Overview

overview

10

Static

static

3

1.rar

windows7-x64

7

1.rar

windows10-2004-x64

1

0oj3.exe

windows7-x64

1

0oj3.exe

windows10-2004-x64

10

Config.ini

windows7-x64

1

Config.ini

windows10-2004-x64

1

interception.dll

windows7-x64

1

interception.dll

windows10-2004-x64

1

libcrypto-3-x64.dll

windows7-x64

1

libcrypto-3-x64.dll

windows10-2004-x64

1

onnxruntime.dll

windows7-x64

1

onnxruntime.dll

windows10-2004-x64

1

opencv_world490.dll

windows7-x64

1

opencv_world490.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2024 21:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0oj3.exe

  • Size

    37.0MB

  • MD5

    d57050cc8f1d71bb068a181301146855

  • SHA1

    564deb2344ea43dd519ee0000642cb0ced55da83

  • SHA256

    08058004805b7054e6dd6c55e1aebfa356cddd46167aae7de4322d4c3ae79db1

  • SHA512

    43af8130465347d06e23838bc652a94b8d06518d81c40f32f87d78d87a485ae23b13d7585f3e05f0231b9f6f59e383b98617b268519d1c6742b7309c1da494e4

  • SSDEEP

    786432:b/gO+cE2+qOnY9ZBLcf5jJGlbarkt0PAmyrL+rXrO37:bEcEGbLwjubcktYbO37

Score
10/10
asyncratservicedefense_evasionexecutionpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.6.1

Botnet

service

C2

193.57.137.78:5555

Mutex

Q8ghiNEV5vpA

Attributes
  • delay

    3

  • install

    true

  • install_file

    cmd.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 62 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 17 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 23 IoCs
  • Modifies registry class 7 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Executes dropped EXE
    PID:612
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      2⤵
        PID:780
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Executes dropped EXE
        PID:64
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Executes dropped EXE
      PID:660
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:776
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p
        1⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:792
        • C:\Windows\system32\wbem\unsecapp.exe
          C:\Windows\system32\wbem\unsecapp.exe -Embedding
          2⤵
          • Executes dropped EXE
          PID:2492
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          2⤵
            PID:3880
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            2⤵
            • Executes dropped EXE
            PID:3968
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4028
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            2⤵
              PID:1036
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              2⤵
              • Executes dropped EXE
              PID:3736
            • C:\Windows\system32\SppExtComObj.exe
              C:\Windows\system32\SppExtComObj.exe -Embedding
              2⤵
              • Executes dropped EXE
              PID:2508
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              2⤵
                PID:2704
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                2⤵
                • Executes dropped EXE
                PID:4324
              • C:\Windows\System32\RuntimeBroker.exe
                C:\Windows\System32\RuntimeBroker.exe -Embedding
                2⤵
                • Executes dropped EXE
                PID:4380
              • C:\Windows\system32\wbem\wmiprvse.exe
                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                2⤵
                • Checks BIOS information in registry
                • Loads dropped DLL
                • Checks SCSI registry key(s)
                • Checks processor information in registry
                • Enumerates system info in registry
                PID:1452
              • C:\Windows\System32\mousocoreworker.exe
                C:\Windows\System32\mousocoreworker.exe -Embedding
                2⤵
                • Loads dropped DLL
                • Checks processor information in registry
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:1960
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                2⤵
                  PID:3140
                • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                  2⤵
                  • Loads dropped DLL
                  PID:4496
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k RPCSS -p
                1⤵
                • Executes dropped EXE
                PID:900
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                1⤵
                • Executes dropped EXE
                PID:948
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                1⤵
                • Executes dropped EXE
                PID:508
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                • Executes dropped EXE
                PID:988
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                1⤵
                • Executes dropped EXE
                PID:1012
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                • Executes dropped EXE
                PID:1104
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                • Executes dropped EXE
                PID:1112
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                1⤵
                • Loads dropped DLL
                • Drops file in System32 directory
                PID:1120
                • C:\Windows\system32\taskhostw.exe
                  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                  2⤵
                  • Executes dropped EXE
                  PID:2776
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                1⤵
                • Executes dropped EXE
                • Indicator Removal: Clear Windows Event Logs
                PID:1144
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                1⤵
                • Executes dropped EXE
                PID:1268
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                1⤵
                • Executes dropped EXE
                PID:1312
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                1⤵
                • Executes dropped EXE
                PID:1324
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                1⤵
                • Executes dropped EXE
                PID:1420
                • C:\Windows\system32\sihost.exe
                  sihost.exe
                  2⤵
                  • Executes dropped EXE
                  PID:2616
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                1⤵
                • Executes dropped EXE
                PID:1432
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                1⤵
                • Executes dropped EXE
                PID:1540
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                1⤵
                • Executes dropped EXE
                PID:1548
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                1⤵
                • Executes dropped EXE
                PID:1640
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                1⤵
                • Executes dropped EXE
                PID:1696
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                1⤵
                • Executes dropped EXE
                PID:1728
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                1⤵
                • Executes dropped EXE
                PID:1776
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                1⤵
                • Executes dropped EXE
                PID:1840
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                1⤵
                • Executes dropped EXE
                PID:1924
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                1⤵
                • Executes dropped EXE
                PID:1932
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                1⤵
                • Executes dropped EXE
                PID:1196
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                1⤵
                • Executes dropped EXE
                PID:1660
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1668
              • C:\Windows\System32\spoolsv.exe
                C:\Windows\System32\spoolsv.exe
                1⤵
                • Executes dropped EXE
                PID:2104
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                1⤵
                • Executes dropped EXE
                PID:2156
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                1⤵
                • Executes dropped EXE
                PID:2200
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                1⤵
                • Executes dropped EXE
                PID:2292
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                1⤵
                • Executes dropped EXE
                PID:2444
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                1⤵
                • Executes dropped EXE
                PID:2452
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                1⤵
                • Executes dropped EXE
                PID:2624
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                PID:2720
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2768
              • C:\Windows\sysmon.exe
                C:\Windows\sysmon.exe
                1⤵
                • Executes dropped EXE
                PID:2796
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                1⤵
                • Executes dropped EXE
                PID:2816
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                1⤵
                • Executes dropped EXE
                PID:2824
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                1⤵
                • Executes dropped EXE
                PID:2904
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                1⤵
                • Executes dropped EXE
                PID:3468
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                • Executes dropped EXE
                PID:3588
                • C:\Users\Admin\AppData\Local\Temp\0oj3.exe
                  "C:\Users\Admin\AppData\Local\Temp\0oj3.exe"
                  2⤵
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: RenamesItself
                  • Suspicious use of WriteProcessMemory
                  PID:3608
                  • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                    cmd.exe
                    3⤵
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: RenamesItself
                    • Suspicious use of WriteProcessMemory
                    PID:3712
                    • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                      "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
                      4⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2700
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"' & exit
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3480
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"'
                          6⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:4900
                      • C:\Windows\System32\sc.exe
                        "C:\Windows\System32\sc.exe" create AutoRunService binPath="C:\Program Files\cmd.exe" type=own start=auto
                        5⤵
                        • Launches sc.exe
                        PID:4780
                      • C:\Windows\System32\sc.exe
                        "C:\Windows\System32\sc.exe" start AutoRunService
                        5⤵
                        • Launches sc.exe
                        PID:456
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                1⤵
                • Executes dropped EXE
                PID:3700
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                1⤵
                • Loads dropped DLL
                • Modifies data under HKEY_USERS
                PID:5116
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                1⤵
                • Executes dropped EXE
                PID:2372
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                1⤵
                • Executes dropped EXE
                PID:5092
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                1⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                PID:1048
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                1⤵
                • Executes dropped EXE
                PID:3664
              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:1344
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                1⤵
                • Executes dropped EXE
                PID:4736
              • C:\Windows\System32\WaaSMedicAgent.exe
                C:\Windows\System32\WaaSMedicAgent.exe 6b6a82f0786ae23f9eb64979f452c5a3 9qSHcJymP0CteioRg+9DsQ.0.1.0.0.0
                1⤵
                  PID:1280
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    2⤵
                    • Loads dropped DLL
                    PID:1664
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                  1⤵
                  • Loads dropped DLL
                  PID:1748
                • C:\Windows\servicing\TrustedInstaller.exe
                  C:\Windows\servicing\TrustedInstaller.exe
                  1⤵
                  • Loads dropped DLL
                  PID:2888
                • C:\Program Files\cmd.exe
                  "C:\Program Files\cmd.exe"
                  1⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  PID:3052
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                  1⤵
                  • Loads dropped DLL
                  PID:1652

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                System Services

                1
                T1569

                Service Execution

                1
                T1569.002

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Indicator Removal

                1
                T1070

                Clear Windows Event Logs

                1
                T1070.001

                Modify Registry

                1
                T1112

                Credential Access

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                6
                T1012

                System Information Discovery

                6
                T1082

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files\cmd.exe
                  Filesize

                  1.9MB

                  MD5

                  5d864ba27836417dbbb494b3a5d888a9

                  SHA1

                  66b87eb33a31d18ac8c89d237c2235b80ecc1b79

                  SHA256

                  0f916874ee10e6b39afb2319eb33ee8f6b6d1b11f223ce859ead0b1375f84b36

                  SHA512

                  6f59639c1b1ec0f928347d2ec7da1c46a5b2c9ef3cff71d2e4ec8009b6a97ca0f033d27a830d4efd697f99982c2a86f6620cd9e392918756425223ca9caafdf6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                  Filesize

                  2.2MB

                  MD5

                  dd2b4161313175caffafa7fa4ee184c6

                  SHA1

                  e660e3063e7771425e1edfffc45d8387c090fb59

                  SHA256

                  c2572e03276acd9c8b641606eb123a304ddfcb1bab172706ce863b1102e42bf4

                  SHA512

                  ed567c0d9827969a66c43dd7c5ac552c18a4f7f4c9063cda30badceddb0397faa14dbef4bb7730b00dc78e55d6f05adc3c149e37a6517f944e4d179e1ae49ce0

                  Download Submit

                • C:\Windows\System32\ASChelp.dll
                  Filesize

                  112KB

                  MD5

                  6a0f36515a46c1a29da10d9aaf6c2193

                  SHA1

                  47f57d38c99d2e9d6cdbb8c8ef9da9eb2b9f6365

                  SHA256

                  ee45c3f9d8b46a1414a313b356c14ef728847072ad01791924eef53215f2e937

                  SHA512

                  3e33c23b2d0de819fa7cdde962c14934b14d81438f5df0b48e450a851ded2f03809ee80246241d8df2c8768f12a4176792f39808534fdbaea8d00cd41b3a6e02

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                  Filesize

                  2KB

                  MD5

                  8abf2d6067c6f3191a015f84aa9b6efe

                  SHA1

                  98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                  SHA256

                  ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                  SHA512

                  c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                  Filesize

                  2KB

                  MD5

                  f313c5b4f95605026428425586317353

                  SHA1

                  06be66fa06e1cffc54459c38d3d258f46669d01a

                  SHA256

                  129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                  SHA512

                  b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                  Filesize

                  2KB

                  MD5

                  ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                  SHA1

                  a3879621f9493414d497ea6d70fbf17e283d5c08

                  SHA256

                  98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                  SHA512

                  1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                  Filesize

                  2KB

                  MD5

                  7d612892b20e70250dbd00d0cdd4f09b

                  SHA1

                  63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                  SHA256

                  727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                  SHA512

                  f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                  Filesize

                  2KB

                  MD5

                  1e8e2076314d54dd72e7ee09ff8a52ab

                  SHA1

                  5fd0a67671430f66237f483eef39ff599b892272

                  SHA256

                  55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                  SHA512

                  5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                  Filesize

                  2KB

                  MD5

                  0b990e24f1e839462c0ac35fef1d119e

                  SHA1

                  9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                  SHA256

                  a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                  SHA512

                  c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                  Download Submit

                • memory/2700-19-0x00000181D6FA0000-0x00000181D6FA6000-memory.dmp

                  Filesize

                  24KB

                  Download

                • memory/2700-17-0x00000181D69B0000-0x00000181D6BF2000-memory.dmp

                  Filesize

                  2.3MB

                  Download

                • memory/3052-30-0x0000021AA9D80000-0x0000021AA9F6C000-memory.dmp

                  Filesize

                  1.9MB

                  Download

                • memory/3608-1-0x00007FFA42B60000-0x00007FFA42B62000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/3608-0-0x00007FFA42B50000-0x00007FFA42B52000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/3608-6-0x00007FF6364D0000-0x00007FF6374D0000-memory.dmp

                  Filesize

                  16.0MB

                  Download

                • memory/3608-2-0x00007FF6364D0000-0x00007FF6374D0000-memory.dmp

                  Filesize

                  16.0MB

                  Download

                • memory/3712-18-0x00007FF6364D0000-0x00007FF6374D0000-memory.dmp

                  Filesize

                  16.0MB

                  Download

                • memory/3880-173-0x0000020739F20000-0x0000020739F28000-memory.dmp

                  Filesize

                  32KB

                  Download