Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

1.rar

windows10-2004-x64

10

0oj3.exe

windows10-2004-x64

10

interception.dll

windows10-2004-x64

1

libcrypto-3-x64.dll

windows10-2004-x64

1

netlimiter....0.exe

windows10-2004-x64

7

onnxruntime.dll

windows10-2004-x64

1

opencv_world490.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    900s
  • max time network
    861s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2024, 21:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0oj3.exe

  • Size

    37.0MB

  • MD5

    d57050cc8f1d71bb068a181301146855

  • SHA1

    564deb2344ea43dd519ee0000642cb0ced55da83

  • SHA256

    08058004805b7054e6dd6c55e1aebfa356cddd46167aae7de4322d4c3ae79db1

  • SHA512

    43af8130465347d06e23838bc652a94b8d06518d81c40f32f87d78d87a485ae23b13d7585f3e05f0231b9f6f59e383b98617b268519d1c6742b7309c1da494e4

  • SSDEEP

    786432:b/gO+cE2+qOnY9ZBLcf5jJGlbarkt0PAmyrL+rXrO37:bEcEGbLwjubcktYbO37

Score
10/10
asyncratserviceexecutionpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.6.1

Botnet

service

C2

193.57.137.78:5555

Mutex

Q8ghiNEV5vpA

Attributes
  • delay

    3

  • install

    true

  • install_file

    cmd.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 61 IoCs
  • Loads dropped DLL 12 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 14 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 17 IoCs
  • Modifies registry class 9 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Executes dropped EXE
    PID:616
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      2⤵
        PID:792
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Executes dropped EXE
        PID:60
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Executes dropped EXE
      PID:676
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p
      1⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:780
      • C:\Windows\system32\wbem\unsecapp.exe
        C:\Windows\system32\wbem\unsecapp.exe -Embedding
        2⤵
        • Executes dropped EXE
        PID:3004
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        2⤵
          PID:3756
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          2⤵
          • Executes dropped EXE
          PID:3884
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          2⤵
          • Loads dropped DLL
          PID:3948
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          2⤵
            PID:4032
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            2⤵
            • Executes dropped EXE
            PID:4084
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            2⤵
            • Executes dropped EXE
            PID:2120
          • C:\Windows\system32\SppExtComObj.exe
            C:\Windows\system32\SppExtComObj.exe -Embedding
            2⤵
            • Executes dropped EXE
            PID:3980
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            2⤵
              PID:4104
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
              2⤵
              • Executes dropped EXE
              PID:4260
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              2⤵
              • Executes dropped EXE
              PID:2776
            • C:\Windows\system32\wbem\wmiprvse.exe
              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
              2⤵
              • Checks BIOS information in registry
              • Loads dropped DLL
              • Checks SCSI registry key(s)
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:3324
            • C:\Windows\System32\mousocoreworker.exe
              C:\Windows\System32\mousocoreworker.exe -Embedding
              2⤵
              • Loads dropped DLL
              PID:4172
            • C:\Windows\system32\backgroundTaskHost.exe
              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              2⤵
                PID:3896
              • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                2⤵
                • Loads dropped DLL
                PID:652
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                2⤵
                  PID:4400
              • C:\Windows\system32\fontdrvhost.exe
                "fontdrvhost.exe"
                1⤵
                  PID:788
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k RPCSS -p
                  1⤵
                  • Executes dropped EXE
                  PID:896
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                  1⤵
                  • Executes dropped EXE
                  PID:948
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                  1⤵
                  • Executes dropped EXE
                  PID:516
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                  1⤵
                  • Executes dropped EXE
                  PID:816
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                  1⤵
                  • Executes dropped EXE
                  PID:1012
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  PID:1104
                  • C:\Windows\system32\taskhostw.exe
                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                    2⤵
                    • Executes dropped EXE
                    PID:3060
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  1⤵
                  • Executes dropped EXE
                  PID:1124
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1132
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                  1⤵
                  • Executes dropped EXE
                  PID:1184
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1260
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1312
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                  1⤵
                  • Executes dropped EXE
                  PID:1348
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                  1⤵
                  • Executes dropped EXE
                  PID:1408
                  • C:\Windows\system32\sihost.exe
                    sihost.exe
                    2⤵
                    • Executes dropped EXE
                    PID:2852
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                  1⤵
                  • Executes dropped EXE
                  PID:1488
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                  1⤵
                  • Executes dropped EXE
                  PID:1532
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                  1⤵
                  • Executes dropped EXE
                  PID:1544
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                  1⤵
                  • Executes dropped EXE
                  PID:1652
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1700
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                  1⤵
                  • Executes dropped EXE
                  PID:1712
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                  1⤵
                  • Executes dropped EXE
                  PID:1796
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                  1⤵
                  • Executes dropped EXE
                  PID:1820
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                  1⤵
                  • Executes dropped EXE
                  PID:1912
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                  1⤵
                  • Executes dropped EXE
                  PID:1920
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                  1⤵
                  • Executes dropped EXE
                  PID:1972
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                  1⤵
                  • Executes dropped EXE
                  PID:1980
                • C:\Windows\System32\spoolsv.exe
                  C:\Windows\System32\spoolsv.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1684
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                  1⤵
                  • Executes dropped EXE
                  PID:2108
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                  1⤵
                  • Executes dropped EXE
                  PID:2168
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2212
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                  1⤵
                  • Executes dropped EXE
                  PID:2312
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                  1⤵
                  • Executes dropped EXE
                  PID:2400
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                  1⤵
                  • Executes dropped EXE
                  PID:2408
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                  1⤵
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  PID:2576
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2620
                • C:\Windows\sysmon.exe
                  C:\Windows\sysmon.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2640
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                  1⤵
                  • Executes dropped EXE
                  PID:2688
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                  1⤵
                  • Executes dropped EXE
                  PID:2740
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                  1⤵
                  • Executes dropped EXE
                  PID:2912
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                  1⤵
                  • Executes dropped EXE
                  PID:3092
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                  1⤵
                  • Executes dropped EXE
                  PID:3352
                • C:\Windows\Explorer.EXE
                  C:\Windows\Explorer.EXE
                  1⤵
                  • Executes dropped EXE
                  PID:3432
                  • C:\Users\Admin\AppData\Local\Temp\0oj3.exe
                    "C:\Users\Admin\AppData\Local\Temp\0oj3.exe"
                    2⤵
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: RenamesItself
                    • Suspicious use of WriteProcessMemory
                    PID:2176
                    • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                      cmd.exe
                      3⤵
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: RenamesItself
                      • Suspicious use of WriteProcessMemory
                      PID:1792
                      • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                        "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
                        4⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3108
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"' & exit
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4400
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"'
                            6⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:3632
                        • C:\Windows\System32\sc.exe
                          "C:\Windows\System32\sc.exe" create AutoRunService binPath="C:\Program Files\cmd.exe" type=own start=auto
                          5⤵
                          • Launches sc.exe
                          PID:3524
                        • C:\Windows\System32\sc.exe
                          "C:\Windows\System32\sc.exe" start AutoRunService
                          5⤵
                          • Loads dropped DLL
                          • Launches sc.exe
                          PID:636
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            6⤵
                            • Loads dropped DLL
                            • Suspicious use of SetWindowsHookEx
                            PID:2360
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                  • Executes dropped EXE
                  PID:3556
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                  1⤵
                  • Executes dropped EXE
                  PID:5016
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                  1⤵
                  • Executes dropped EXE
                  PID:3664
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                  1⤵
                  • Executes dropped EXE
                  PID:960
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                  1⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  PID:3680
                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                  1⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:1456
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                  1⤵
                  • Loads dropped DLL
                  PID:3840
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                  1⤵
                  • Executes dropped EXE
                  PID:2892
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                  1⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:3512
                • C:\Windows\servicing\TrustedInstaller.exe
                  C:\Windows\servicing\TrustedInstaller.exe
                  1⤵
                  • Loads dropped DLL
                  PID:5100
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                  1⤵
                  • Loads dropped DLL
                  PID:4892
                • C:\Program Files\cmd.exe
                  "C:\Program Files\cmd.exe"
                  1⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2436

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                System Services

                1
                T1569

                Service Execution

                1
                T1569.002

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Modify Registry

                1
                T1112

                Credential Access

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                6
                T1012

                System Information Discovery

                6
                T1082

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files\cmd.exe
                  Filesize

                  1.9MB

                  MD5

                  5d864ba27836417dbbb494b3a5d888a9

                  SHA1

                  66b87eb33a31d18ac8c89d237c2235b80ecc1b79

                  SHA256

                  0f916874ee10e6b39afb2319eb33ee8f6b6d1b11f223ce859ead0b1375f84b36

                  SHA512

                  6f59639c1b1ec0f928347d2ec7da1c46a5b2c9ef3cff71d2e4ec8009b6a97ca0f033d27a830d4efd697f99982c2a86f6620cd9e392918756425223ca9caafdf6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                  Filesize

                  2.2MB

                  MD5

                  dd2b4161313175caffafa7fa4ee184c6

                  SHA1

                  e660e3063e7771425e1edfffc45d8387c090fb59

                  SHA256

                  c2572e03276acd9c8b641606eb123a304ddfcb1bab172706ce863b1102e42bf4

                  SHA512

                  ed567c0d9827969a66c43dd7c5ac552c18a4f7f4c9063cda30badceddb0397faa14dbef4bb7730b00dc78e55d6f05adc3c149e37a6517f944e4d179e1ae49ce0

                  Download Submit

                • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                  Filesize

                  328B

                  MD5

                  6540e20f8320b9ca0b5a4a754d433861

                  SHA1

                  b4ea3d8981584d81702e6e1869469ed71a82422f

                  SHA256

                  dd0561f12baff9807d08529dc0737e6ff69cb2d782bf20ee8a518a6804e986de

                  SHA512

                  5dbfe134bbd6d861285991ae24dbbc7661a4d0753e0de11dc4eee3ea8bfb55d74ec9c8091fefabdf193dd3206645d2c28ffa8ac6379bde2449ce4f46379265e2

                  Download Submit

                • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
                  Filesize

                  330B

                  MD5

                  e5e3c3a4911d1111afa8581ccce4b779

                  SHA1

                  464162ca79900da3c05295cbc18f441e74c9a38f

                  SHA256

                  3e077acaf6cb6c2e56ab9af0dcfe710ca68fca0736aa5f75f5b2c0f61dcfd0ec

                  SHA512

                  56aa47f7c94004792f9dc476d9ec6704c068899aaa9c44f87158d268120f56e5be544f946ac48f18859615e715a7baa01592a7b24fdfd636aa59eccccb69f381

                  Download Submit

                • C:\Windows\system32\ASChelp.dll
                  Filesize

                  112KB

                  MD5

                  6a0f36515a46c1a29da10d9aaf6c2193

                  SHA1

                  47f57d38c99d2e9d6cdbb8c8ef9da9eb2b9f6365

                  SHA256

                  ee45c3f9d8b46a1414a313b356c14ef728847072ad01791924eef53215f2e937

                  SHA512

                  3e33c23b2d0de819fa7cdde962c14934b14d81438f5df0b48e450a851ded2f03809ee80246241d8df2c8768f12a4176792f39808534fdbaea8d00cd41b3a6e02

                  Download Submit

                • memory/1792-19-0x00007FF732A50000-0x00007FF733A50000-memory.dmp

                  Filesize

                  16.0MB

                  Download

                • memory/1792-11-0x00007FF732A50000-0x00007FF733A50000-memory.dmp

                  Filesize

                  16.0MB

                  Download

                • memory/2176-0-0x00007FFF4F0D0000-0x00007FFF4F0D2000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/2176-6-0x00007FF732A50000-0x00007FF733A50000-memory.dmp

                  Filesize

                  16.0MB

                  Download

                • memory/2176-2-0x00007FF732A50000-0x00007FF733A50000-memory.dmp

                  Filesize

                  16.0MB

                  Download

                • memory/2176-1-0x00007FFF4F0E0000-0x00007FFF4F0E2000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/2436-32-0x000001459B840000-0x000001459BA2C000-memory.dmp

                  Filesize

                  1.9MB

                  Download

                • memory/3108-17-0x0000011CF6800000-0x0000011CF6A42000-memory.dmp

                  Filesize

                  2.3MB

                  Download

                • memory/3108-18-0x0000011CF86B0000-0x0000011CF86B6000-memory.dmp

                  Filesize

                  24KB

                  Download

                • memory/3512-132-0x00000209F8FD0000-0x00000209F8FD4000-memory.dmp

                  Filesize

                  16KB

                  Download

                • memory/3512-133-0x00000209F8F10000-0x00000209F8F11000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3512-137-0x00000209F8ED0000-0x00000209F8ED1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3756-111-0x000001C1E1E00000-0x000001C1E1E08000-memory.dmp

                  Filesize

                  32KB

                  Download