donutloader | 071b182afc551f116e0bad87839dd451673cb0e75f16cf1847fa66c4f15a9b71

Analysis

max time kernel
45s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient_protected.exe
Size 234KB
Sample261024-k87csays3j
SHA256 071b182afc551f116e0bad87839dd451673cb0e75f16cf1847fa66c4f15a9b71
MD5 870b0b55bf20894fd900663b3ada0680
SHA1 232877d12f76773ef1b4ac5f10d4262af158a38c
SHA512 5a4ab0080a82c85f895d07d3504e8be7fd86bc30809e1540b5b272389944d4de9ef083cff1a0f23d4940924080f9a64462470020446688b78c7e701ea5dff904
SSDEEP 6144:+/qK2eAFngHBY/263FPScKX1Y9jy7aQtyNU7jvQb:+/4rxgg2OOwuaI3
TLSH
T13E349C244A912521C28D82FF74270B15E7F8CA7E7323D35AEE2A06F3F9D16E74E91550
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader neptunerat loader persistence privilege_escalation trojan

Malware Config

Extracted

Family

neptunerat

193.161.193.99:45108

Attributes

filename
USB.exe
group
MasonGroup
key
I3ujeNhtTGMSOz0g
rat_name
MasonRAT

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral3/memory/3692-45-0x00000134053E0000-0x00000134053F5000-memory.dmp	family_donutloader

Detects NeptuneRAT stealer 1 IoCs

resource	yara_rule
behavioral3/memory/3692-48-0x0000013405FD0000-0x0000013405FE2000-memory.dmp	family_neptunerat

Modifies visibility of hidden/system files in Explorer 2 TTPs 21 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	MasonClient_protected.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	mfxy3224.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	0xwimaei.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ouaykpod.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	msfto5ya.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	r3sty4ax.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	0ooknoyg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wtops1g0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lvtfzayl.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	j0b1spb2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	u5qx1tmq.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	pe4x2m4y.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vtt2qz1o.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	gtfonanz.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qi3pvqc2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	kz5om0xt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ffoer1ka.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	44v0ajei.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	mdvkur0b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	oxn4zpem.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	rzr1fqrb.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3692 created 2736	3692	RuntimeBroker.exe	51
PID 2988 created 2736	2988	RuntimeBroker.exe	51
PID 3792 created 2736	3792	RuntimeBroker.exe	51

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3132	powershell.exe
4208	powershell.exe
2036	powershell.exe
5928	powershell.exe
2864	powershell.exe
4184	powershell.exe
232	powershell.exe
5056	powershell.exe
2996	powershell.exe
4668	powershell.exe
2512	powershell.exe
2612	powershell.exe
1728	powershell.exe
5788	powershell.exe
1924	powershell.exe
5968	powershell.exe
4652	powershell.exe
4448	powershell.exe
5608	powershell.exe
4700	powershell.exe
5448	powershell.exe
1264	powershell.exe
5880	powershell.exe
1960	powershell.exe
3512	powershell.exe
5912	powershell.exe
5356	powershell.exe
4312	powershell.exe
5804	powershell.exe
4196	powershell.exe
4620	powershell.exe
4776	powershell.exe
5156	powershell.exe
3304	powershell.exe
4448	powershell.exe
5456	powershell.exe
4688	powershell.exe
2028	powershell.exe
5328	powershell.exe
5396	powershell.exe
580	powershell.exe
4148	powershell.exe
3408	powershell.exe
3968	powershell.exe
4844	powershell.exe
3732	powershell.exe
3240	powershell.exe
3268	powershell.exe
5428	powershell.exe
5900	powershell.exe
5372	powershell.exe
1960	powershell.exe
3788	powershell.exe
2188	powershell.exe
2620	powershell.exe
4780	powershell.exe
3300	powershell.exe
5540	powershell.exe
6132	powershell.exe
5216	powershell.exe
4456	powershell.exe
2244	powershell.exe
3900	powershell.exe
5624	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 6 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	gtfonanz.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	wtops1g0.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	ouaykpod.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	oxn4zpem.exe

Executes dropped EXE 23 IoCs

pid	Process
2408	0ooknoyg.exe
3048	oxn4zpem.exe
920	RuntimeBroker.exe
5192	gtfonanz.exe
5500	wtops1g0.exe
4400	qi3pvqc2.exe
4588	mfxy3224.exe
4116	0xwimaei.exe
3568	lvtfzayl.exe
5652	kz5om0xt.exe
5704	rzr1fqrb.exe
4384	j0b1spb2.exe
1764	u5qx1tmq.exe
5988	pe4x2m4y.exe
5780	RuntimeBroker.exe
936	ouaykpod.exe
2944	ffoer1ka.exe
2336	msfto5ya.exe
4720	vtt2qz1o.exe
5892	r3sty4ax.exe
1744	44v0ajei.exe
1556	mdvkur0b.exe
1944	kco0hxda.exe

Adds Run key to start application 2 TTPs 49 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvtfzayl = "C:\\Users\\Admin\\AppData\\Roaming\\lvtfzayl.exe"	0xwimaei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kz5om0xt = "C:\\Users\\Admin\\AppData\\Roaming\\kz5om0xt.exe"	lvtfzayl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ouaykpod = "C:\\Users\\Admin\\AppData\\Roaming\\ouaykpod.exe"	pe4x2m4y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msfto5ya = "C:\\Users\\Admin\\AppData\\Roaming\\msfto5ya.exe"	ffoer1ka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vtt2qz1o = "C:\\Users\\Admin\\AppData\\Roaming\\vtt2qz1o.exe"	msfto5ya.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdvkur0b = "C:\\Users\\Admin\\AppData\\Roaming\\mdvkur0b.exe"	44v0ajei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tf2timr2 = "C:\\Users\\Admin\\AppData\\Roaming\\tf2timr2.exe"	kco0hxda.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\oxn4zpem = "C:\\Users\\Admin\\AppData\\Roaming\\oxn4zpem.exe"	0ooknoyg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oxn4zpem = "C:\\Users\\Admin\\AppData\\Roaming\\oxn4zpem.exe"	0ooknoyg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe"	RuntimeBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rzr1fqrb = "C:\\Users\\Admin\\AppData\\Roaming\\rzr1fqrb.exe"	kz5om0xt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\r3sty4ax = "C:\\Users\\Admin\\AppData\\Roaming\\r3sty4ax.exe"	vtt2qz1o.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\tf2timr2 = "C:\\Users\\Admin\\AppData\\Roaming\\tf2timr2.exe"	kco0hxda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0ooknoyg = "C:\\Users\\Admin\\AppData\\Roaming\\0ooknoyg.exe"	MasonClient_protected.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wtops1g0 = "C:\\Users\\Admin\\AppData\\Roaming\\wtops1g0.exe"	gtfonanz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\0xwimaei = "C:\\Users\\Admin\\AppData\\Roaming\\0xwimaei.exe"	mfxy3224.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0xwimaei = "C:\\Users\\Admin\\AppData\\Roaming\\0xwimaei.exe"	mfxy3224.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvtfzayl = "C:\\Users\\Admin\\AppData\\Roaming\\lvtfzayl.exe"	0xwimaei.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\ffoer1ka = "C:\\Users\\Admin\\AppData\\Roaming\\ffoer1ka.exe"	ouaykpod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtfonanz = "C:\\Users\\Admin\\AppData\\Roaming\\gtfonanz.exe"	oxn4zpem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtfonanz = "C:\\Users\\Admin\\AppData\\Roaming\\gtfonanz.exe"	oxn4zpem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtops1g0 = "C:\\Users\\Admin\\AppData\\Roaming\\wtops1g0.exe"	gtfonanz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\mfxy3224 = "C:\\Users\\Admin\\AppData\\Roaming\\mfxy3224.exe"	qi3pvqc2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\kz5om0xt = "C:\\Users\\Admin\\AppData\\Roaming\\kz5om0xt.exe"	lvtfzayl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ffoer1ka = "C:\\Users\\Admin\\AppData\\Roaming\\ffoer1ka.exe"	ouaykpod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\r3sty4ax = "C:\\Users\\Admin\\AppData\\Roaming\\r3sty4ax.exe"	vtt2qz1o.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\qi3pvqc2 = "C:\\Users\\Admin\\AppData\\Roaming\\qi3pvqc2.exe"	wtops1g0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\j0b1spb2 = "C:\\Users\\Admin\\AppData\\Roaming\\j0b1spb2.exe"	rzr1fqrb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\44v0ajei = "C:\\Users\\Admin\\AppData\\Roaming\\44v0ajei.exe"	r3sty4ax.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\44v0ajei = "C:\\Users\\Admin\\AppData\\Roaming\\44v0ajei.exe"	r3sty4ax.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\kco0hxda = "C:\\Users\\Admin\\AppData\\Roaming\\kco0hxda.exe"	mdvkur0b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\0ooknoyg = "C:\\Users\\Admin\\AppData\\Roaming\\0ooknoyg.exe"	MasonClient_protected.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe"	RuntimeBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qi3pvqc2 = "C:\\Users\\Admin\\AppData\\Roaming\\qi3pvqc2.exe"	wtops1g0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\rzr1fqrb = "C:\\Users\\Admin\\AppData\\Roaming\\rzr1fqrb.exe"	kz5om0xt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\pe4x2m4y = "C:\\Users\\Admin\\AppData\\Roaming\\pe4x2m4y.exe"	u5qx1tmq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\msfto5ya = "C:\\Users\\Admin\\AppData\\Roaming\\msfto5ya.exe"	ffoer1ka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\u5qx1tmq = "C:\\Users\\Admin\\AppData\\Roaming\\u5qx1tmq.exe"	j0b1spb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\ouaykpod = "C:\\Users\\Admin\\AppData\\Roaming\\ouaykpod.exe"	pe4x2m4y.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\vtt2qz1o = "C:\\Users\\Admin\\AppData\\Roaming\\vtt2qz1o.exe"	msfto5ya.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kco0hxda = "C:\\Users\\Admin\\AppData\\Roaming\\kco0hxda.exe"	mdvkur0b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mfxy3224 = "C:\\Users\\Admin\\AppData\\Roaming\\mfxy3224.exe"	qi3pvqc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\j0b1spb2 = "C:\\Users\\Admin\\AppData\\Roaming\\j0b1spb2.exe"	rzr1fqrb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\u5qx1tmq = "C:\\Users\\Admin\\AppData\\Roaming\\u5qx1tmq.exe"	j0b1spb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pe4x2m4y = "C:\\Users\\Admin\\AppData\\Roaming\\pe4x2m4y.exe"	u5qx1tmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdvkur0b = "C:\\Users\\Admin\\AppData\\Roaming\\mdvkur0b.exe"	44v0ajei.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe"	RuntimeBroker.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
8	raw.githubusercontent.com
1	raw.githubusercontent.com
2	raw.githubusercontent.com
3	raw.githubusercontent.com
4	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 46 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rzr1fqrb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wtops1g0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mfxy3224.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	kz5om0xt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vtt2qz1o.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	44v0ajei.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wtops1g0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	qi3pvqc2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mfxy3224.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vtt2qz1o.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	r3sty4ax.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	oxn4zpem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msfto5ya.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kz5om0xt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pe4x2m4y.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ouaykpod.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ouaykpod.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ffoer1ka.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	j0b1spb2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	u5qx1tmq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	u5qx1tmq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MasonClient_protected.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MasonClient_protected.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0ooknoyg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0xwimaei.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lvtfzayl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0ooknoyg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	oxn4zpem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gtfonanz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0xwimaei.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ffoer1ka.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msfto5ya.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	qi3pvqc2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	lvtfzayl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rzr1fqrb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	r3sty4ax.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mdvkur0b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mdvkur0b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gtfonanz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	j0b1spb2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pe4x2m4y.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	44v0ajei.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
780	schtasks.exe
4804	schtasks.exe
2388	schtasks.exe
2424	schtasks.exe
3276	schtasks.exe
1172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2612	powershell.exe
2612	powershell.exe
2420	MasonClient_protected.exe
2420	MasonClient_protected.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe
2408	0ooknoyg.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	MasonClient_protected.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2408	0ooknoyg.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	3692	RuntimeBroker.exe
Token: SeDebugPrivilege	3048	oxn4zpem.exe
Token: SeDebugPrivilege	3692	RuntimeBroker.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeDebugPrivilege	5192	gtfonanz.exe
Token: SeDebugPrivilege	5372	powershell.exe
Token: SeDebugPrivilege	5500	wtops1g0.exe
Token: SeDebugPrivilege	920	RuntimeBroker.exe
Token: SeDebugPrivilege	920	RuntimeBroker.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	4400	qi3pvqc2.exe
Token: SeDebugPrivilege	2988	RuntimeBroker.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	4588	mfxy3224.exe
Token: SeDebugPrivilege	2988	RuntimeBroker.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	4116	0xwimaei.exe
Token: SeDebugPrivilege	3792	RuntimeBroker.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	3568	lvtfzayl.exe
Token: SeDebugPrivilege	3792	RuntimeBroker.exe
Token: SeDebugPrivilege	5624	powershell.exe
Token: SeDebugPrivilege	5652	kz5om0xt.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	5704	rzr1fqrb.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	4384	j0b1spb2.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeDebugPrivilege	1764	u5qx1tmq.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	5988	pe4x2m4y.exe
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeDebugPrivilege	936	ouaykpod.exe
Token: SeDebugPrivilege	5780	RuntimeBroker.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	5780	RuntimeBroker.exe
Token: SeDebugPrivilege	2944	ffoer1ka.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	2336	msfto5ya.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	4720	vtt2qz1o.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	5892	r3sty4ax.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	1744	44v0ajei.exe
Token: SeDebugPrivilege	5628	powershell.exe
Token: SeDebugPrivilege	1556	mdvkur0b.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeDebugPrivilege	1944	kco0hxda.exe
Token: SeDebugPrivilege	4700	powershell.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2612	2420	MasonClient_protected.exe	81
PID 2408 wrote to memory of 4456	2408	0ooknoyg.exe	86
PID 2420 wrote to memory of 3692	2420	MasonClient_protected.exe	59
PID 3692 wrote to memory of 1172	3692	RuntimeBroker.exe	89
PID 2408 wrote to memory of 3692	2408	0ooknoyg.exe	59
PID 3048 wrote to memory of 3240	3048	oxn4zpem.exe	94
PID 5192 wrote to memory of 5372	5192	gtfonanz.exe	98
PID 3048 wrote to memory of 920	3048	oxn4zpem.exe	93
PID 920 wrote to memory of 780	920	RuntimeBroker.exe	102
PID 5192 wrote to memory of 920	5192	gtfonanz.exe	93
PID 5500 wrote to memory of 2864	5500	wtops1g0.exe	104
PID 5500 wrote to memory of 2988	5500	wtops1g0.exe	83
PID 2988 wrote to memory of 4804	2988	RuntimeBroker.exe	108
PID 4400 wrote to memory of 4808	4400	qi3pvqc2.exe	110
PID 4400 wrote to memory of 2988	4400	qi3pvqc2.exe	83
PID 4588 wrote to memory of 2244	4588	mfxy3224.exe	152
PID 4588 wrote to memory of 3792	4588	mfxy3224.exe	60
PID 3792 wrote to memory of 2388	3792	RuntimeBroker.exe	118
PID 4116 wrote to memory of 3900	4116	0xwimaei.exe	120
PID 4116 wrote to memory of 3792	4116	0xwimaei.exe	60
PID 3568 wrote to memory of 5624	3568	lvtfzayl.exe	125
PID 5652 wrote to memory of 3268	5652	kz5om0xt.exe	129
PID 5704 wrote to memory of 5428	5704	rzr1fqrb.exe	202
PID 4384 wrote to memory of 4184	4384	j0b1spb2.exe	137
PID 1764 wrote to memory of 232	1764	u5qx1tmq.exe	141
PID 5988 wrote to memory of 3252	5988	pe4x2m4y.exe	145
PID 5988 wrote to memory of 5780	5988	pe4x2m4y.exe	147
PID 5780 wrote to memory of 2424	5780	RuntimeBroker.exe	189
PID 936 wrote to memory of 2244	936	ouaykpod.exe	259
PID 936 wrote to memory of 5780	936	ouaykpod.exe	147
PID 2944 wrote to memory of 4360	2944	ffoer1ka.exe	156
PID 2336 wrote to memory of 1960	2336	msfto5ya.exe	268
PID 4720 wrote to memory of 3132	4720	vtt2qz1o.exe	164
PID 5892 wrote to memory of 5328	5892	r3sty4ax.exe	168
PID 1744 wrote to memory of 5628	1744	44v0ajei.exe	172
PID 1556 wrote to memory of 5900	1556	mdvkur0b.exe	469
PID 1944 wrote to memory of 4700	1944	kco0hxda.exe	180

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2736
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1172
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4804
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792

C:\Users\Admin\AppData\Local\Temp\MasonClient_protected.exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient_protected.exe"
1⤵
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0ooknoyg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2612

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988

C:\Users\Admin\AppData\Roaming\0ooknoyg.exe
C:\Users\Admin\AppData\Roaming\0ooknoyg.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oxn4zpem.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4456

C:\Users\Admin\AppData\Roaming\oxn4zpem.exe
C:\Users\Admin\AppData\Roaming\oxn4zpem.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gtfonanz.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3240

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:780

C:\Users\Admin\AppData\Roaming\gtfonanz.exe
C:\Users\Admin\AppData\Roaming\gtfonanz.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wtops1g0.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5372

C:\Users\Admin\AppData\Roaming\wtops1g0.exe
C:\Users\Admin\AppData\Roaming\wtops1g0.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qi3pvqc2.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2864

C:\Users\Admin\AppData\Roaming\qi3pvqc2.exe
C:\Users\Admin\AppData\Roaming\qi3pvqc2.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mfxy3224.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4808

C:\Users\Admin\AppData\Roaming\mfxy3224.exe
C:\Users\Admin\AppData\Roaming\mfxy3224.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0xwimaei.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2244

C:\Users\Admin\AppData\Roaming\0xwimaei.exe
C:\Users\Admin\AppData\Roaming\0xwimaei.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lvtfzayl.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3900

C:\Users\Admin\AppData\Roaming\lvtfzayl.exe
C:\Users\Admin\AppData\Roaming\lvtfzayl.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kz5om0xt.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5624

C:\Users\Admin\AppData\Roaming\kz5om0xt.exe
C:\Users\Admin\AppData\Roaming\kz5om0xt.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rzr1fqrb.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3268

C:\Users\Admin\AppData\Roaming\rzr1fqrb.exe
C:\Users\Admin\AppData\Roaming\rzr1fqrb.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\j0b1spb2.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5428

C:\Users\Admin\AppData\Roaming\j0b1spb2.exe
C:\Users\Admin\AppData\Roaming\j0b1spb2.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\u5qx1tmq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4184

C:\Users\Admin\AppData\Roaming\u5qx1tmq.exe
C:\Users\Admin\AppData\Roaming\u5qx1tmq.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pe4x2m4y.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:232

C:\Users\Admin\AppData\Roaming\pe4x2m4y.exe
C:\Users\Admin\AppData\Roaming\pe4x2m4y.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ouaykpod.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3252

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2424

C:\Users\Admin\AppData\Roaming\ouaykpod.exe
C:\Users\Admin\AppData\Roaming\ouaykpod.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ffoer1ka.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2244

C:\Users\Admin\AppData\Roaming\ffoer1ka.exe
C:\Users\Admin\AppData\Roaming\ffoer1ka.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msfto5ya.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4360

C:\Users\Admin\AppData\Roaming\msfto5ya.exe
C:\Users\Admin\AppData\Roaming\msfto5ya.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vtt2qz1o.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1960

C:\Users\Admin\AppData\Roaming\vtt2qz1o.exe
C:\Users\Admin\AppData\Roaming\vtt2qz1o.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\r3sty4ax.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3132

C:\Users\Admin\AppData\Roaming\r3sty4ax.exe
C:\Users\Admin\AppData\Roaming\r3sty4ax.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\44v0ajei.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5328

C:\Users\Admin\AppData\Roaming\44v0ajei.exe
C:\Users\Admin\AppData\Roaming\44v0ajei.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mdvkur0b.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5628

C:\Users\Admin\AppData\Roaming\mdvkur0b.exe
C:\Users\Admin\AppData\Roaming\mdvkur0b.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kco0hxda.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5900

C:\Users\Admin\AppData\Roaming\kco0hxda.exe
C:\Users\Admin\AppData\Roaming\kco0hxda.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tf2timr2.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4700

C:\Users\Admin\AppData\Roaming\tf2timr2.exe
C:\Users\Admin\AppData\Roaming\tf2timr2.exe
1⤵
PID:5820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\its2qypd.exe"
  2⤵
  PID:4920

C:\Users\Admin\AppData\Roaming\its2qypd.exe
C:\Users\Admin\AppData\Roaming\its2qypd.exe
1⤵
PID:836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cdjk1nma.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4312
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2424

C:\Users\Admin\AppData\Roaming\cdjk1nma.exe
C:\Users\Admin\AppData\Roaming\cdjk1nma.exe
1⤵
PID:1596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ldha0jlv.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4780

C:\Users\Admin\AppData\Roaming\ldha0jlv.exe
C:\Users\Admin\AppData\Roaming\ldha0jlv.exe
1⤵
PID:5320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wf5txv4f.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1960

C:\Users\Admin\AppData\Roaming\wf5txv4f.exe
C:\Users\Admin\AppData\Roaming\wf5txv4f.exe
1⤵
PID:3700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cvwljz2a.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5448

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5428

C:\Users\Admin\AppData\Roaming\cvwljz2a.exe
C:\Users\Admin\AppData\Roaming\cvwljz2a.exe
1⤵
PID:5264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yppitlyw.exe"
  2⤵
  PID:2516

C:\Users\Admin\AppData\Roaming\yppitlyw.exe
C:\Users\Admin\AppData\Roaming\yppitlyw.exe
1⤵
PID:3928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kvcf42ri.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1264

C:\Users\Admin\AppData\Roaming\kvcf42ri.exe
C:\Users\Admin\AppData\Roaming\kvcf42ri.exe
1⤵
PID:444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\43kzo3ji.exe"
  2⤵
  PID:2664

C:\Users\Admin\AppData\Roaming\43kzo3ji.exe
C:\Users\Admin\AppData\Roaming\43kzo3ji.exe
1⤵
PID:4404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qrb5yqoi.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5880

C:\Users\Admin\AppData\Roaming\qrb5yqoi.exe
C:\Users\Admin\AppData\Roaming\qrb5yqoi.exe
1⤵
PID:1488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\n0t2ps0a.exe"
  2⤵
  PID:1112

C:\Users\Admin\AppData\Roaming\n0t2ps0a.exe
C:\Users\Admin\AppData\Roaming\n0t2ps0a.exe
1⤵
PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rwwqtoch.exe"
  2⤵
  PID:888

C:\Users\Admin\AppData\Roaming\rwwqtoch.exe
C:\Users\Admin\AppData\Roaming\rwwqtoch.exe
1⤵
PID:1712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\j522lapg.exe"
  2⤵
  PID:4812

C:\Users\Admin\AppData\Roaming\j522lapg.exe
C:\Users\Admin\AppData\Roaming\j522lapg.exe
1⤵
PID:5624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hk2tppzj.exe"
  2⤵
  PID:5280

C:\Users\Admin\AppData\Roaming\hk2tppzj.exe
C:\Users\Admin\AppData\Roaming\hk2tppzj.exe
1⤵
PID:4224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\g3a4jev3.exe"
  2⤵
  PID:5632

C:\Users\Admin\AppData\Roaming\g3a4jev3.exe
C:\Users\Admin\AppData\Roaming\g3a4jev3.exe
1⤵
PID:2112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jrwbokup.exe"
  2⤵
  PID:1688

C:\Users\Admin\AppData\Roaming\jrwbokup.exe
C:\Users\Admin\AppData\Roaming\jrwbokup.exe
1⤵
PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vvbtwtat.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5804

C:\Users\Admin\AppData\Roaming\vvbtwtat.exe
C:\Users\Admin\AppData\Roaming\vvbtwtat.exe
1⤵
PID:5476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1xqjqtsl.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4196

C:\Users\Admin\AppData\Roaming\1xqjqtsl.exe
C:\Users\Admin\AppData\Roaming\1xqjqtsl.exe
1⤵
PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vykzzclm.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5056

C:\Users\Admin\AppData\Roaming\vykzzclm.exe
C:\Users\Admin\AppData\Roaming\vykzzclm.exe
1⤵
PID:6024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qd025fl3.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2996

C:\Users\Admin\AppData\Roaming\qd025fl3.exe
C:\Users\Admin\AppData\Roaming\qd025fl3.exe
1⤵
PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\p3ounbfv.exe"
  2⤵
  PID:1460

C:\Users\Admin\AppData\Roaming\p3ounbfv.exe
C:\Users\Admin\AppData\Roaming\p3ounbfv.exe
1⤵
PID:3640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mdvu5vpk.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1728

C:\Users\Admin\AppData\Roaming\mdvu5vpk.exe
C:\Users\Admin\AppData\Roaming\mdvu5vpk.exe
1⤵
PID:1756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\w4nrolyk.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1960

C:\Users\Admin\AppData\Roaming\w4nrolyk.exe
C:\Users\Admin\AppData\Roaming\w4nrolyk.exe
1⤵
PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\c0bszmvt.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5396

C:\Users\Admin\AppData\Roaming\c0bszmvt.exe
C:\Users\Admin\AppData\Roaming\c0bszmvt.exe
1⤵
PID:1808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2wnqegbk.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5456

C:\Users\Admin\AppData\Roaming\2wnqegbk.exe
C:\Users\Admin\AppData\Roaming\2wnqegbk.exe
1⤵
PID:6108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0ugiftli.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4208

C:\Users\Admin\AppData\Roaming\0ugiftli.exe
C:\Users\Admin\AppData\Roaming\0ugiftli.exe
1⤵
PID:3776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\3se5gbcx.exe"
  2⤵
  PID:3028

C:\Users\Admin\AppData\Roaming\3se5gbcx.exe
C:\Users\Admin\AppData\Roaming\3se5gbcx.exe
1⤵
PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lsv0nvaj.exe"
  2⤵
  PID:4580

C:\Users\Admin\AppData\Roaming\lsv0nvaj.exe
C:\Users\Admin\AppData\Roaming\lsv0nvaj.exe
1⤵
PID:1820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zowvpfdy.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2036

C:\Users\Admin\AppData\Roaming\zowvpfdy.exe
C:\Users\Admin\AppData\Roaming\zowvpfdy.exe
1⤵
PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zesgp0p4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3512

C:\Users\Admin\AppData\Roaming\zesgp0p4.exe
C:\Users\Admin\AppData\Roaming\zesgp0p4.exe
1⤵
PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\drxieqdg.exe"
  2⤵
  PID:1460

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
1⤵
PID:1492
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3276

C:\Users\Admin\AppData\Roaming\drxieqdg.exe
C:\Users\Admin\AppData\Roaming\drxieqdg.exe
1⤵
PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\by1cnc0u.exe"
  2⤵
  PID:5436

C:\Users\Admin\AppData\Roaming\by1cnc0u.exe
C:\Users\Admin\AppData\Roaming\by1cnc0u.exe
1⤵
PID:5380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5ol04stp.exe"
  2⤵
  PID:5548

C:\Users\Admin\AppData\Roaming\5ol04stp.exe
C:\Users\Admin\AppData\Roaming\5ol04stp.exe
1⤵
PID:4532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iedu5fdj.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:580

C:\Users\Admin\AppData\Roaming\iedu5fdj.exe
C:\Users\Admin\AppData\Roaming\iedu5fdj.exe
1⤵
PID:756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ewlynwxv.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5788

C:\Users\Admin\AppData\Roaming\ewlynwxv.exe
C:\Users\Admin\AppData\Roaming\ewlynwxv.exe
1⤵
PID:844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\c5hxisbx.exe"
  2⤵
  PID:5072

C:\Users\Admin\AppData\Roaming\c5hxisbx.exe
C:\Users\Admin\AppData\Roaming\c5hxisbx.exe
1⤵
PID:5936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mi1szu3i.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5912

C:\Users\Admin\AppData\Roaming\mi1szu3i.exe
C:\Users\Admin\AppData\Roaming\mi1szu3i.exe
1⤵
PID:5308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\txf2jxcg.exe"
  2⤵
  PID:1420

C:\Users\Admin\AppData\Roaming\txf2jxcg.exe
C:\Users\Admin\AppData\Roaming\txf2jxcg.exe
1⤵
PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dlgvxw3n.exe"
  2⤵
  PID:5312

C:\Users\Admin\AppData\Roaming\dlgvxw3n.exe
C:\Users\Admin\AppData\Roaming\dlgvxw3n.exe
1⤵
PID:1144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0rousu2o.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1924

C:\Users\Admin\AppData\Roaming\0rousu2o.exe
C:\Users\Admin\AppData\Roaming\0rousu2o.exe
1⤵
PID:5172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\x1bf2deo.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5968

C:\Users\Admin\AppData\Roaming\x1bf2deo.exe
C:\Users\Admin\AppData\Roaming\x1bf2deo.exe
1⤵
PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\m0xl5j5z.exe"
  2⤵
  PID:1780

C:\Users\Admin\AppData\Roaming\m0xl5j5z.exe
C:\Users\Admin\AppData\Roaming\m0xl5j5z.exe
1⤵
PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fbihye24.exe"
  2⤵
  PID:3988

C:\Users\Admin\AppData\Roaming\fbihye24.exe
C:\Users\Admin\AppData\Roaming\fbihye24.exe
1⤵
PID:3176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ykttmq2r.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4652

C:\Users\Admin\AppData\Roaming\ykttmq2r.exe
C:\Users\Admin\AppData\Roaming\ykttmq2r.exe
1⤵
PID:4672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\h5yk1knx.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4448

C:\Users\Admin\AppData\Roaming\h5yk1knx.exe
C:\Users\Admin\AppData\Roaming\h5yk1knx.exe
1⤵
PID:892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pojjcepl.exe"
  2⤵
  PID:6008

C:\Users\Admin\AppData\Roaming\pojjcepl.exe
C:\Users\Admin\AppData\Roaming\pojjcepl.exe
1⤵
PID:3156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uxcgouo4.exe"
  2⤵
  PID:980

C:\Users\Admin\AppData\Roaming\uxcgouo4.exe
C:\Users\Admin\AppData\Roaming\uxcgouo4.exe
1⤵
PID:5848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vnosd1kc.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3300

C:\Users\Admin\AppData\Roaming\vnosd1kc.exe
C:\Users\Admin\AppData\Roaming\vnosd1kc.exe
1⤵
PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\agow4hx4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5356

C:\Users\Admin\AppData\Roaming\agow4hx4.exe
C:\Users\Admin\AppData\Roaming\agow4hx4.exe
1⤵
PID:5168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aujpqa4z.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5608

C:\Users\Admin\AppData\Roaming\aujpqa4z.exe
C:\Users\Admin\AppData\Roaming\aujpqa4z.exe
1⤵
PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nxcaf3ws.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5928

C:\Users\Admin\AppData\Roaming\nxcaf3ws.exe
C:\Users\Admin\AppData\Roaming\nxcaf3ws.exe
1⤵
PID:2908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\njcgsn0e.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4620

C:\Users\Admin\AppData\Roaming\njcgsn0e.exe
C:\Users\Admin\AppData\Roaming\njcgsn0e.exe
1⤵
PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ohbu35qj.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4776

C:\Users\Admin\AppData\Roaming\ohbu35qj.exe
C:\Users\Admin\AppData\Roaming\ohbu35qj.exe
1⤵
PID:4484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vcpgocul.exe"
  2⤵
  PID:984

C:\Users\Admin\AppData\Roaming\vcpgocul.exe
C:\Users\Admin\AppData\Roaming\vcpgocul.exe
1⤵
PID:5416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nbslzmst.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3788

C:\Users\Admin\AppData\Roaming\nbslzmst.exe
C:\Users\Admin\AppData\Roaming\nbslzmst.exe
1⤵
PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5f3pq1cu.exe"
  2⤵
  PID:5436

C:\Users\Admin\AppData\Roaming\5f3pq1cu.exe
C:\Users\Admin\AppData\Roaming\5f3pq1cu.exe
1⤵
PID:3184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sgjaajoy.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2188

C:\Users\Admin\AppData\Roaming\sgjaajoy.exe
C:\Users\Admin\AppData\Roaming\sgjaajoy.exe
1⤵
PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2xipaqnw.exe"
  2⤵
  PID:3852

C:\Users\Admin\AppData\Roaming\2xipaqnw.exe
C:\Users\Admin\AppData\Roaming\2xipaqnw.exe
1⤵
PID:3936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\u5ufrmnu.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5540

C:\Users\Admin\AppData\Roaming\u5ufrmnu.exe
C:\Users\Admin\AppData\Roaming\u5ufrmnu.exe
1⤵
PID:4908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nbueho4z.exe"
  2⤵
  PID:4580

C:\Users\Admin\AppData\Roaming\nbueho4z.exe
C:\Users\Admin\AppData\Roaming\nbueho4z.exe
1⤵
PID:6104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\n1asx55n.exe"
  2⤵
  PID:4776

C:\Users\Admin\AppData\Roaming\n1asx55n.exe
C:\Users\Admin\AppData\Roaming\n1asx55n.exe
1⤵
PID:4388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uivllz2a.exe"
  2⤵
  PID:4300

C:\Users\Admin\AppData\Roaming\uivllz2a.exe
C:\Users\Admin\AppData\Roaming\uivllz2a.exe
1⤵
PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bs2hv25v.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4148

C:\Users\Admin\AppData\Roaming\bs2hv25v.exe
C:\Users\Admin\AppData\Roaming\bs2hv25v.exe
1⤵
PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1sba4ybx.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5156

C:\Users\Admin\AppData\Roaming\1sba4ybx.exe
C:\Users\Admin\AppData\Roaming\1sba4ybx.exe
1⤵
PID:3580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\refpvoax.exe"
  2⤵
  PID:5812

C:\Users\Admin\AppData\Roaming\refpvoax.exe
C:\Users\Admin\AppData\Roaming\refpvoax.exe
1⤵
PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hi013xwo.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3304

C:\Users\Admin\AppData\Roaming\hi013xwo.exe
C:\Users\Admin\AppData\Roaming\hi013xwo.exe
1⤵
PID:5852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\3kjbj3yd.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3408

C:\Users\Admin\AppData\Roaming\3kjbj3yd.exe
C:\Users\Admin\AppData\Roaming\3kjbj3yd.exe
1⤵
PID:2284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qcluiugf.exe"
  2⤵
  PID:2552

C:\Users\Admin\AppData\Roaming\qcluiugf.exe
C:\Users\Admin\AppData\Roaming\qcluiugf.exe
1⤵
PID:6052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\k5trfce4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4448

C:\Users\Admin\AppData\Roaming\k5trfce4.exe
C:\Users\Admin\AppData\Roaming\k5trfce4.exe
1⤵
PID:3796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fwxxt25m.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4688

C:\Users\Admin\AppData\Roaming\fwxxt25m.exe
C:\Users\Admin\AppData\Roaming\fwxxt25m.exe
1⤵
PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cm2z3su0.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2028

C:\Users\Admin\AppData\Roaming\cm2z3su0.exe
C:\Users\Admin\AppData\Roaming\cm2z3su0.exe
1⤵
PID:2764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hpyeft34.exe"
  2⤵
  PID:5340

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5900

C:\Users\Admin\AppData\Roaming\hpyeft34.exe
C:\Users\Admin\AppData\Roaming\hpyeft34.exe
1⤵
PID:4024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\i2rmq1rh.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2620

C:\Users\Admin\AppData\Roaming\i2rmq1rh.exe
C:\Users\Admin\AppData\Roaming\i2rmq1rh.exe
1⤵
PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rf4kd0v4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3968

C:\Users\Admin\AppData\Roaming\rf4kd0v4.exe
C:\Users\Admin\AppData\Roaming\rf4kd0v4.exe
1⤵
PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\w3vjzvw4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4844

C:\Users\Admin\AppData\Roaming\w3vjzvw4.exe
C:\Users\Admin\AppData\Roaming\w3vjzvw4.exe
1⤵
PID:2996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vvyxxke5.exe"
  2⤵
  PID:468

C:\Users\Admin\AppData\Roaming\vvyxxke5.exe
C:\Users\Admin\AppData\Roaming\vvyxxke5.exe
1⤵
PID:5576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pvajrgp1.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3732

C:\Users\Admin\AppData\Roaming\pvajrgp1.exe
C:\Users\Admin\AppData\Roaming\pvajrgp1.exe
1⤵
PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uusvcmgd.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4668

C:\Users\Admin\AppData\Roaming\uusvcmgd.exe
C:\Users\Admin\AppData\Roaming\uusvcmgd.exe
1⤵
PID:5460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ofrnq2zb.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6132

C:\Users\Admin\AppData\Roaming\ofrnq2zb.exe
C:\Users\Admin\AppData\Roaming\ofrnq2zb.exe
1⤵
PID:5996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\21q5xhyh.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5216

C:\Users\Admin\AppData\Roaming\21q5xhyh.exe
C:\Users\Admin\AppData\Roaming\21q5xhyh.exe
1⤵
PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wwpjctgn.exe"
  2⤵
  PID:1400

C:\Users\Admin\AppData\Roaming\wwpjctgn.exe
C:\Users\Admin\AppData\Roaming\wwpjctgn.exe
1⤵
PID:424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sulyzdld.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2512

C:\Users\Admin\AppData\Roaming\sulyzdld.exe
C:\Users\Admin\AppData\Roaming\sulyzdld.exe
1⤵
PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\a54203rk.exe"
  2⤵
  PID:5296

C:\Users\Admin\AppData\Roaming\a54203rk.exe
C:\Users\Admin\AppData\Roaming\a54203rk.exe
1⤵
PID:5212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5clreirl.exe"
  2⤵
  PID:5844

C:\Users\Admin\AppData\Roaming\5clreirl.exe
C:\Users\Admin\AppData\Roaming\5clreirl.exe
1⤵
PID:5304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
Size 1KB
SHA256 7b9294002c9fcd85ee06e8b1caac5acf1fdda0d0a91819567abf0244537c69f2
MD5 1b1546b3a9d17ecdbc5ebe5a6374e545
SHA1 07f0e4be9653de7d0fe3b6160095a640527a47c2
SHA512 4d6099209db72c3b3ae92b3f13dc1102e407359bdc960b8e71f1a6f09fbeda03faa9b37990581407e4fdc68b4adcd800c87774be820d00ef8429d88d4561bebe
TLSH
T11B21AF312372B1D889163F431C5D2A846BFF4719BA50EE0CB698635ED92605B6F212F3
MD5 SHA1 SHA512 TLSH

Submit Download

gtfonanz.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\gtfonanz.exe.log
Size 859B
SHA256 a6f7d3892a001df1aafe2eaf221a3b09a4fdad23ad642a62b9cc50fd25f9415f
MD5 b80ab36515c0740685e38a5cd01e292a
SHA1 ebea40ce14021888f2c869576ad62b98b7c73c8a
SHA512 a9ad31c000c2264f8a9b7bac6bc60edd7ecf0d1c946a4bb3e57d824283c6b65e59344e834bcbf563586211078ddb895af13e4c697bea2c4a907982bbc5fbd4a0
TLSH
T1CE1166313376A0D889163F821C1E56C957BF4329A550AD08B998624DED3601B6B213E3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 dd16566ab212783e890f0f99ec0b0c501fe85b02aa0ad98f5f9d91ff9080af9d
MD5 e658fc871c669b740efbcf9672996959
SHA1 e465bea74f7a594b5f04633332f03e7bdfb71f76
SHA512 d1d7a7fec050718614f9fe88b7f9be07ca2f5280f7605f1ae456ab61f58a69090511ba38cbeb66064ca3c23104d8dcef1732672238b5ac29634a8c50025a39b4
SSDEEP 96:iq4uYqGEo9xx+incqKXqntzYfqCYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXqntzYfqRWq2Iz+wx
TLSH
T1E191EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download