asyncrat | 53ff78b28192c5bcff9d2ebb969478dde46da1ffc70216a62dcb213d20244b01

Analysis

max time kernel
207s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Infected.exe
Size

63KB
MD5

45db61adfe86228dd20597126a684af8
SHA1

3aa8f5b1c78b1361f7bd5dfa5b7dd24139318451
SHA256

53ff78b28192c5bcff9d2ebb969478dde46da1ffc70216a62dcb213d20244b01
SHA512

87575618fcb0324fdc671c19a6046802b92276944f18f1ddc56dea20ae86ca33ed0aa52f559a711313ecdc80885da2fd980ead9fe0397e434b5701c66e5490cf
SSDEEP

768:ijSu/n3jzh78J4C8A+XTSazcBRL5JTk1+T4KSBGHmDbD/ph0oXiYlDgh/5Sugdph:UrzV4dSJYUbdh9AIugdpqKmY7

Score

10^/10

asyncrat default ransomware rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

comment-seasons.gl.at.ply.gg:13056

Attributes

delay
1
install
true
install_file
susamogus.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/files/0x0007000000023c87-11.dat	family_asyncrat

Renames multiple (1280) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Infected.exesusamogus.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Infected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	susamogus.exe

Executes dropped EXE 1 IoCs

Processes:

susamogus.exe

pid	Process
4192	susamogus.exe

Drops file in Program Files directory 64 IoCs

Processes:

susamogus.exe

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png	susamogus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ShareProvider_CopyFile24x24.scale-125.png	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.contrast-white_scale-200.png	susamogus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif	susamogus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WideTile.scale-125.png	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\SmallTile.scale-125.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\162.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png	susamogus.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml	susamogus.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png	susamogus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\rt.jar	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\THMBNAIL.PNG	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\3.png	susamogus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\LargeTile.scale-125.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_contrast-black.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-64_contrast-black.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-400_contrast-black.png	susamogus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.tree.dat	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\PREVIEW.GIF	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\SmallTile.scale-125.png	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-125_contrast-white.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-64_contrast-white.png	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-400.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	susamogus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125_contrast-black.png	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-125_contrast-white.png	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\PREVIEW.GIF	susamogus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-125.png	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\SmallTile.scale-125.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileSmallSquare.scale-100.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-36_contrast-black.png	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png	susamogus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-125_contrast-high.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-150.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML	susamogus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png	susamogus.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_scale-200.png	susamogus.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png	susamogus.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrome.7z	susamogus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md	susamogus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
1932	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
4000	schtasks.exe
3596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

Processes:

Infected.exetaskmgr.exesusamogus.exetaskmgr.exe

pid	Process
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
1764	Infected.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
4192	susamogus.exe
2544	taskmgr.exe
2544	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

Infected.exesusamogus.exetaskmgr.exetaskmgr.exe

description	pid	Process
Token: SeDebugPrivilege	1764	Infected.exe
Token: SeDebugPrivilege	4192	susamogus.exe
Token: SeDebugPrivilege	2544	taskmgr.exe
Token: SeSystemProfilePrivilege	2544	taskmgr.exe
Token: SeCreateGlobalPrivilege	2544	taskmgr.exe
Token: 33	2544	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2544	taskmgr.exe
Token: SeDebugPrivilege	2612	taskmgr.exe
Token: SeSystemProfilePrivilege	2612	taskmgr.exe
Token: SeCreateGlobalPrivilege	2612	taskmgr.exe
Token: 33	2612	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2612	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exetaskmgr.exe

pid	Process
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exetaskmgr.exe

pid	Process
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2544	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe
2612	taskmgr.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Infected.execmd.execmd.exesusamogus.execmd.exe

description	pid	Process	procid_target
PID 1764 wrote to memory of 1052	1764	Infected.exe	82
PID 1764 wrote to memory of 1052	1764	Infected.exe	82
PID 1764 wrote to memory of 3480	1764	Infected.exe	84
PID 1764 wrote to memory of 3480	1764	Infected.exe	84
PID 3480 wrote to memory of 1932	3480	cmd.exe	86
PID 3480 wrote to memory of 1932	3480	cmd.exe	86
PID 1052 wrote to memory of 4000	1052	cmd.exe	87
PID 1052 wrote to memory of 4000	1052	cmd.exe	87
PID 3480 wrote to memory of 4192	3480	cmd.exe	88
PID 3480 wrote to memory of 4192	3480	cmd.exe	88
PID 4192 wrote to memory of 4348	4192	susamogus.exe	99
PID 4192 wrote to memory of 4348	4192	susamogus.exe	99
PID 4348 wrote to memory of 3596	4348	cmd.exe	101
PID 4348 wrote to memory of 3596	4348	cmd.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Infected.exe
"C:\Users\Admin\AppData\Local\Temp\Infected.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "susamogus" /tr '"C:\Users\Admin\AppData\Roaming\susamogus.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "susamogus" /tr '"C:\Users\Admin\AppData\Roaming\susamogus.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpADF3.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1932
- - C:\Users\Admin\AppData\Roaming\susamogus.exe
    "C:\Users\Admin\AppData\Roaming\susamogus.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "susamogus" /tr '"C:\Users\Admin\AppData\Local\Temp\susamogus.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4348
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "susamogus" /tr '"C:\Users\Admin\AppData\Local\Temp\susamogus.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3596

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2544

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
941314b42590e569f8d8553961e3b229

SHA1
f8d16cbcd9f38486432e8743154efa42b347f5a3

SHA256
532b4249234192f7bdbbb3f94b07c405983cdc4289eb96c71d4642036966379b

SHA512
4bf4ab9e9e97b111f39b6d0f7765726f05b1401d80e4fed6b39b266ff1b56f312d7c44cd10032425d7aab55ca4f8d58920df138829581f5e0193189897d7ccd0

Download Submit
C:\Program Files\Java\jre-1.8\COPYRIGHT

Filesize
3KB

MD5
e7eda2c8700b3b580fe885f3bbd5d73b

SHA1
1383033126ed0867c702075f28723ceb07b8e8db

SHA256
2b55e78fb4cda3aabb5099b97a6d871a0891804354f9ae60f6934a50f9ed12bd

SHA512
87844a57e95747d0994bcb17d7d6265f49f34d36ca33a44ae76a9ad873e77303cf553eb77e0e9bc9a33ec2c284557f88393991eac814eaecd719eea9d43afb84

Download Submit
C:\Program Files\Java\jre-1.8\LICENSE

Filesize
48B

MD5
971d314711bbd9cb0d99fc7abd124a19

SHA1
9ae699add5bc65e4ad6cea4755c6a676e89f12fa

SHA256
3072ad1eb91c2a774ec947022801fd83935612d5a9b7a9473817905e219787d5

SHA512
ed33779fce9c4558e944b7007a03688a945fcd9e3fb8fc225d5ea9f3669984bde1f692c1829748776268355887a664d737ea37be1136c02f1ef8aba0fbc382c7

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
192B

MD5
9b79afa6e5c92fd841917d3a5606c863

SHA1
058f4c364bd36048e41af8d6f9914c31ce084ec1

SHA256
6b6dcb9d8d4548414001eb22261363a9113c54ddba218aa452c87c97f325c593

SHA512
0908b9a0b967b0aa37770f83ceb17581450bbcb9a487ce90f50c1d914e38535155634c125d35591873b1afd7c9035e663f141dc19fb8ddcf7102530b75816d4b

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
192B

MD5
39ab3e26e8211dfffb63b4292a641f9f

SHA1
8ac0ab4008cdbc22fd05d4eb8bf6e22066b04a63

SHA256
722ea564d5685a1c91f57836754108110046b1878eabef74309e756b8c4c90ed

SHA512
aebe364187ccde511c70a4986d595b187b5b300adf385a4521c35494ccae99a17ae12b9b750803caed339671d062d086e8b3fa2bbdaea3934c1fdcf7d278c73b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
540a6ec644001142533642bae2007c56

SHA1
69779ae5621019c962ba8978d018907cdc56ee9a

SHA256
2587e6d4ec0db8826aa47a59eb4087e69f2b44643f30a9b26800a16181452a7d

SHA512
533640d45a8f1a4cbaefcfb15b206a29ccc2480bb20b56a2a9e66ebb9eee1a8799832b641d40ee1a49fcccc7db68ccb92fe328d734b5562f6395eb22cd110603

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
74f2f7d3765b8bc812e90a1cffeccd57

SHA1
ceed0e358d5b5cd626830cd242f39f33dd11777b

SHA256
acee5e158f1e306dd6c0dd465240cd0a01c74e0b371066195385fdce29c0d382

SHA512
3cb82bf938d6dac854637f4f61a1ccbbc16a8df2969a29b0c4851c3c6b2030ded620ab5224bb7ef43cdca94c9d12504d42eebed5ace5218321e845b7e0a75cf4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
9f908148cd81075a6496cda09d2be0ac

SHA1
11f4c1009423bfcd5de86f489da4046e12a9c20a

SHA256
577992d754a5ebbf65c688d3b18363926bad544bea6f6d6af8c3e284e4f8335a

SHA512
786f054f610bdb49ab8047ffb2b7c6c4edf81dc58d114ac41092bfc3666434428c269b5835f705207f9eb9378425a2b6809bcbfbca6a77f9d10bbc41d085d676

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
7dfa9c36f88579d7218c7ae488670eaa

SHA1
9a630e55f66b8e70be09cff2e6f12af39e5b659e

SHA256
3fdb1ea415d82993ecb6f8468d922a06923b7cd5899ab9c7e71eb9c46ee72ee3

SHA512
5c635e0759586c035b90347da028bdd9ab5d5bfd286b902cc54cfaa49e1c3ea26a2acc60cc0dd066bb563abd21f9bbe27b08b64dec7e65a9702cd5e3b415a2b8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
93c8f04e8b8c8d3f0c87f9d0ec304fe1

SHA1
ca75ff9641b450dc324ce867c9de4a1fabf9dc03

SHA256
ac4285f58cd11d23103f79e29d3d590076a48bd9a9d6f63c1c3116117488c39f

SHA512
0f09e181755380ddb47a7ad0868f79ca6238f4fedd6bb0c8a242bf1bed5c06947883f04e63addbc544c946eca4c5fcf67091c8e5c23d0054fb722b7b541cc166

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
dbeaee1cd3adefdd8e909079ab2837a8

SHA1
6568e075078ce857d00edd876871d498d276523b

SHA256
7653fd60c99fc70626df85a0a91c07fc680dddbc71a9a56f8c03e129dd33fbdc

SHA512
161b7c26c4db57f74b9955ab3d071bb70f8fe5e386744a8f667824d2c7eb42992435ec313a6a44f01556294d0f9d802d56322a5a58f84c439cc9c2192a563835

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
36a452716fc2f42480f3f6327fc4db61

SHA1
7a67307312b1790b630e66c0a263ff86c5e8f104

SHA256
d201ed74ccac85a75f7772cef9c14205a08dd926a85e5eeb6db75829bad42293

SHA512
3249cdaea18d426eda4c7ea47a6d385db225e0cef4d463abbaee5bc0d9bc294796990a0a5d7588a92f75dd22bde1880459bb12ec52ce42544aafaf1ee0166785

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
0b55f145e703f42ad166c7c96aabe4de

SHA1
72ba38ace81a358a8bf36486950ef1a48c2f285f

SHA256
e34e7ac3ddc68a2b595a503963e5b4ccc24dad98a205e88e7c880afa37209d96

SHA512
6aadc7cc8521cb2bce9a0a5bdf63849b8d34821ba0678f5318d84f32fe4208c5498f953f34f7223440e75e1a9ffcfde4ca1afe5501e75baa7a928606e4adfe9c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
8af3ea16d429cfb0b0ee036fa54a112f

SHA1
9fe1b19aaa2d1a205398869951f47ba4476c9002

SHA256
c7b24d9701ff9b33c00853c66e44cebe74c39924d0615daf78cebf19f1988546

SHA512
02026f8ce9b055e0ce8842a300e84b50c0d0031346b6ff5eef5219b729a2a77fc70320b21d3d4abdd3135fd3f21e242afcef465fb01ded46d2e3bfad0ae5b98c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
b3aabfd97fd6b3da8b798e94c75cc33e

SHA1
332340d550cf8ccd1aa1ae55e1bdb68c9ce1c22d

SHA256
b62b7026b7fc0b253f27771cf2fda9c4614514def95b5f617274f601a61f47a7

SHA512
efca83fb36e013e678e6b8e5e337d230455ceb0f45d33d78a91986f904f1fed48c9a7246908f2a7c6a259be6af2e3a7162d37afdd1ea42b24ab664c27c4be081

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
3e3c8953616e1098aecb744c622c3a79

SHA1
7389d6731bd3a40aaf21a7417d60c19dbe33ec40

SHA256
3fd3dc1f6d2dcc0374bcbc89a1f93338a460fd8f3deaad7874b526be9ed380a4

SHA512
ea36f0e180b2661b4819e369fda112cb42203554305e469d9597e89aaf0a26d90167bcdf69b37d7c3cc0d3efff1d10578efbe5a2de9a7a205156c198913fab8a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
578a700a6712f597978ed7007ccb80cf

SHA1
c73d9fa4e5122c7a25626b7f32c24160762304dc

SHA256
6646d807ac781eebbdd286e716bfd46c157b78d62a469c67c6d0f8c75c3fd2f8

SHA512
cb9540de3803d62493e1f7ca0ca31f95af67dbfaaca7ee13c56b94a9fe498237c0faae5dccb35c28d0abbb6c00e7554ca8de87ea36c60fbea07b742e5d469fc5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
f9042d822b3d92a05b1e2c9f3b02658d

SHA1
b420c83e85fae633681b6fdf34101b92bd7c1c25

SHA256
a7c7b64cb6a0f85cbefd6218eafb4b3e512eaf3fdbddcc3bad87cfe7daf26295

SHA512
4aa2f7735155cd15a64742c8c95ddfb67b5db850d38dd56a00e4027921ed6e41f0fc61b17dc44df0c09670a079974a3fb692c019497e3b78ee8b7c416c326204

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
c48bfe92caf993610b18356aa835db42

SHA1
8e8ce6c81f4c646f4a9df6396738b71ddbab626d

SHA256
d7fc4d67a34e9c9cdd4e9afe7aebd1c35ca9aabf6c6e72bb41b9aed5e54cb67e

SHA512
32ced277570371de8f41de051fb84645a90659bea05e6081eca882c124b1d82a84610b9e77e566d96c3d7b65b478be0e58209ad180ead43f8d4c748b38db11bf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
176B

MD5
11c726d4eb7162e56d677567c36251f2

SHA1
c8d0c3d0979c84aefc9eaf4db1fff513ea30cf11

SHA256
1cb265244fd5b8b284a9c54d0839942e8a70c29d0bc2c9bdd11897cb6dd07031

SHA512
f436d0333aed8dcf85758ad181c8917e9682c3e869cc6a9f8a894370c6e31408ae0a55457ef49d141d0b544bda002a9014cdf1867595c65100bb01718e0503e6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
0ea21bd919d5e1811502c584b9dca2f0

SHA1
13d7c106a1c1fe3af81f4d973ea2587a9aa83404

SHA256
7e9b1139463808afade60273510427966c045823551926bca97ec3993bd15941

SHA512
b7839c934a547ec33a80019a9d40209ec346f123dceaafd5244ca0747f9919c3fa5b7c0b8efda216b1414568cfd8628fe043a18e196adb35358493558f639ee3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
c245922985dbc708acc8bc92d3604b9f

SHA1
1045e76451e2be17f7e00cdcc54c7a6a3560a16b

SHA256
f8bb30c6a9263ba7c413d49bf8ffb9ab19f0de01c0de084e0e574c1000411998

SHA512
6bd50b0f4d86461742f10432bf686c8d966b75cfe7f2bb95d7ea9177c252b8756f93c99da5b3262280668f6ea44066a5005245bd77bace6b0678933786a80e2b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
18d69d56826d31f16a8aa29d7bb79b9e

SHA1
6aca678d212669c7d392dc3d77c38914cb654db6

SHA256
a7ff9350bf6363a6dc0deb3e9e40d80192c19ccf0e29942dec48f0faad51fb30

SHA512
8eef3ea91417d0f922e11d88639b14a9c40185b61141318a9530fc2deb5d1232d05dd6f3d3df01a74cf20f38eff3f33f1a4e1affc9b0a255e85f0743b3943544

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
c4cd22b4c7b05c2189e7ca0435b1426b

SHA1
99d0566a0255acc6ce29a042b59b222871ecde43

SHA256
372fa703e847350b1ed143ae709569bb7c66a67a03d7063d249e251ede9dff43

SHA512
759ad0d4b9837f2bbcb8b7f583fc00f897ac3a1c45f81637eaecb05290be44f46ff823d954dd573153c1f5e8e4884212733346d2f2551fee05e72f07b51fdec9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
795f61e0eba7db7a225285c5c9fd40f5

SHA1
1364c1b0152a3fb1a695dc53ad394f080abef836

SHA256
c17504ddef6da1a29bc02de31c1f2499fa74715c74f056366ac2dbd30ad75525

SHA512
5b54d26d3e2ec835045344350589ccc18744539b503e0f4121b5494f2e40579ef3183354c4e444a8092aaf82926abb7fd0ddfef52db861fc3992e7e7ea31bdbf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
8b3fee253102bebb59c012ba3079d0fd

SHA1
dd778243f2f7b7cd56010763722462a2e0f8085e

SHA256
580a1e88e8a9060c43df9a897cfc0bb61ac3754171605f3c12bf334b53d42e7d

SHA512
97a8ddfaa9b43a5e92abaec216ba5b03164fcc39a2567311b0ec7076aadecfa93338686a6eda18031a7d099d2e451cdbe31684f712a51576210ccc8f3f24f154

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
aa960374f2310967c2fe84ad386f3e00

SHA1
d984d83090f7057bbbb526ac1932f8f32e5a4aa9

SHA256
147ee03a53e0b67c9d68d235af1501e7b49d57f85bd4b7084c91b617e007891d

SHA512
8e0bfc783c2ef2fd0efeab9b2f610e7108d0836465965178bd4347bf1a381fe1ec833a3b3590b5597ca20cdb6779afcacad9c1936943cd85befd01610b2979c4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
79998a3e9231f8404d5b9af716fc9eca

SHA1
e9420b8b273fd52ee6585d3bb84f07c8fac5a955

SHA256
73f37d1e98dd6d023d92bc72d429b46bb31524ba439dcd767feec39dd759fdcd

SHA512
c75e20eaafeff538a4c5457c122e6066708cdae735153532194f31d2a36d52b81ea806605918285ee7f490bda7699b561d5158a18bee3fddf8141d539f6ffd86

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
64fccd29bfbd650abeef09378e10f148

SHA1
94e1a714304974599ca010baa66fa07fffd963e5

SHA256
b8abb52754ac71a718672d073b705113a919cf9b6a9c711fbd2ee2abc9886cad

SHA512
81d17e2066932001d7f391d477532e64041aedf5f01a7964ebf5616df4c8d822e4f4b975a3bfd877b44d6e354850fd8e339d9bfb2507e6d75a79f7a023410fb6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
4c2d474c456c1ac1a23d17c1ca4ddf9b

SHA1
9cfa21083bb140ba044e85805c4ab22af1ac52f6

SHA256
d6ecadee236d999aead77632254d37a9dca76fcd317c1641bee7400982cf3e1c

SHA512
785b5cc97783c2650867efb9addaf97ce349d02790bd5e909bcacbf1fcae8050bea46a110500129e25b1defa29a997bbdaf19139ca739b52b8ce1875e2391746

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
86e5dc695077e6916488bd1a8184604a

SHA1
b9fd812ca0f9618e3ba77aceea35734b4ef1af1b

SHA256
86da77577cdfaf4f9de850ab21671a2d654176d479688d12217bc24def48b4ae

SHA512
e725f6534654ce1db5a90e95dcfca756bf62dd9ed40acdf81270aec6c08dc99abdaadfeb2d8c7c15121d967e1a7ac5a4d41786a79da96c745998c48da8709e59

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
3143f2aca25532282a4ad979b3dcab6b

SHA1
837f167035840d83533123313c83e9370919bb95

SHA256
b091e71bcd787147a17024405bf23fc0d6c50b09807a4d18bf56c31efb872cd2

SHA512
0473c9008eb6b6a643298fa90af6af583fccb435690917be97d542802a53b94db0a24360d89a79cdeb77d408030fc0c1716851afd58cbeca350d42679a72abf6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
4ee0732350961db18519b52b55a54d9f

SHA1
c2d73172a3bb21ade7d50094f9df5e36abb6ae02

SHA256
fe63a4c04749e33f1a8d42018bb584f70d1ab6073765988a4d1d62e0033fb1a4

SHA512
4db688dfadd9e73ab5a9090f8c8f9190b9f246419a72f4cd08b8a598fd09d31b459ed686a9ab7daa6575768a241b06b88c70dff9bdcce02451ac07beb8645403

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
19b280624d0500aa4971512e4e41a883

SHA1
aaf98214f1d43b70c6a455003f07a61cd770ba94

SHA256
6c5d331c556f5f30efd008efeadff10681faaa47b2c3cb2ca95e4933d156e8ea

SHA512
1abb04dd43f73eacfa973778d964269169e4dd86d177b8aef99cd1bbe772934a2ccfd577326b0fe0f8b3cdd08155c0a764e499ce3008cb9ac2c54aa93269c705

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
1fdb951772241a21c8e9d6e6bc39e56d

SHA1
dd0b0783d042d1564676462db725bdcd8fb30f28

SHA256
538c1fc3d4a188c4e6c6ee6e6156742fc5f0b0d7facbe8452184cb2040556455

SHA512
730b2ce5de074d3782afc83876151ab8694f2f54d0392001ae7c5895fb545d09adf598bf177c2097fe688c9072877e85ee327ae9bf81c51598509550fa2f730f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
ebbdf99da6f0d2f47e99cfd359a9abfa

SHA1
b3f4159257f4ea31aa975a0d490eec76518a27f0

SHA256
54ddabfacaa1706084fcb0eb95ac1185569d366c41d9ddf1f4117fa2a9039114

SHA512
35488b1080163e2e1812d2374d0406a3dfe9b4dce0bc8f584b658a4fc55f021f00ddd36c20be16bc24d08be3c1e093b319ab3c57ebb3bb717964d72c8d033d67

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
9b81a4283c55bc0d603971ada6808818

SHA1
d4a1a092bec9c4d55a39d747076fb6f4df94b9d7

SHA256
8ddf62255c929ec7c675eee7c0fb2d5f877fd596542fd1f284f711c4788890a1

SHA512
bece5cd3509f85262cba0241cedbec19f7ee77dfd9fd4bf3c32e38161ecee64816bac464f8dd0a58864287253045c5722746081fd8f4b39b61d42c4394f7d037

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
e1016818e5a78f6dfd552555c5d6c530

SHA1
e6a2631a5086b3d7758818fdfaf0bfa7ef087335

SHA256
02a35e9488eec2eb81cdd611b33685f51c0fa6db5afa485ed0363c64719661c2

SHA512
252af40900be783ccf14849e810ef7822209ff1e4cb29c33a05717f46e371b426c46037a6933df8c70e0dd3fd48d7841f3d2c72875fc3a6d34e869ccd207a3d1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
72e97216e2696e68859720492b48f6d4

SHA1
39d11844853dd60591a9f577f4b41f395ea83c76

SHA256
8d4c0319258bf79df8ec13ce0f953827e0b55699403adbf4a2118c8415bca647

SHA512
9ae2ab633396539b4242f1a82bbc49974acf87c33a2c1116aa7508d9481fe4f5bc638a649921f32f9708ad84e7f2b30c7e025d2f4734cad1588a4493554a87a2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
4dd977f7ab8b6952904a1c1dbde8211b

SHA1
e51e4fe1a6692a5169fe16f71052e579dbca8f55

SHA256
1ae6aeb5391db6263ca31ea544d2a2be68ad42d420950bf6cddfbc5d22ffed2c

SHA512
ce04c4b8eda47a67670b1fe064028fb886f9b2f2fe413eacb489c2034f13016f58a5fb4e00d9bcccfebd3703809a113cd5d6b06f141ca633333279d946782605

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
545d557013e6690ef393866f8652aa70

SHA1
d4167d4d71be8255b32c3b46016bb0cbbc447d66

SHA256
f7a1e6fb47d7852770fb4f50209d43bed2f8cd099f41f76d7e76143a0a53a53e

SHA512
a9a01b2fdbe9b690dd4b1ab4f7cbc69ab8800394af9b8a03d4fffa79c3091fd680fe36c5f6ce58614ce793b0315eea5002c56321c9b5fb4fb1d68a58c25860f5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
816e04698482043997718e383319d249

SHA1
beee95f9bb05ddc219aad038f987499bc3a6f410

SHA256
9138fff1da341b75678aedd383400e67d53730dbcdfe1366c9e9f5eaf5885811

SHA512
4b5aba44c66afcd023322237a7978e3a07278e2c5102b28202247c6202c899df1ec0805c67eb70ec30c29e584f612020a255136bec5eb91c192f4545657408ab

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
ddfd82c5f6d21cdd2b608af9c709b244

SHA1
c37ba1489cfcd22397bad6dd01a5f07eefbe3610

SHA256
c7e2618112fd6baa543efda127140de2673007d7ff578b6a790479dc7199abfc

SHA512
19e340fae16413f512355a25d797df5b5c8740ed42c2a839f985da93c6188f529e78fd1e0224414ffa08953da9a6e1cdfd2ed2d1fef433908cc91fc23feb50aa

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
b5cc311fa1574e79ec49c77e6bcecfda

SHA1
278da40ef69b09b60054132262848103a6fcd6d6

SHA256
1c179295e7490320741daf6a0bf1f71301f3ee33ab546eab413f5204c25c6453

SHA512
646e36f8b72c51d5ca700cf55475923db6e7f954e0769eca596fba9a2ac820fd2544d4d6ae08a0e0c6ae0a770a63b922e28c52f99418af10f77ec8fe1b7aa26a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
5e9d59929349cd012552c8e3b393dd9d

SHA1
d809a785aa5e57a506a11eb973418cc059a27544

SHA256
c567bfde514556e5a3dddc604476d2c79e877e46405fe68326ce5738eda10eb6

SHA512
4f08eac5f319e60ff54c00c9c29c765005d72af35fe7261d2d646d867fc3d09d0910a8bc74f905c7b8d32cbce934ec6ca8e82adb5b4cc9ffdd819ea74307ad15

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1024B

MD5
3794d273ae258b28b7dbabd163308ed0

SHA1
810afe37b6261c73f91e97af6f90618189e7a558

SHA256
6b09e8a03bcab8fcf0f3b228e29e55e3084ad049b10bbeb4bb5f0bec054640cb

SHA512
45e8f8d5d583f283be232dd08e3c9282913d605819ef7cfbe40045cfa3047964ea6ab889f9497b730b4ba1247cece4331d703f39aee597ee0dce64e3fa14699c

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
48B

MD5
3b92f896680046d0b389eceacc1dac7d

SHA1
6898121536cd4e9a35427b6b1ea04f54341348f6

SHA256
ca231551739316df09cc8b9151fe28903c0f4b169d82ee78c2c83143bf811550

SHA512
5b19cea9a4496c738e2ba5f82a385ce76e1918ed8d4a12debff69b3f503e77b8ffde73b52210dc07751eb4338878cad25038cd05d6dbf998060cd05b3a5537cb

Download Submit
C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

Filesize
584KB

MD5
ad5bea7e3c8adbe594ee610e892cae44

SHA1
52202464d28bc38ebba331eceb402cb1e912850d

SHA256
d26a35430986683e91d17e8fb1c594f6ebfec151bc2dda424dd4dba1798019f8

SHA512
b3bab6583cf9d41b326d74ff7e34303dc97c8198603284f7fb54840d9161d9b09bdbb3f695e11e55c30cf077a986b2a1bc91660d192a61cacbdb9052a2d87434

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpADF3.tmp.bat

Filesize
153B

MD5
7b11d1c8308220dcbf8131d827a28d7c

SHA1
cbfddf411c6ae4d60df7a934de9e6a29405aed2b

SHA256
26f1c7c7c7b2001025b07a4eb04cbce02bb2d594644d5f5a2f6121880849bf82

SHA512
974c079aadc9bc98babb04a23239f89fc85c65e0484bed9347c0cabf793f6ab46f67b36ba90483828046e4ce20b7a9b75060db1e188317d6da49a0da1029c7b3

Download Submit
C:\Users\Admin\AppData\Roaming\susamogus.exe

Filesize
63KB

MD5
45db61adfe86228dd20597126a684af8

SHA1
3aa8f5b1c78b1361f7bd5dfa5b7dd24139318451

SHA256
53ff78b28192c5bcff9d2ebb969478dde46da1ffc70216a62dcb213d20244b01

SHA512
87575618fcb0324fdc671c19a6046802b92276944f18f1ddc56dea20ae86ca33ed0aa52f559a711313ecdc80885da2fd980ead9fe0397e434b5701c66e5490cf

Download Submit
memory/1764-8-0x00007FFEBCFA0000-0x00007FFEBDA61000-memory.dmp

Filesize
10.8MB

Download
memory/1764-0-0x00007FFEBCFA3000-0x00007FFEBCFA5000-memory.dmp

Filesize
8KB

Download
memory/1764-1-0x0000000000FB0000-0x0000000000FC6000-memory.dmp

Filesize
88KB

Download
memory/1764-2-0x00007FFEBCFA0000-0x00007FFEBDA61000-memory.dmp

Filesize
10.8MB

Download
memory/1764-7-0x00007FFEBCFA0000-0x00007FFEBDA61000-memory.dmp

Filesize
10.8MB

Download
memory/2544-26-0x000001E69AD00000-0x000001E69AD01000-memory.dmp

Filesize
4KB

Download
memory/2544-28-0x000001E69AD00000-0x000001E69AD01000-memory.dmp

Filesize
4KB

Download
memory/2544-24-0x000001E69AD00000-0x000001E69AD01000-memory.dmp

Filesize
4KB

Download
memory/2544-25-0x000001E69AD00000-0x000001E69AD01000-memory.dmp

Filesize
4KB

Download
memory/2544-18-0x000001E69AD00000-0x000001E69AD01000-memory.dmp

Filesize
4KB

Download
memory/2544-19-0x000001E69AD00000-0x000001E69AD01000-memory.dmp

Filesize
4KB

Download
memory/2544-20-0x000001E69AD00000-0x000001E69AD01000-memory.dmp

Filesize
4KB

Download
memory/2544-30-0x000001E69AD00000-0x000001E69AD01000-memory.dmp

Filesize
4KB

Download
memory/2544-29-0x000001E69AD00000-0x000001E69AD01000-memory.dmp

Filesize
4KB

Download
memory/2544-27-0x000001E69AD00000-0x000001E69AD01000-memory.dmp

Filesize
4KB

Download
memory/4192-15-0x000000001D800000-0x000000001D876000-memory.dmp

Filesize
472KB

Download
memory/4192-289-0x000000001B160000-0x000000001B17C000-memory.dmp

Filesize
112KB

Download
memory/4192-17-0x000000001D7A0000-0x000000001D7BE000-memory.dmp

Filesize
120KB

Download
memory/4192-16-0x0000000003020000-0x0000000003052000-memory.dmp

Filesize
200KB

Download
memory/4192-31-0x000000001D980000-0x000000001DA32000-memory.dmp

Filesize
712KB

Download
memory/4192-47-0x000000001DCA0000-0x000000001DCD4000-memory.dmp

Filesize
208KB

Download
memory/4192-48-0x000000001E6D0000-0x000000001EB9C000-memory.dmp

Filesize
4.8MB

Download