xmrig | f221720d8817f6f9caf678dde62f43e9f19e7cd40e0b941371774caa85ed76fe

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_54339822a9633d49e230b367333e607f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 57.7MB
Sample260418-w4ggcaev2k
SHA256 f221720d8817f6f9caf678dde62f43e9f19e7cd40e0b941371774caa85ed76fe
MD5 54339822a9633d49e230b367333e607f
SHA1 2abe41fad120e74ef3ae40cb7754ca7b0e7c0f9d
SHA512 66e4e9e773a2eab67e083ac9dfacb5e0acca8d0b762577b34d772a858dd717b703295e973e7beb7f22ee16ab0a44bd8dcb66bfcf5b1af2d82d0e08204c09cf63
SSDEEP 1572864:THhVmo6O7f0+wx/W72cG8snGxwR8tpvRs:THhVoOD0+S/WScGDntyy
TLSH
T11CD72217F7A140E8C46EC539C646AA33E7B1B81A5334A7DB2AE4D3651F23AD04E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence ransomware spyware trojan upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral2/files/0x001a00000002b550-13.dat	family_xmrig
behavioral2/files/0x001a00000002b550-13.dat	xmrig
behavioral2/memory/4920-99-0x00007FF6050F0000-0x00007FF605AE1000-memory.dmp	xmrig
behavioral2/memory/5872-112-0x00007FF7D7590000-0x00007FF7D7F81000-memory.dmp	xmrig
behavioral2/memory/5276-100-0x00007FF664B70000-0x00007FF668528000-memory.dmp	xmrig
behavioral2/memory/1676-150-0x00007FF7D7590000-0x00007FF7D7F81000-memory.dmp	xmrig
behavioral2/files/0x001b00000002b550-335.dat	family_xmrig
behavioral2/files/0x001b00000002b550-335.dat	xmrig
behavioral2/memory/1676-372-0x00007FF7D7590000-0x00007FF7D7F81000-memory.dmp	xmrig

Clears Windows event logs 1 TTPs 2 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
5576	wevtutil.exe
5952	wevtutil.exe

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b561-356.dat	UPX
behavioral2/memory/4988-363-0x0000000000400000-0x00000000006D9000-memory.dmp	UPX
behavioral2/memory/4988-391-0x0000000000400000-0x00000000006D9000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3868	powershell.exe
2328	powershell.exe
5208	powershell.exe
772	powershell.exe
4040	powershell.exe
3108	powershell.exe
2328	powershell.exe
5208	powershell.exe
4040	powershell.exe
3108	powershell.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 7 IoCs

pid	Process
408	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
4920	sys_update.exe
1676	svchost.exe
5872	svchost.exe
1500	Data.exe
5636	svchost32.exe
4988	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host Process = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHost\\svchost.exe"	sys_update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host Process = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHost\\svchost.exe"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5620	tasklist.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b561-356.dat	upx
behavioral2/memory/4988-363-0x0000000000400000-0x00000000006D9000-memory.dmp	upx
behavioral2/memory/4988-391-0x0000000000400000-0x00000000006D9000-memory.dmp	upx

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\CoreFoundation.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\libdispatch.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\SQLite3.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\zlib1.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\Uninstall.exe	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\HFZ Activator A12+ Premium.exe	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\ASL.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\icudt62.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\libplist-2.0.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\MobileDevice.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\libtatsu.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\CFNetwork.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\libicuin.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\objc.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\libcrypto-3.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\libimobiledevice-1.0.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\libimobiledevice-glue-1.0.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\Data.exe	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\libicuuc.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files\windows update\allow.bat	Data.exe
File created	C:\Program Files\windows update\Uninstall.ini	Data.exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\pthreadVC2.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files\windows update\Uninstall.exe	Data.exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\idevicetunnel.exe	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\libssl-3.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\libusbmuxd-2.0.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\libxml2.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File created	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\Uninstall.ini	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\libruntime.dll	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
File opened for modification	C:\Program Files\windows update\cmd.exe	Data.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Data.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	sys_update.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c0000000100000004000000000800000f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda1400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997f000000010000000c000000300a06082b060105050703037e00000001000000080000000000e4add325dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2020	schtasks.exe
3008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3868	powershell.exe
3868	powershell.exe
2328	powershell.exe
2328	powershell.exe
5208	powershell.exe
5208	powershell.exe
772	powershell.exe
772	powershell.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe
1676	svchost.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5576	wevtutil.exe
Token: SeBackupPrivilege	5576	wevtutil.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeSecurityPrivilege	5952	wevtutil.exe
Token: SeBackupPrivilege	5952	wevtutil.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	5208	powershell.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeLockMemoryPrivilege	5636	svchost32.exe
Token: SeLockMemoryPrivilege	5636	svchost32.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	5620	tasklist.exe
Token: SeDebugPrivilege	3108	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5636	svchost32.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5276 wrote to memory of 408	5276	2026-04-18_54339822a9633d49e230b367333e607f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	79
PID 5276 wrote to memory of 4920	5276	2026-04-18_54339822a9633d49e230b367333e607f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	80
PID 408 wrote to memory of 3868	408	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe	81
PID 4920 wrote to memory of 3232	4920	sys_update.exe	83
PID 4920 wrote to memory of 3192	4920	sys_update.exe	85
PID 3232 wrote to memory of 2020	3232	cmd.exe	87
PID 3192 wrote to memory of 5576	3192	cmd.exe	88
PID 4920 wrote to memory of 1676	4920	sys_update.exe	89
PID 1676 wrote to memory of 3992	1676	svchost.exe	91
PID 1676 wrote to memory of 1504	1676	svchost.exe	93
PID 1504 wrote to memory of 5952	1504	cmd.exe	96
PID 3992 wrote to memory of 3008	3992	cmd.exe	97
PID 408 wrote to memory of 2328	408	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe	98
PID 2328 wrote to memory of 5208	2328	powershell.exe	100
PID 408 wrote to memory of 1500	408	HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe	101
PID 1500 wrote to memory of 772	1500	Data.exe	103
PID 1676 wrote to memory of 5636	1676	svchost.exe	105
PID 1500 wrote to memory of 4040	1500	Data.exe	107
PID 1500 wrote to memory of 4988	1500	Data.exe	109
PID 1572 wrote to memory of 5620	1572	cmd.exe	112
PID 1572 wrote to memory of 4404	1572	cmd.exe	113
PID 4040 wrote to memory of 3108	4040	powershell.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-18_54339822a9633d49e230b367333e607f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_54339822a9633d49e230b367333e607f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5276
- C:\Users\Admin\AppData\Local\Temp\HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
  "C:\Users\Admin\AppData\Local\Temp\HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath '%~dp0'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '%EXE_PATH%'; Add-MpPreference -ExclusionPath '%FOLDER_PATH%'; Add-MpPreference -ExclusionExtension '.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionProcess %EXE_PATH%
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5208
- - C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\Data.exe
    "C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\Data.exe" /verysilent /norestart
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath '$env:APPDATA\windowshost'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '%EXE_PATH%'; Add-MpPreference -ExclusionPath '%FOLDER_PATH%'; Add-MpPreference -ExclusionExtension '.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4040
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionProcess %EXE_PATH%
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3108
  - - C:\Program Files\windows update\cmd.exe
      "C:\Program Files\windows update\cmd.exe" /verysilent /norestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4988
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A207.tmp\A208.tmp\A209.bat "C:\Program Files\windows update\cmd.exe" /verysilent /norestart"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1572
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq svchost32.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5620
      - C:\Windows\system32\find.exe
        
        find /I "svchost32.exe"
        6⤵
        
        PID:4404
- C:\Users\Admin\AppData\Local\Temp\sys_update.exe
  "C:\Users\Admin\AppData\Local\Temp\sys_update.exe" --source="HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2020
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c w^ev^tu^ti^l cl "Windows-Security"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows-Security"
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:5576
- - C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
    "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" --source="HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3992
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3008
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c w^ev^tu^ti^l cl "Windows-Security"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows-Security"
        5⤵
        Clears Windows event logs
        Suspicious use of AdjustPrivilegeToken
        
        PID:5952
  - - C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe
      "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe" --config="C:\Users\Admin\AppData\Roaming\WindowsHost\config.json"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:5636

C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
1⤵
- Executes dropped EXE
PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HFZ Activator A12+ Premium.exe

Path C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\HFZ Activator A12+ Premium.exe
Size 7.7MB
SHA256 3bf13e44afc013ed0f69d50aac22d876b9872b4c14bc8aaed9716111dbc13993
MD5 c502311bcbc5cd985e25903b05267e6f
SHA1 a0afc13de03b3697b13ee18bac406d81d627088c
SHA512 1bcff873c3705dcd4836586a093226259a479d64de2181b6f1cd0d7ae7470c9a2f971e4f23029bd1a3bace614561d03f35a8bcb90e666fa2b651fa1111616782
SSDEEP 196608:wAQKCtf11/iB/1Op/dZnNq9ZIzGS+S4mNSg8wwzpMMyHC0dh09CLUKDg7xsOy:wAPq16Op/vk2ynSRNSHpM/C0dhCjKEmH
TLSH
T1FB86DF0A62B5DA41F27BA7F9009246400BDA5714DE4FDB1363C52FE35AD2389A73B12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Data.exe

Path C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\Data.exe
Size 3.0MB
SHA256 3894f2173ba17af0fbf027df0ae9701e0070a20f5c3e5c93b33d76e75f5ab85f
MD5 b9a77216900c859465f20c44644c500a
SHA1 083f03fd9a127fb5edf005e9935a4f221c7e3a3c
SHA512 46e6929be5aeb8aea89ada1e998f3b70cfdab78fbae36b7a2b4732d7f7432def5f32772004cf07a3899158546cf53696f665bafbff8fece7bd97650925387812
SSDEEP 98304:lAI+khu2Ly4J+l/52waFPXpRg296j292bed:2tkhng/52XFfpRR6jad
TLSH
T1F6E5333593418AFAD2623834984BD2BDF5397A180E2896CFF6DE06280D3635749F77C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmd.exe

Path C:\Program Files\windows update\cmd.exe
Size 2.8MB
SHA256 51cc7987d7e3d07dc2447939c9008366f6f89e63f3545b1cb02aa50aacd5aca1
MD5 5b98f6f68f579edc85e6223ca8a3042f
SHA1 6a9e97a1316a5242915a0819f9d4f2cb61914e4f
SHA512 357c1b285c999e88716a864ce3918a6f5e0343e639a7763b041db25ae68bd345a5e3070fc4462ddff2fe1f573f5be66428f5b37fa8d9a241b416447fc1f6a599
SSDEEP 49152:nny7yWOPS6zK+DVc59ZhYsHw3rfkaFnq0fi1Br63lJqujp6csa2gybhFlAN:nGyWOPrjAho3bkaFe1qlwuV6E2gybnq
TLSH
T10CD533F4C664AFDAC7827870F85E90BCA688157C5C09C76BFC5703650AA8767C877E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 f2ff14d55d562cf4888c4807ea5b9682a188ad087d039a7fbdfa9a88ca2df08b
MD5 93f98577c2975a1ad9cf084f6330acee
SHA1 71aae67686c3e402eeda7f724ae3c17a9584fd32
SHA512 a348f4554e2e77bbe4a8da5389621dd811fded3f709d6b6450ddb201311dd7a7ca21e470da7cbad4abe8f6f787115efe2eaae4222cd4cdd2737c0ec1d947a190
SSDEEP 384:XL3HhRSS1CsiGpcs6FRHEMnH4nNzjs2xtg+Nr6I59p9JQu0iF5X:7rSSkDM96RPHWzj7xtgGr6ap9JQu0k
TLSH
T10B92B4AE711F22C3C89553B8E107050FE8F2DE8D431912D9BB2E9F7B89AC65E813D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 b4a90cb6f7058b9a5e70c17ec07d3e176e0429204a417e005f54435cbc480cc9
MD5 3f4cb886cfb17fe8ff88e73dd3c0decd
SHA1 7b191a4f0be4f79d67d3c3cdfcc11f454619eba1
SHA512 6887bc976a83922af6ed691f8a7df5dda01b22a49bc64580fe6de2d6f2084c245f9bc57502290d9c7a1173befa734ae1143533e89a20e226bd2e970cac7e182b
SSDEEP 384:aL3HhsSS1U6wG3sDFRHEuRGeHUtzjsaaDbFIRZ7GrlSjnYXUaDDU3V:kySSjORFRh6zj6VYZ7KScRUl
TLSH
T1789229AD321F26E7D4A513B4C0320797FEB08EDEC38463DE671A687B14CA67140A94EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 75db8e3a1bd5e9605174fd6c2a4106530b7cec5d44271df52ce8736711f160c4
MD5 ea718bcd62b9d79ae75f40849f46f28e
SHA1 3e9f72ec8dc5701474e6141ea15ca6bce2bb2b33
SHA512 7b2ba0cc5640cef02c6792050bd671c83f70f2782b3769dd752d009c5680c5e7f240737b17c02de1104f422b08a0aa59a4afa8a2ebaa85b3241b8e1818efe067
SSDEEP 384:zTHhY1SSpAogChZYa2EHDH4cznRYaazbI3i2L9g9+5nYEDDU1C:+SSCv2l2ETTNW/eg9+myUM
TLSH
T1F3922A6D222F66C7D56A13B4C023079BFEF08ECFC30852EE6755993A05CB26544E95F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 57560d3da10fc67d6e59653709198a035ef825a1d3c8ea4903fbd2d2b35b6dfd
MD5 10d4e8ff7f630c74ae7b4f9880810e2a
SHA1 ee8f64be84f93b1e5d315ae65b0280fb6a32ca3a
SHA512 165718fdae1d2ab6e39ad000b18d9a3105ba28c674fe6b977f18438af83cf2f0ac3d4b7da7e1530caa98e689062e2791a2922057860aaf2ddf4223a90eb61818
SSDEEP 384:3THhY1SGAF0q6FRHEMEBgnHHCaaDb66W7GElm3CnYnRDDU3l:ySjFj6RPESEpW7vm3tBU1
TLSH
T1D592196D326F26DBC06623F48022179FEEF09EDE838452DE6758587B05CB67184DA4EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0001.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp
Size 8.0MB
SHA256 1938f91efaf9db5bca637a3d024a7b1971ba08abcdfe794a5c1da1c70115eb7b
MD5 18c5c1960fd080ea182b6c2a7f5b5f23
SHA1 9be422eadc4e7deeaf9425c660797d49a79d6959
SHA512 6c56777a288809f7be71f94175f39e18acd7bc1def25b638884ac5951338262529a11a4390e749dfe995e34750ca5c7323fa36112e1c5cf6a217b85d67a60e0a
SSDEEP 196608:HvYssJK1aGgunFYW2sUxvRTc7PIBI6klr3eza5IxstHWpppl:PYlJK1ouFjCxv9tclSkFt+L
TLSH
T1A28633AB9F31FA99C234E560D9B0B41A970B5F9152A9FE227F5CA53FF37D0444AE4800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0003.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0003.tmp
Size 8.0MB
SHA256 35f0558ca724ec25798347a5e41904a7dd004673a37516aa24ed1ac06b374415
MD5 c0111d6a01baf8567ea91581c3da1c66
SHA1 0d6ded7c024c77026fae7002a2484477c0ca37c4
SHA512 eaac95e43d1b21c02625946143f9bb2b06db91eb81f57103a30e97959d9c6b0d9582f7a7685a7c00d8b81a3062a80bba7eda37d54779d2727198819eed62ead8
SSDEEP 196608:/kzmPlRHX6iUUpyDIvQdNyjKHXM5BL+5Sy45xmTDIlPaOuUAstvPVL:/kCBKiNQDIvQdNyjK3kBab6xyMbttvPN
TLSH
T12E8633BB262B4DCC86E89FADDDD6DE9E4CCCF1D3923911133DCAC911401AE160779A89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0004.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0004.tmp
Size 8.0MB
SHA256 2fd7a55096a5058f3b114039d5c8c89352a6f4d9937684e6fddacbeea8fd3cf7
MD5 d30c0bfb7469374aa9a2b231754ba508
SHA1 62079c779514514793ff76b16a965f828e6d4505
SHA512 b1435b9a63f4cdce74483f753d5fc63cfc4fb4df6daac6619ec268a410d61d7e0057fad1acdab4fe0e8c53104e5a1cbecdb08757c4101eec8238807758af7be2
SSDEEP 196608:6t4Rg/ZbL2EKbBRpA36U1YZsy1NW6rH29Selymd8+Rpvd7HRd0:9+2TbBRO3Us36rWcoPHpvpHRd0
TLSH
T11A863339865EDBDC9B92727A993760788490E2298A0CCFBB6C7255F505973870CF36C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0005.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0005.tmp
Size 6.3MB
SHA256 b794ffe0499b8cf562ca5dea030721e84af3228559198af36d3a02c16256ad32
MD5 d2659fbb13f87cdd8d4af6a9d4967e9c
SHA1 083c239124d2f35f1683b09b9cd8f92847270272
SHA512 226d6763eb4957727c8fd174ab03a3d76ae4151745b0865218860b55a3b4b00574d2e15a5e6ae5a8876cc5c0f8e8f4a495ab64d430d22ad4ad8845bcf1705aae
SSDEEP 196608:9Hb4GsHqUl8fCYU6KhdgBibz8SG/78YCPo:9HWqTaaKt/sbCPo
TLSH
T190663361AD7D840737795C3E4635F82C93EA90BBBB8B907376940EA84E7149637E102F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp
Size 36B
SHA256 a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
MD5 8708699d2c73bed30a0a08d80f96d6d7
SHA1 684cb9d317146553e8c5269c8afb1539565f4f78
SHA512 38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264
MD5 SHA1 SHA512

Submit Download

HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe

Path C:\Users\Admin\AppData\Local\Temp\HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
Size 46.5MB
SHA256 75c8943c651d8a9043b5bc1d77343f27cce9f998060b07c46e97ea9947fe5702
MD5 fd51630c8d2e6a07b45670c4d13c17bb
SHA1 595e33f97621db3347b18eaa05dd85e3ef4d1c27
SHA512 1c2f4e59f6183bd75351af2afe14418a452b36b926c391ecec612eed9c5d5001ac819386f7d91a54ee1b4c5eefe965e2333690a1c22b9c83adb4093b7286ca03
SSDEEP 786432:cVmQqa6O2yf07LK1P5CxXclSk780J72PDwEiNQD8smaGxDdU+GBR8OVApvRsQaa6:cVmo6O7f0+wx/W72cG8snGxwR8tpvRsJ
TLSH
T19AB7337ED66788AAC3DC6977CC76FF2DD1B4A987771944333EE66AE4402B1420DB0248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0jbtjxpk.1xp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0jbtjxpk.1xp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sys_update.exe

Path C:\Users\Admin\AppData\Local\Temp\sys_update.exe
Size 10.5MB
SHA256 653c91379314f2a6e0344cceae36b75ea8318204a20fc93b321007b0677d7b1e
MD5 338bd7391963d266a163894b3f2da0ed
SHA1 49d7f1edca68d6081cf52ed9c434eb4e5934e9ec
SHA512 627bc150e03b1e6fb770fd27f6a7b9717cd521d29c4c48c14a5a656b719e7c2ce7d223eb2251dc928cade19a8af771d9653dc35f0354fedcf033d52acc9d6835
SSDEEP 196608:CQ/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RjUdPfjx1J+46eU18kE:LkFCUatKWEe6J+FeK/Ra+ynJ+FeU1Y
TLSH
T1B3B6CF16B7A401E8C86AC538C64A9633E7B1B8195374A7CF26F4D2691F33BD05E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\WindowsHost\config.json
Size 2KB
SHA256 c64306b30281e43453f9019cb22d3040cbe65bee129ecbdef62cefdb8cdf494a
MD5 1057ca39f3c8da2a02b19b29865534c1
SHA1 a7b185266f8cffa2bfdc29e1ccf26381721a4050
SHA512 399b906a6e746353a70d6b2c10cf60e9cc9a9d70ac509c2c555d548e72d200ac9be22eec0c90b7e7dd257ff0456e7ec7997bafdd1d76421466399a239ddf2796
TLSH
T16E51D325C9600CFF19B8A15C96B4B393DA69831B23410C3F75FC995C2F37A36B142BA9
MD5 SHA1 SHA512 TLSH

Submit Download

svchost32.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe
Size 9.1MB
SHA256 0383b275816b264faa6855f8496e1df9fc6a1de950cc0a2e234005e6564b1e95
MD5 09158cf4be40387c9fe23e808808af1e
SHA1 a86aeac9be45a03b5dd6073f91f9200b673b7e1d
SHA512 7a7226b0da31ea42d3b21c16fc175ba5b7cf18d3c487521c2cf30900c21245cda510e6b97fb95699589a4bbccaf5d0042cf60f6df68426743837bdabe5b064d3
SSDEEP 196608:A/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RjUdPfju:AkFCUatKWEe6J+FeK/Ra+y6
TLSH
T1F5A6CF16B7A400E8C87EC53CC64A9513E7B1B81953B0A7DB26F4966A1F33BD41E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-15-0x000000000042B000-0x000000000042C000-memory.dmp

Download

memory/408-300-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/408-139-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/408-140-0x0000000002340000-0x000000000241A000-memory.dmp

Download

memory/408-301-0x0000000002340000-0x000000000241A000-memory.dmp

Download

memory/772-340-0x0000000001220000-0x00000000013CC000-memory.dmp

Download

memory/772-319-0x000000006F190000-0x000000006F1DC000-memory.dmp

Download

memory/772-311-0x0000000006110000-0x0000000006467000-memory.dmp

Download

memory/1500-361-0x0000000002300000-0x00000000023DA000-memory.dmp

Download

memory/1500-360-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1676-372-0x00007FF7D7590000-0x00007FF7D7F81000-memory.dmp

Download

memory/1676-151-0x0000016D4C1A0000-0x0000016D4C1AC000-memory.dmp

Download

memory/1676-150-0x00007FF7D7590000-0x00007FF7D7F81000-memory.dmp

Download

memory/2328-157-0x0000000006160000-0x00000000064B7000-memory.dmp

Download

memory/2328-175-0x000000006F190000-0x000000006F1DC000-memory.dmp

Download

memory/3108-381-0x000000006F780000-0x000000006F7CC000-memory.dmp

Download

memory/3108-388-0x0000000007700000-0x00000000077A4000-memory.dmp

Download

memory/3108-389-0x0000000007A30000-0x0000000007A41000-memory.dmp

Download

memory/3108-394-0x0000000007A70000-0x0000000007A85000-memory.dmp

Download

memory/3108-397-0x0000000006700000-0x0000000006782000-memory.dmp

Download

memory/3108-396-0x0000000000F60000-0x000000000110C000-memory.dmp

Download

memory/3868-134-0x0000000007F60000-0x00000000085DA000-memory.dmp

Download

memory/3868-113-0x00000000065D0000-0x00000000065EE000-memory.dmp

Download

memory/3868-85-0x0000000003110000-0x0000000003146000-memory.dmp

Download

memory/3868-148-0x00000000011B0000-0x000000000135C000-memory.dmp

Download

memory/3868-145-0x0000000007C60000-0x0000000007C68000-memory.dmp

Download

memory/3868-144-0x0000000007C80000-0x0000000007C9A000-memory.dmp

Download

memory/3868-143-0x0000000007B70000-0x0000000007B85000-memory.dmp

Download

memory/3868-142-0x0000000007B60000-0x0000000007B6E000-memory.dmp

Download

memory/3868-141-0x00000000011B0000-0x000000000135C000-memory.dmp

Download

memory/3868-138-0x0000000007B30000-0x0000000007B41000-memory.dmp

Download

memory/3868-137-0x0000000007BC0000-0x0000000007C56000-memory.dmp

Download

memory/3868-136-0x0000000007990000-0x000000000799A000-memory.dmp

Download

memory/3868-135-0x0000000007920000-0x000000000793A000-memory.dmp

Download

memory/3868-133-0x00000000075C0000-0x0000000007664000-memory.dmp

Download

memory/3868-132-0x0000000006BA0000-0x0000000006BBE000-memory.dmp

Download

memory/3868-98-0x00000000058B0000-0x0000000005EDA000-memory.dmp

Download

memory/3868-125-0x000000006F190000-0x000000006F1DC000-memory.dmp

Download

memory/3868-124-0x0000000007570000-0x00000000075A4000-memory.dmp

Download

memory/3868-114-0x00000000065F0000-0x000000000663C000-memory.dmp

Download

memory/3868-103-0x00000000060C0000-0x0000000006126000-memory.dmp

Download

memory/3868-102-0x0000000006050000-0x00000000060B6000-memory.dmp

Download

memory/3868-101-0x0000000005630000-0x0000000005652000-memory.dmp

Download

memory/3868-109-0x0000000006130000-0x0000000006487000-memory.dmp

Download

memory/4040-405-0x0000000006EE0000-0x0000000006F84000-memory.dmp

Download

memory/4040-374-0x0000000006130000-0x000000000617C000-memory.dmp

Download

memory/4040-411-0x0000000005E60000-0x0000000005EE2000-memory.dmp

Download

memory/4040-370-0x0000000005750000-0x0000000005AA7000-memory.dmp

Download

memory/4040-410-0x00000000007B0000-0x000000000095C000-memory.dmp

Download

memory/4040-407-0x0000000007260000-0x0000000007275000-memory.dmp

Download

memory/4040-406-0x0000000007220000-0x0000000007231000-memory.dmp

Download

memory/4040-398-0x000000006F780000-0x000000006F7CC000-memory.dmp

Download

memory/4920-99-0x00007FF6050F0000-0x00007FF605AE1000-memory.dmp

Download

memory/4988-363-0x0000000000400000-0x00000000006D9000-memory.dmp

Download

memory/4988-391-0x0000000000400000-0x00000000006D9000-memory.dmp

Download

memory/5208-174-0x0000000000D70000-0x0000000000F1C000-memory.dmp

Download

memory/5208-166-0x000000006F190000-0x000000006F1DC000-memory.dmp

Download

memory/5276-100-0x00007FF664B70000-0x00007FF668528000-memory.dmp

Download

memory/5636-337-0x000001E914030000-0x000001E914050000-memory.dmp

Download

memory/5872-112-0x00007FF7D7590000-0x00007FF7D7F81000-memory.dmp

Download