home

ash.0b2169676d766d3448636a4b48795d.run.exe

Microsoft Automated Troubleshooting Services

Microsoft Corporation

Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft® Automated Troubleshooting Services

Version:
3.5.0000.41 (winmain.141211-2009)

MD5:
68d6a05c24987e3abf021691d3e53028

SHA-1:
ade5db664069846ea39eca42aee7194b055c5c59

SHA-256:
9365eaf0f35617cc9c31553f581cd8bc217899f63870311d9793958f9ede1879

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/26/2024 9:14:54 PM UTC  (today)

File size:
342.7 KB (350,936 bytes)

Product version:
3.5.0000.41

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
Mats_Run.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\ash.0b2169676d766d3448636a4b48795d.run.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
4/22/2014 6:39:00 PM

Valid to:
7/22/2015 6:39:00 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
33000000CA6CD5321235C4E1550001000000CA

File PE Metadata
Compilation timestamp:
12/19/2014 2:39:12 AM

OS version:
6.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:McUCT62bW4YKUT3WLmLL9SSguxEcihWeiNDBOs2p6saKhn:5W4xUTrLL97guxEcihiDBDW6ROn

Entry address:
0x1EFAC

Entry point:
E8, 35, 0C, 00, 00, E9, 4E, FD, FF, FF, CC, CC, CC, CC, CC, CC, FF, 25, 9C, 14, 00, 01, CC, CC, CC, CC, CC, CC, FF, 25, 60, 14, 00, 01, CC, CC, CC, CC, CC, CC, FF, 25, 98, 14, 00, 01, CC, CC, CC, CC, CC, CC, CC, CC, 6A, 14, 68, E8, 4E, 03, 01, E8, F2, 00, 00, 00, A1, CC, A4, 03, 01, 89, 45, E4, 83, F8, FF, 75, 0C, FF, 75, 08, FF, 15, AC, 14, 00, 01, 59, EB, 51, 6A, 08, E8, 86, 0C, 00, 00, 59, 83, 65, FC, 00, A1, CC, A4, 03, 01, 89, 45, E4, A1, C8, A4, 03, 01, 89, 45, E0, 8D, 45, E0, 50, 8D, 45, E4, 50, FF...
 
[+]

Entropy:
6.9050

Code size:
216 KB (221,184 bytes)

The file ash.0b2169676d766d3448636a4b48795d.run.exe has been seen being distributed by the following 23 URLs.

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B2FE24E7341473763376A43394EC0.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B272E5B6566786E7A6A644D316521.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B2ECC9946425A6D56315753316776.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B2E0A0A336D4D394B654C50595430.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B2D86584B6F306A6F6772745A77A5.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B25256B4A424A32484E715A41661A.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B2C86F246344770347A704F583609.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B2C0B2C6577514A6D6A6A63574A1A.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../SDP.0b27f01238333936333535303930c0.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B2BD4BE766A347A55525138614255.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B288B1554524654674E45397350DF.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B291FAC764F714C674A4C554D638F.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B2909096842327A7765484B346702.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B27361D493444726874506A433019.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B271A197333705238576B70767936.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B2645B6713234684C35326F356EBE.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B2418C157787278304249495734C2.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B252C915A5279594C4970563975D4.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B23DA7939327A417744416E5259AC.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B23B40F546E4E376C4547564271DB.Run.exe

https://diagnostics.support.microsoft.com/diagprov/.../SDP.0b2079033238323637383636303252.Run.exe

https://diagnostics.support.microsoft.com/.../request

https://diagnostics.support.microsoft.com/diagprov/.../ASH.0B2198806753494254756762374759.Run.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.