users\Admin\AppData\Roaming\zui0ujzf.exe
                1⤵
                • Modifies visibility of hidden/system files in Explorer
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Reads the TCP/IP host and domain name from the registry
                • Suspicious use of WriteProcessMemory
                PID:4660
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\3pndible.exe"
                  2⤵
                    PID:480
                • C:\Users\Admin\AppData\Roaming\3pndible.exe
                  C:\Users\Admin\AppData\Roaming\3pndible.exe
                  1⤵
                  • Modifies visibility of hidden/system files in Explorer
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Reads the TCP/IP host and domain name from the registry
                  • Suspicious use of WriteProcessMemory
                  PID:5056
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pkzokldu.exe"
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2444
                • C:\Users\Admin\AppData\Roaming\pkzokldu.exe
                  C:\Users\Admin\AppData\Roaming\pkzokldu.exe
                  1⤵
                  • Modifies visibility of hidden/system files in Explorer
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Reads the TCP/IP host and domain name from the registry
                  • Suspicious use of WriteProcessMemory
                  PID:2088
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kpdh0rtl.exe"
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4272
                • C:\Users\Admin\AppData\Roaming\kpdh0rtl.exe
                  C:\Users\Admin\AppData\Roaming\kpdh0rtl.exe
                  1⤵
                  • Modifies visibility of hidden/system files in Explorer
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Reads the TCP/IP host and domain name from the registry
                  • Suspicious use of WriteProcessMemory
                  PID:1156
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fxihbpoe.exe"
                    2⤵
                      PID:3352
                  • C:\Users\Admin\AppData\Roaming\fxihbpoe.exe
                    C:\Users\Admin\AppData\Roaming\fxihbpoe.exe
                    1⤵
                    • Modifies visibility of hidden/system files in Explorer
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Reads the TCP/IP host and domain name from the registry
                    • Suspicious use of WriteProcessMemory
                    PID:4736
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bafz3ua2.exe"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:1752
                  • C:\Users\Admin\AppData\Roaming\bafz3ua2.exe
                    C:\Users\Admin\AppData\Roaming\bafz3ua2.exe
                    1⤵
                    • Modifies visibility of hidden/system files in Explorer
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Reads the TCP/IP host and domain name from the registry
                    • Suspicious use of WriteProcessMemory
                    PID:1224
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dhnqrgoo.exe"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:3504
                  • C:\Users\Admin\AppData\Roaming\dhnqrgoo.exe
                    C:\Users\Admin\AppData\Roaming\dhnqrgoo.exe
                    1⤵
                    • Modifies visibility of hidden/system files in Explorer
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Reads the TCP/IP host and domain name from the registry
                    • Suspicious use of WriteProcessMemory
                    PID:2732
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yuggreel.exe"
                      2⤵
                        PID:2460
                    • C:\Users\Admin\AppData\Roaming\yuggreel.exe
                      C:\Users\Admin\AppData\Roaming\yuggreel.exe
                      1⤵
                      • Modifies visibility of hidden/system files in Explorer
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Reads the TCP/IP host and domain name from the registry
                      • Suspicious use of WriteProcessMemory
                      PID:4972
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\p43j4rx5.exe"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:3532
                    • C:\Users\Admin\AppData\Roaming\p43j4rx5.exe
                      C:\Users\Admin\AppData\Roaming\p43j4rx5.exe
                      1⤵
                      • Modifies visibility of hidden/system files in Explorer
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Reads the TCP/IP host and domain name from the registry
                      • Suspicious use of WriteProcessMemory
                      PID:5028
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\csbiv1ba.exe"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:1916
                    • C:\Users\Admin\AppData\Roaming\csbiv1ba.exe
                      C:\Users\Admin\AppData\Roaming\csbiv1ba.exe
                      1⤵
                      • Modifies visibility of hidden/system files in Explorer
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of WriteProcessMemory
                      PID:1400
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\axi3y4iw.exe"
                        2⤵
                          PID:2300
                      • C:\Users\Admin\AppData\Roaming\axi3y4iw.exe
                        C:\Users\Admin\AppData\Roaming\axi3y4iw.exe
                        1⤵
                        • Modifies visibility of hidden/system files in Explorer
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Reads the TCP/IP host and domain name from the registry
                        • Suspicious use of WriteProcessMemory
                        PID:3920
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oecal5gc.exe"
                          2⤵
                            PID:452
                        • C:\Users\Admin\AppData\Roaming\oecal5gc.exe
                          C:\Users\Admin\AppData\Roaming\oecal5gc.exe
                          1⤵
                          • Modifies visibility of hidden/system files in Explorer
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Reads the TCP/IP host and domain name from the registry
                          • Suspicious use of WriteProcessMemory
                          PID:416
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fnj4q2no.exe"
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:3864
                        • C:\Users\Admin\AppData\Roaming\fnj4q2no.exe
                          C:\Users\Admin\AppData\Roaming\fnj4q2no.exe
                          1⤵
                          • Modifies visibility of hidden/system files in Explorer
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Reads the TCP/IP host and domain name from the registry
                          • Suspicious use of WriteProcessMemory
                          PID:3884
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rj2ptxgn.exe"
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:3088
                        • C:\Users\Admin\AppData\Roaming\rj2ptxgn.exe
                          C:\Users\Admin\AppData\Roaming\rj2ptxgn.exe
                          1⤵
                          • Modifies visibility of hidden/system files in Explorer
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Reads the TCP/IP host and domain name from the registry
                          • Suspicious use of WriteProcessMemory
                          PID:4656
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hwftnck3.exe"
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:4772
                        • C:\Users\Admin\AppData\Roaming\hwftnck3.exe
                          C:\Users\Admin\AppData\Roaming\hwftnck3.exe
                          1⤵
                          • Modifies visibility of hidden/system files in Explorer
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Reads the TCP/IP host and domain name from the registry
                          • Suspicious use of WriteProcessMemory
                          PID:232
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2wtiya51.exe"
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:4464
                        • C:\Users\Admin\AppData\Roaming\2wtiya51.exe
                          C:\Users\Admin\AppData\Roaming\2wtiya51.exe
                          1⤵
                          • Modifies visibility of hidden/system files in Explorer
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Reads the TCP/IP host and domain name from the registry
                          • Suspicious use of WriteProcessMemory
                          PID:1524
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2f5dwrvr.exe"
                            2⤵
                              PID:740
                          • C:\Users\Admin\AppData\Roaming\2f5dwrvr.exe
                            C:\Users\Admin\AppData\Roaming\2f5dwrvr.exe
                            1⤵
                            • Modifies visibility of hidden/system files in Explorer
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Reads the TCP/IP host and domain name from the registry
                            • Suspicious use of WriteProcessMemory
                            PID:1120
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xhxqzog2.exe"
                              2⤵
                                PID:1604
                            • C:\Users\Admin\AppData\Roaming\xhxqzog2.exe
                              C:\Users\Admin\AppData\Roaming\xhxqzog2.exe
                              1⤵
                              • Modifies visibility of hidden/system files in Explorer
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Reads the TCP/IP host and domain name from the registry
                              • Suspicious use of WriteProcessMemory
                              PID:2716
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dti3ajcd.exe"
                                2⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4104
                            • C:\Users\Admin\AppData\Roaming\dti3ajcd.exe
                              C:\Users\Admin\AppData\Roaming\dti3ajcd.exe
                              1⤵
                              • Modifies visibility of hidden/system files in Explorer
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Reads the TCP/IP host and domain name from the registry
                              • Suspicious use of WriteProcessMemory
                              PID:2020
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bfnoafzf.exe"
                                2⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4028
                            • C:\Users\Admin\AppData\Roaming\bfnoafzf.exe
                              C:\Users\Admin\AppData\Roaming\bfnoafzf.exe
                              1⤵
                              • Modifies visibility of hidden/system files in Explorer
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Reads the TCP/IP host and domain name from the registry
                              • Suspicious use of WriteProcessMemory
                              PID:4824
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\p3xw1yhh.exe"
                                2⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:2916
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  3⤵
                                    PID:2300
                              • C:\Users\Admin\AppData\Roaming\p3xw1yhh.exe
                                C:\Users\Admin\AppData\Roaming\p3xw1yhh.exe
                                1⤵
                                • Modifies visibility of hidden/system files in Explorer
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Reads the TCP/IP host and domain name from the registry
                                • Suspicious use of WriteProcessMemory
                                PID:1804
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ko1su42l.exe"
                                  2⤵
                                    PID:2204
                                • C:\Users\Admin\AppData\Roaming\ko1su42l.exe
                                  C:\Users\Admin\AppData\Roaming\ko1su42l.exe
                                  1⤵
                                  • Modifies visibility of hidden/system files in Explorer
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Reads the TCP/IP host and domain name from the registry
                                  • Suspicious use of WriteProcessMemory
                                  PID:3088
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uzm1mzyj.exe"
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:1320
                                • C:\Users\Admin\AppData\Roaming\uzm1mzyj.exe
                                  C:\Users\Admin\AppData\Roaming\uzm1mzyj.exe
                                  1⤵
                                  • Modifies visibility of hidden/system files in Explorer
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Reads the TCP/IP host and domain name from the registry
                                  • Suspicious use of WriteProcessMemory
                                  PID:4996
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1acs2m2u.exe"
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:5016
                                • C:\Users\Admin\AppData\Roaming\1acs2m2u.exe
                                  C:\Users\Admin\AppData\Roaming\1acs2m2u.exe
                                  1⤵
                                  • Modifies visibility of hidden/system files in Explorer
                                  • Checks computer location settings
                                  • Executes a file named after a Windows system binary
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:852
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ifwm3laq.exe"
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:1584
                                • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
                                  "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
                                  1⤵
                                  • Executes a file named after a Windows system binary
                                  • Executes dropped EXE
                                  PID:1704
                                • C:\Users\Admin\AppData\Roaming\ifwm3laq.exe
                                  C:\Users\Admin\AppData\Roaming\ifwm3laq.exe
                                  1⤵
                                  • Modifies visibility of hidden/system files in Explorer
                                  • Checks computer location settings
                                  • Executes a file named after a Windows system binary
                                  • Executes dropped EXE
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:4272
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1fgdat0f.exe"
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:4144
                                • C:\Users\Admin\AppData\Roaming\1fgdat0f.exe
                                  C:\Users\Admin\AppData\Roaming\1fgdat0f.exe
                                  1⤵
                                  • Modifies visibility of hidden/system files in Explorer
                                  • Checks computer location settings
                                  • Executes a file named after a Windows system binary
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:4732
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\4t1p0fsh.exe"
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:3504
                                • C:\Users\Admin\AppData\Roaming\4t1p0fsh.exe
                                  C:\Users\Admin\AppData\Roaming\4t1p0fsh.exe
                                  1⤵
                                  • Modifies visibility of hidden/system files in Explorer
                                  • Checks computer location settings
                                  • Executes a file named after a Windows system binary
                                  • Executes dropped EXE
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:3076
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0towp1zt.exe"
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:3184
                                • C:\Users\Admin\AppData\Roaming\0towp1zt.exe
                                  C:\Users\Admin\AppData\Roaming\0towp1zt.exe
                                  1⤵
                                  • Modifies visibility of hidden/system files in Explorer
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:476
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gjpgkpxk.exe"
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:4596
                                • C:\Users\Admin\AppData\Roaming\gjpgkpxk.exe
                                  C:\Users\Admin\AppData\Roaming\gjpgkpxk.exe
                                  1⤵
                                  • Modifies visibility of hidden/system files in Explorer
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:4036
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zm5nx0n5.exe"
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:2204
                                • C:\Users\Admin\AppData\Roaming\zm5nx0n5.exe
                                  C:\Users\Admin\AppData\Roaming\zm5nx0n5.exe
                                  1⤵
                                  • Modifies visibility of hidden/system files in Explorer
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:4248
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\41dnbn4l.exe"
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:2436
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  1⤵
                                    PID:1320
                                  • C:\Users\Admin\AppData\Roaming\41dnbn4l.exe
                                    C:\Users\Admin\AppData\Roaming\41dnbn4l.exe
                                    1⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    PID:1488
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\4f3x311o.exe"
                                      2⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:4816
                                  • C:\Users\Admin\AppData\Roaming\4f3x311o.exe
                                    C:\Users\Admin\AppData\Roaming\4f3x311o.exe
                                    1⤵
                                      PID:1016
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hs2slcqj.exe"
                                        2⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:992
                                    • C:\Users\Admin\AppData\Roaming\hs2slcqj.exe
                                      C:\Users\Admin\AppData\Roaming\hs2slcqj.exe
                                      1⤵
                                        PID:4528
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2uym5bx5.exe"
                                          2⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          PID:1636
                                      • C:\Users\Admin\AppData\Roaming\2uym5bx5.exe
                                        C:\Users\Admin\AppData\Roaming\2uym5bx5.exe
                                        1⤵
                                          PID:1076
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dtg2vma5.exe"
                                            2⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            PID:1920
                                        • C:\Users\Admin\AppData\Roaming\dtg2vma5.exe
                                          C:\Users\Admin\AppData\Roaming\dtg2vma5.exe
                                          1⤵
                                            PID:4772
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sk5mkekj.exe"
                                              2⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:4940
                                          • C:\Users\Admin\AppData\Roaming\sk5mkekj.exe
                                            C:\Users\Admin\AppData\Roaming\sk5mkekj.exe
                                            1⤵
                                              PID:3800
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jv1p25pw.exe"
                                                2⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:2308
                                            • C:\Users\Admin\AppData\Roaming\jv1p25pw.exe
                                              C:\Users\Admin\AppData\Roaming\jv1p25pw.exe
                                              1⤵
                                                PID:5068
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lkcr0rc5.exe"
                                                  2⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  PID:788
                                              • C:\Users\Admin\AppData\Roaming\lkcr0rc5.exe
                                                C:\Users\Admin\AppData\Roaming\lkcr0rc5.exe
                                                1⤵
                                                  PID:64
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qyu0buy5.exe"
                                                    2⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    PID:5016
                                                • C:\Users\Admin\AppData\Roaming\qyu0buy5.exe
                                                  C:\Users\Admin\AppData\Roaming\qyu0buy5.exe
                                                  1⤵
                                                    PID:1732
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\phgwrurg.exe"
                                                      2⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:224
                                                  • C:\Users\Admin\AppData\Roaming\phgwrurg.exe
                                                    C:\Users\Admin\AppData\Roaming\phgwrurg.exe
                                                    1⤵
                                                      PID:756
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1dnwon3x.exe"
                                                        2⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        PID:3744
                                                        • C:\Windows\System32\Conhost.exe
                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          3⤵
                                                            PID:3184
                                                      • C:\Users\Admin\AppData\Roaming\1dnwon3x.exe
                                                        C:\Users\Admin\AppData\Roaming\1dnwon3x.exe
                                                        1⤵
                                                          PID:3904
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cshxhrvd.exe"
                                                            2⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:5012
                                                        • C:\Users\Admin\AppData\Roaming\cshxhrvd.exe
                                                          C:\Users\Admin\AppData\Roaming\cshxhrvd.exe
                                                          1⤵
                                                            PID:1824
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xbdailh1.exe"
                                                              2⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              PID:4648
                                                          • C:\Users\Admin\AppData\Roaming\xbdailh1.exe
                                                            C:\Users\Admin\AppData\Roaming\xbdailh1.exe
                                                            1⤵
                                                              PID:4620
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\omrimsoc.exe"
                                                                2⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                PID:2080
                                                            • C:\Users\Admin\AppData\Roaming\omrimsoc.exe
                                                              C:\Users\Admin\AppData\Roaming\omrimsoc.exe
                                                              1⤵
                                                                PID:4140
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\el1pnw2w.exe"
                                                                  2⤵
                                                                    PID:992
                                                                • C:\Users\Admin\AppData\Roaming\el1pnw2w.exe
                                                                  C:\Users\Admin\AppData\Roaming\el1pnw2w.exe
                                                                  1⤵
                                                                    PID:4464
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hebecwt0.exe"
                                                                      2⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      PID:2596
                                                                  • C:\Users\Admin\AppData\Roaming\hebecwt0.exe
                                                                    C:\Users\Admin\AppData\Roaming\hebecwt0.exe
                                                                    1⤵
                                                                      PID:1584
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ogxej4ah.exe"
                                                                        2⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        PID:4540
                                                                    • C:\Users\Admin\AppData\Roaming\ogxej4ah.exe
                                                                      C:\Users\Admin\AppData\Roaming\ogxej4ah.exe
                                                                      1⤵
                                                                        PID:2524
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hcaiitit.exe"
                                                                          2⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:3352
                                                                      • C:\Users\Admin\AppData\Roaming\hcaiitit.exe
                                                                        C:\Users\Admin\AppData\Roaming\hcaiitit.exe
                                                                        1⤵
                                                                          PID:2036
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fldh32bd.exe"
                                                                            2⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            PID:3836
                                                                        • C:\Users\Admin\AppData\Roaming\fldh32bd.exe
                                                                          C:\Users\Admin\AppData\Roaming\fldh32bd.exe
                                                                          1⤵
                                                                            PID:3028
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kcmq2uog.exe"
                                                                              2⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:2596
                                                                          • C:\Users\Admin\AppData\Roaming\kcmq2uog.exe
                                                                            C:\Users\Admin\AppData\Roaming\kcmq2uog.exe
                                                                            1⤵
                                                                              PID:1292
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2iphwexw.exe"
                                                                                2⤵
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                PID:1556
                                                                            • C:\Users\Admin\AppData\Roaming\2iphwexw.exe
                                                                              C:\Users\Admin\AppData\Roaming\2iphwexw.exe
                                                                              1⤵
                                                                                PID:2720
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\numrpdqd.exe"
                                                                                  2⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  PID:4060
                                                                              • C:\Users\Admin\AppData\Roaming\numrpdqd.exe
                                                                                C:\Users\Admin\AppData\Roaming\numrpdqd.exe
                                                                                1⤵
                                                                                  PID:2108
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\h0hhdk3u.exe"
                                                                                    2⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    PID:2496
                                                                                • C:\Users\Admin\AppData\Roaming\h0hhdk3u.exe
                                                                                  C:\Users\Admin\AppData\Roaming\h0hhdk3u.exe
                                                                                  1⤵
                                                                                    PID:3868
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qko5jmgw.exe"
                                                                                      2⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      PID:4532
                                                                                  • C:\Users\Admin\AppData\Roaming\qko5jmgw.exe
                                                                                    C:\Users\Admin\AppData\Roaming\qko5jmgw.exe
                                                                                    1⤵
                                                                                      PID:4444
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\10atr4ch.exe"
                                                                                        2⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        PID:2424
                                                                                    • C:\Users\Admin\AppData\Roaming\10atr4ch.exe
                                                                                      C:\Users\Admin\AppData\Roaming\10atr4ch.exe
                                                                                      1⤵
                                                                                        PID:3576
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\et2seuwz.exe"
                                                                                          2⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          PID:968
                                                                                      • C:\Users\Admin\AppData\Roaming\et2seuwz.exe
                                                                                        C:\Users\Admin\AppData\Roaming\et2seuwz.exe
                                                                                        1⤵
                                                                                          PID:5052
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cd4vmodf.exe"
                                                                                            2⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            PID:4980
                                                                                        • C:\Users\Admin\AppData\Roaming\cd4vmodf.exe
                                                                                          C:\Users\Admin\AppData\Roaming\cd4vmodf.exe
                                                                                          1⤵
                                                                                            PID:1272
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\o24uaahv.exe"
                                                                                              2⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              PID:2484
                                                                                          • C:\Users\Admin\AppData\Roaming\o24uaahv.exe
                                                                                            C:\Users\Admin\AppData\Roaming\o24uaahv.exe
                                                                                            1⤵
                                                                                              PID:5000
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hrfvibzd.exe"
                                                                                                2⤵
                                                                                                  PID:1696

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                    Reconnaissance

                                                                                                    Resource Development

                                                                                                    Initial Access

                                                                                                    Execution

                                                                                                    Command and Scripting Interpreter

                                                                                                    1
                                                                                                    T1059

                                                                                                    PowerShell

                                                                                                    1
                                                                                                    T1059.001

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Persistence

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    1
                                                                                                    T1547

                                                                                                    Registry Run Keys / Startup Folder

                                                                                                    1
                                                                                                    T1547.001

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Privilege Escalation

                                                                                                    Access Token Manipulation

                                                                                                    1
                                                                                                    T1134

                                                                                                    Parent PID Spoofing

                                                                                                    1
                                                                                                    T1134.004

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    1
                                                                                                    T1547

                                                                                                    Registry Run Keys / Startup Folder

                                                                                                    1
                                                                                                    T1547.001

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Defense Evasion

                                                                                                    Access Token Manipulation

                                                                                                    1
                                                                                                    T1134

                                                                                                    Parent PID Spoofing

                                                                                                    1
                                                                                                    T1134.004

                                                                                                    Hide Artifacts

                                                                                                    1
                                                                                                    T1564

                                                                                                    Hidden Files and Directories

                                                                                                    1
                                                                                                    T1564.001

                                                                                                    Masquerading

                                                                                                    1
                                                                                                    T1036

                                                                                                    Match Legitimate Name or Location

                                                                                                    1
                                                                                                    T1036.005

                                                                                                    Modify Registry

                                                                                                    2
                                                                                                    T1112

                                                                                                    Credential Access

                                                                                                    Discovery

                                                                                                    Query Registry

                                                                                                    2
                                                                                                    T1012

                                                                                                    System Information Discovery

                                                                                                    2
                                                                                                    T1082

                                                                                                    System Network Configuration Discovery

                                                                                                    1
                                                                                                    T1016

                                                                                                    Lateral Movement

                                                                                                    Collection

                                                                                                    Command and Control

                                                                                                    Web Service

                                                                                                    1
                                                                                                    T1102

                                                                                                    Exfiltration

                                                                                                    Impact

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    RuntimeBroker.exe.log
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
                                                                                                    • Size 1KB
                                                                                                    • SHA256 134d2bf114bac63c38eb575024baab59755e5bce5550e89e38b68057956eaccc
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    ircidkie.exe.log
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ircidkie.exe.log
                                                                                                    • Size 859B
                                                                                                    • SHA256 978228083a455adcd3407c110bf18d613f544ad37c47bc2d92a7be87f6c3168d
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    powershell.exe.log
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                    • Size 3KB
                                                                                                    • SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 29173c8d4dfb89cc2e244d3bf23db070c4aa1e08420fb62808c45226e12ea295
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 057dc9b8f7c35b6fb55f8a2618fb75057ada88a95629c4414ed67e9fc2542247
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 119a4e580cac67ff92e83f9200f1b7aa760c29c9f846b105731888dbff3da644
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 6e1b7399dd34670a45049d8277fcf071ff714ae9fec382c909abe3d3f77492e7
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 6814b74f3f95da7aa1de9f6e629aa3d908e3d1603f0a724bb3ae7ae381834e9c
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 6b830d4238dcf55ab6d900a1422bc43c1fea43e8b0f4746b3a18d978cefd9142
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 e3e3c6b847f77d8bc467b69d25beb685e9c1b92e5b23cedfb54983c4accffc0b
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 79b642bb5e891e139113a05c3e4da77264cbaa0a3c46abd8766213cd0edb2192
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 359f4116adf02b56a97acd0663da54e03f7fecec3c67a14d3db4c194e145c667
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 43d3c3113c66141b3a1f1f1bbf2d32a80128d029903ca58db09e9c6a9410ef9e
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 f6c41d71efdb8e40b75efeeb26cfa0ad2789082baf128aee3a5dca26409077cf
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 f8abcfc4432aa1052262db5854f2732f33142a4b7fc0b8dffc7463b0791c6308
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 8985c0a0e906b970e974f2841ff37489f37f5a029cab6b9e1a86eda6406a0c45
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 fc11fabec8268cef1c52f0db67f23390bcf7c96c31376f2a93a7b104dd932f74
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 862f07e297a99a62b5e51b56d9ac97a2417d2ce7ff1ee01f6f0e45cd4c087cee
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 3d54f3965dfd12a94155f8f24aca3123a15d24cafbc52ba4dcb46b6173f19c35
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 a518703a1552666bd5ba7daf5a53d696aeb71bff73b92fa147d4f3e892c3c3ce
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 df1163792fe7c000400918e60721e19a72750a36fa7e723afb97c2083da5693e
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 443c0539d5ed93a1c04cb3b184b0f7a2c494b0459a646fb681f3f94a714e1faf
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 e7e8a4def273d0e298b8aac873652004bebb98a7e424f5896d85819068e894c5
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 313690a5bea10becc948a438d4197abe7d6116e1f36cc094bfe63ac4b76bc704
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 5c09ae4bd7edd4d26fc157b2eeaf2c1dfe81dc9ff551c5f359773443de7b0d1f
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 8c7a181a57f70244cda67dbe474763dd031c066b340fc20a8b7cea09b4562e06
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 a99bb45c15e7b13de98561fdae201b18b46b0d19731cc117f1428196d6016b0e
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 1KB
                                                                                                    • SHA256 b62f7cff896354646fd63e67f61d6bdf504c35c901f05b48ca905535a603ae3b
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    __PSScriptPolicyTest_3dq1cb4y.gj1.ps1
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3dq1cb4y.gj1.ps1
                                                                                                    • Size 60B
                                                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    RuntimeBroker.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
                                                                                                    • Size 100KB
                                                                                                    • SHA256 579dfced8f02a7e1e6e8df10c400117d3127ead7231776a1e467eb507261e920
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    lcmwxfho.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\lcmwxfho.exe
                                                                                                    • Size 234KB
                                                                                                    • SHA256 071b182afc551f116e0bad87839dd451673cb0e75f16cf1847fa66c4f15a9b71
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    memory/2744-3-0x000001E646900000-0x000001E646910000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2744-4-0x000001E646900000-0x000001E646910000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2744-13-0x000001E646900000-0x000001E646910000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2744-5-0x000001E6468B0000-0x000001E6468D2000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2744-17-0x000001E647500000-0x000001E64771D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4024-84-0x0000012A1E1F0000-0x0000012A1E202000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4308-37-0x000001E4C5FF0000-0x000001E4C6002000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4308-36-0x000001E4C5FF0000-0x000001E4C6002000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4308-21-0x000001E4C5F30000-0x000001E4C5F42000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4308-18-0x000001E4C37D0000-0x000001E4C37E5000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4440-0-0x0000000000280000-0x00000000002C0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4440-2-0x000000001AEC0000-0x000000001AED0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4440-1-0x000000001AEC0000-0x000000001AED0000-memory.dmp
                                                                                                    Download