Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/08/2026, 01:47
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
33 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
30 signatures
150 seconds
General
- Target 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe
- Size 14.4MB
- Sample260806-b72aps1dmb
- SHA256 4d6b422963811adb65620efe279c5293df40aad0ba517dd4e5c50c2d37aebd57
- MD5 26d62c1cedba3cb556d90458c0defbf5
- SHA1 7c615f0e343111e6eb5945a6b5e03afe68f99893
- SHA512 7867040981bb2336922ad6870d85f1ae3f4a037f26b45cd5b52d2e05adf4125953dd9274cce7691352260b33f73dfb0633e742192501dd8fe16df0287079054e
- SSDEEP 196608:lgPVXwhLpvPiM+Btyoh9CggQIPCj6NwjyXok:lFhLpvaMqLh9CggQI4mXok
- TLSH T1D8E67C47E8A101E5C0EED535C6669226BA713C885F3563D72B50FB282F73BE0AE79710
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/files/0x00090000000246fd-443.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WinHostSvc = "0" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WinHostSvc\winhostsvc.exe = "0" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\winhostsvc.exe = "0" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
resource yara_rule behavioral1/files/0x00090000000246fd-443.dat INDICATOR_SUSPICIOUS_DisableWinDefender - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x00090000000246fd-443.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell and hide display window.
pid Process 3920 powershell.exe 5880 powershell.exe 5204 powershell.exe 8 powershell.exe 5460 powershell.exe 3976 powershell.exe 5752 powershell.exe 2528 powershell.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 70 4992 Process not Found - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation memreduct-3.5.2-setup.exe - Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHostSvc.vbs 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Deletes itself 1 IoCs
pid Process 2928 winhostsvc.exe - Executes dropped EXE 6 IoCs
pid Process 1652 memreduct-3.5.2-setup.exe 1784 Windows10UpgraderApp.exe 2928 winhostsvc.exe 2940 winhostsvc.exe 4508 winhostsvc.exe 5224 winhostsvc.exe - Loads dropped DLL 2 IoCs
pid Process 1784 Windows10UpgraderApp.exe 1784 Windows10UpgraderApp.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WinHostSvc = "0" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WinHostSvc\winhostsvc.exe = "0" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\winhostsvc.exe = "0" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHostSvc = "C:\\ProgramData\\WinHostSvc\\winhostsvc.exe" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHostSvc = "C:\\ProgramData\\WinHostSvc\\winhostsvc.exe" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 3 discord.com 4 discord.com - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_bg-bg.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_en-us.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_fi-fi.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_fr-fr.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_el-gr.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_germany_region.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_hu-hu.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ko-kr.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_lv-lv.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_zh-cn.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_de-de.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ja-jp.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_pl-pl.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sk-sk.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\WinDlp.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ro-ro.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sv-se.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktop.css memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentOOBE.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_es-es.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_pt-br.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_es-mx.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sl-si.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_gl-es.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_he-il.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ru-ru.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_tr-tr.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\base.js memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ar-sa.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_lt-lt.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_pt-pt.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_th-th.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_it-it.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css memreduct-3.5.2-setup.exe File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini Windows10UpgraderApp.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_zh-tw.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ca-es.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_cs-cz.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_et-ee.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_da-dk.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_en-gb.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_fr-ca.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_nl-nl.htm memreduct-3.5.2-setup.exe File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_hr-hr.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_nb-no.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_eu-es.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sr-latn-rs.htm memreduct-3.5.2-setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows10UpgraderApp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language memreduct-3.5.2-setup.exe - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Windows10UpgraderApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Windows10UpgraderApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Windows10UpgraderApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Windows10UpgraderApp.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotificationUx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotificationUx.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Detects videocard installed 1 TTPs 5 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1976 wmic.exe 2116 wmic.exe 5416 wmic.exe 844 wmic.exe 3904 wmic.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Windows10UpgraderApp.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\IESettingSync Windows10UpgraderApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" Windows10UpgraderApp.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Windows10UpgraderApp.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2568 schtasks.exe 2900 schtasks.exe - Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 2528 powershell.exe 2528 powershell.exe 5752 powershell.exe 5752 powershell.exe 3976 powershell.exe 3976 powershell.exe 8 powershell.exe 8 powershell.exe 5460 powershell.exe 5460 powershell.exe 5204 powershell.exe 5204 powershell.exe 3920 powershell.exe 3920 powershell.exe 3976 powershell.exe 3920 powershell.exe 5880 powershell.exe 5880 powershell.exe 5752 powershell.exe 8 powershell.exe 5204 powershell.exe 5460 powershell.exe 5880 powershell.exe 2928 winhostsvc.exe 2928 winhostsvc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2528 powershell.exe Token: SeDebugPrivilege 3976 powershell.exe Token: SeDebugPrivilege 5752 powershell.exe Token: SeDebugPrivilege 8 powershell.exe Token: SeDebugPrivilege 5460 powershell.exe Token: SeDebugPrivilege 5204 powershell.exe Token: SeDebugPrivilege 3920 powershell.exe Token: SeBackupPrivilege 1652 memreduct-3.5.2-setup.exe Token: SeRestorePrivilege 1652 memreduct-3.5.2-setup.exe Token: SeDebugPrivilege 5880 powershell.exe Token: SeIncreaseQuotaPrivilege 3484 wmic.exe Token: SeSecurityPrivilege 3484 wmic.exe Token: SeTakeOwnershipPrivilege 3484 wmic.exe Token: SeLoadDriverPrivilege 3484 wmic.exe Token: SeSystemProfilePrivilege 3484 wmic.exe Token: SeSystemtimePrivilege 3484 wmic.exe Token: SeProfSingleProcessPrivilege 3484 wmic.exe Token: SeIncBasePriorityPrivilege 3484 wmic.exe Token: SeCreatePagefilePrivilege 3484 wmic.exe Token: SeBackupPrivilege 3484 wmic.exe Token: SeRestorePrivilege 3484 wmic.exe Token: SeShutdownPrivilege 3484 wmic.exe Token: SeDebugPrivilege 3484 wmic.exe Token: SeSystemEnvironmentPrivilege 3484 wmic.exe Token: SeRemoteShutdownPrivilege 3484 wmic.exe Token: SeUndockPrivilege 3484 wmic.exe Token: SeManageVolumePrivilege 3484 wmic.exe Token: 33 3484 wmic.exe Token: 34 3484 wmic.exe Token: 35 3484 wmic.exe Token: 36 3484 wmic.exe Token: SeIncreaseQuotaPrivilege 3484 wmic.exe Token: SeSecurityPrivilege 3484 wmic.exe Token: SeTakeOwnershipPrivilege 3484 wmic.exe Token: SeLoadDriverPrivilege 3484 wmic.exe Token: SeSystemProfilePrivilege 3484 wmic.exe Token: SeSystemtimePrivilege 3484 wmic.exe Token: SeProfSingleProcessPrivilege 3484 wmic.exe Token: SeIncBasePriorityPrivilege 3484 wmic.exe Token: SeCreatePagefilePrivilege 3484 wmic.exe Token: SeBackupPrivilege 3484 wmic.exe Token: SeRestorePrivilege 3484 wmic.exe Token: SeShutdownPrivilege 3484 wmic.exe Token: SeDebugPrivilege 3484 wmic.exe Token: SeSystemEnvironmentPrivilege 3484 wmic.exe Token: SeRemoteShutdownPrivilege 3484 wmic.exe Token: SeUndockPrivilege 3484 wmic.exe Token: SeManageVolumePrivilege 3484 wmic.exe Token: 33 3484 wmic.exe Token: 34 3484 wmic.exe Token: 35 3484 wmic.exe Token: 36 3484 wmic.exe Token: SeIncreaseQuotaPrivilege 2956 wmic.exe Token: SeSecurityPrivilege 2956 wmic.exe Token: SeTakeOwnershipPrivilege 2956 wmic.exe Token: SeLoadDriverPrivilege 2956 wmic.exe Token: SeSystemProfilePrivilege 2956 wmic.exe Token: SeSystemtimePrivilege 2956 wmic.exe Token: SeProfSingleProcessPrivilege 2956 wmic.exe Token: SeIncBasePriorityPrivilege 2956 wmic.exe Token: SeCreatePagefilePrivilege 2956 wmic.exe Token: SeBackupPrivilege 2956 wmic.exe Token: SeRestorePrivilege 2956 wmic.exe Token: SeShutdownPrivilege 2956 wmic.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3784 MusNotifyIcon.exe 3784 MusNotifyIcon.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3784 MusNotifyIcon.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1784 Windows10UpgraderApp.exe 1784 Windows10UpgraderApp.exe 1784 Windows10UpgraderApp.exe 1784 Windows10UpgraderApp.exe 1784 Windows10UpgraderApp.exe 1784 Windows10UpgraderApp.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1072 wrote to memory of 1652 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 88 PID 1072 wrote to memory of 2528 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 126 PID 1072 wrote to memory of 5752 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 134 PID 1072 wrote to memory of 3976 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 92 PID 1072 wrote to memory of 5460 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 94 PID 1072 wrote to memory of 8 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 97 PID 1072 wrote to memory of 5204 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 99 PID 1072 wrote to memory of 3920 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 100 PID 1072 wrote to memory of 5880 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 103 PID 1652 wrote to memory of 1784 1652 memreduct-3.5.2-setup.exe 105 PID 1072 wrote to memory of 2568 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 107 PID 1072 wrote to memory of 2900 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 109 PID 1072 wrote to memory of 2928 1072 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 111 PID 2928 wrote to memory of 2940 2928 winhostsvc.exe 112 PID 2928 wrote to memory of 3484 2928 winhostsvc.exe 118 PID 2928 wrote to memory of 2956 2928 winhostsvc.exe 121 PID 2928 wrote to memory of 1976 2928 winhostsvc.exe 123 PID 2928 wrote to memory of 1124 2928 winhostsvc.exe 125 PID 2928 wrote to memory of 3004 2928 winhostsvc.exe 139 PID 2928 wrote to memory of 5516 2928 winhostsvc.exe 141 PID 2928 wrote to memory of 2116 2928 winhostsvc.exe 143 PID 2928 wrote to memory of 2900 2928 winhostsvc.exe 145 PID 2928 wrote to memory of 5588 2928 winhostsvc.exe 149 PID 2928 wrote to memory of 1124 2928 winhostsvc.exe 151 PID 2928 wrote to memory of 5416 2928 winhostsvc.exe 153 PID 2928 wrote to memory of 464 2928 winhostsvc.exe 155 PID 2928 wrote to memory of 680 2928 winhostsvc.exe 163 PID 2928 wrote to memory of 5008 2928 winhostsvc.exe 165 PID 2928 wrote to memory of 844 2928 winhostsvc.exe 167 PID 2928 wrote to memory of 3960 2928 winhostsvc.exe 169 PID 2928 wrote to memory of 4988 2928 winhostsvc.exe 172 PID 2928 wrote to memory of 176 2928 winhostsvc.exe 174 PID 2928 wrote to memory of 3904 2928 winhostsvc.exe 176 PID 2928 wrote to memory of 5380 2928 winhostsvc.exe 178 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Creates a file in the Startup directory
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\memreduct-3.5.2-setup.exeC:\Users\Admin\AppData\Local\Temp\memreduct-3.5.2-setup.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe" /SkipSelfUpdate /SunValley3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1784
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "exit 0"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAVwBpAG4ASABvAHMAdABTAHYAYwAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5752
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwBBAGwAbABvAHcAZQBkAEEAcABwAGwAaQBjAGEAdABpAG8AbgBzACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABXAGkAbgBIAG8AcwB0AFMAdgBjAFwAdwBpAG4AaABvAHMAdABzAHYAYwAuAGUAeABlACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAVwBpAG4ASABvAHMAdABTAHYAYwBcAHcAaQBuAGgAbwBzAHQAcwB2AGMALgBlAHgAZQAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAATgBlAHYAZQByAFMAZQBuAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAdwBpAG4AaABvAHMAdABzAHYAYwAuAGUAeABlACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AQQB0AHQAYQBjAGsAUwB1AHIAZgBhAGMAZQBSAGUAZAB1AGMAdABpAG8AbgBPAG4AbAB5AEUAeABjAGwAdQBzAGkAbwBuAHMAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFcAaQBuAEgAbwBzAHQAUwB2AGMAXAB3AGkAbgBoAG8AcwB0AHMAdgBjAC4AZQB4AGUAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5880
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN WinHostSvcLogon /TR \"C:\ProgramData\WinHostSvc\winhostsvc.exe\" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:2568
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN WinHostSvcBoot /TR \"C:\ProgramData\WinHostSvc\winhostsvc.exe\" /SC ONSTART /RU SYSTEM /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:2900
-
-
C:\ProgramData\WinHostSvc\winhostsvc.exeC:\ProgramData\WinHostSvc\winhostsvc.exe -cleanup-source C:\Users\Admin\AppData\Local\Temp\2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\ProgramData\WinHostSvc\winhostsvc.exeC:\ProgramData\WinHostSvc\winhostsvc.exe -watchdog 29283⤵
- Executes dropped EXE
PID:2940
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,LoadPercentage /value3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory,TotalVisibleMemorySize /value3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_VideoController get Name,AdapterRAM /value3⤵
- Detects videocard installed
PID:1976
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get Model,InterfaceType,MediaType,Size /value3⤵PID:1124
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2528
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,LoadPercentage /value3⤵PID:3004
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory,TotalVisibleMemorySize /value3⤵PID:5516
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_VideoController get Name,AdapterRAM /value3⤵
- Detects videocard installed
PID:2116
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get Model,InterfaceType,MediaType,Size /value3⤵PID:2900
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,LoadPercentage /value3⤵PID:5588
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory,TotalVisibleMemorySize /value3⤵PID:1124
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_VideoController get Name,AdapterRAM /value3⤵
- Detects videocard installed
PID:5416
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get Model,InterfaceType,MediaType,Size /value3⤵PID:464
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,LoadPercentage /value3⤵PID:680
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory,TotalVisibleMemorySize /value3⤵PID:5008
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_VideoController get Name,AdapterRAM /value3⤵
- Detects videocard installed
PID:844
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get Model,InterfaceType,MediaType,Size /value3⤵PID:3960
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,LoadPercentage /value3⤵PID:4988
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory,TotalVisibleMemorySize /value3⤵PID:176
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_VideoController get Name,AdapterRAM /value3⤵
- Detects videocard installed
PID:3904
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get Model,InterfaceType,MediaType,Size /value3⤵PID:5380
-
-
-
C:\ProgramData\WinHostSvc\winhostsvc.exe"C:\ProgramData\WinHostSvc\winhostsvc.exe"1⤵
- Executes dropped EXE
PID:5224
-
C:\ProgramData\WinHostSvc\winhostsvc.exeC:\ProgramData\WinHostSvc\winhostsvc.exe1⤵
- Executes dropped EXE
PID:4508
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5752
-
C:\Windows\system32\MusNotificationUx.exe%systemroot%\system32\MusNotificationUx.exe Toast_DownloadNeedUserAgreement 01⤵
- Checks processor information in registry
PID:2568
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 161⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3784
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
- Size 3.5MB
- SHA256 3d6675649b66674a9488f399898df788e7693f7a622ba66db3ef9296c23c1953
- MD5 1c4c26433d7dfad06a6d58a19f8b8d2f
- SHA1 c3a54496d49f1dd85902a50f500f0a1828aeeb58
- SHA512 e9bf314d150be4ee27897dbe14ff8db365cdc6ce2d0a8849f078a7055087c22f579ceb69f234cce805c8a02e6710e079dbac7e0e8ce750503eb832ea4075cb06
- SSDEEP 49152:X5CkppwlOZP7S0JqAUnQQZr5ydpekLPd/PdpAS0JGBpQQZV35w7dDo:Bpd
- TLSH T1EB06D75382F49A24D4F7E2679A5B3A36445E5C3C5722D3C6F20C888E6BD4EAC8770376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll
- Size 199KB
- SHA256 a08c6fe5feddbb534659baf002c244c173e03aa947bc30dba1f698ff841b21a9
- MD5 74a68460ddc67986a5045a2fb1aae374
- SHA1 bb2c3d04ea96fe59f997c310b345189d308a864b
- SHA512 a2a43cb924b64e798561f14a9c0fbae8bf777af42496f290e61faa60a56513d0d78fd54175b978e54ecd2560a36c898739dd6b3679783f4d0e5932d70d2de5ed
- SSDEEP 6144:Ej4UFGJ+RglWkyWw7KU9evkCEnoP143DyZgQ:24M5kfOKbEl3DySQ
- TLSH T115148C16E78060BED6FB3570113B6F3568BE9B352F908DC313648952A9307C4DA3AB5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA.css
- Size 82B
- SHA256 35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225
- MD5 b81d1e97c529ac3d7f5a699afce27080
- SHA1 0a981264db289afd71695b4d6849672187e8120f
- SHA512 e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607
- TLSH T160A01100E280200BB033022A32F28000FB2AA0A200008B2CBA2AAE828B280882C30883
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css
- Size 5KB
- SHA256 453d8ca4f52fb8fd40d5b4596596911b9fb0794bb89fbf9b60dc27af3eaa2850
- MD5 7f5fcac447cc2150ac90020f8dc8c98b
- SHA1 5710398d65fba59bd91d603fc340bf2a101df40a
- SHA512 b9fb315fdcf93d028423f49438b1eff40216b377d8c3bc866a20914c17e00bef58a18228bebb8b33c8a64fcaaa34bee84064bb24a525b4c9ac2f26e384edb1ff
- SSDEEP 96:UFoQ//z4NYkx5O6bL1IskwnP8RmoJlopRuAZnUW/vNvy+kDL97Rut3FgMk8ufdfZ:4zZkx5O6f1IskkP8RmoJupRZZnUGNy+C
- TLSH T100C19D8CD6126381A137EB645FF24316FA2200E35F4251593EDCE580CF7A9A89612FEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm
- Size 54KB
- SHA256 00f8f3e4534146858326d6d2524f3360dfc9e5d149e207d61cabac17ad7a5f9f
- MD5 66b63e270cc9186f7186b316606f541f
- SHA1 35468eeefc8d878f843bbf0bb0b4b1d43b843cdf
- SHA512 b9d1b4b201cabf087a44d958584ecb1c110807b9bd9865f1e76bf9d989d7d000ee84f07558bcae5e05d11f7121fe2c402fcf916b00ff5d8eac7eaf05e21a29f2
- SSDEEP 1536:fESyT4+Ydo0TbqFkm0TEnsR3fkPQqj5/1d1kZRKlPFtYDSvnbonS1bunC1b2nbZ+:fbyT4+Ydo0TbqFkm0TEsR3fkPQqj5/XN
- TLSH T1F3437266A11206345AB7737BAFE74349FE7003174A019602BD3C89955FB6C88C1BBFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif
- Size 16KB
- SHA256 9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618
- MD5 1a276cb116bdece96adf8e32c4af4fee
- SHA1 6bc30738fcd0c04370436f4d3340d460d25b788f
- SHA512 5b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6
- SSDEEP 384:3UTbQS+EXdr+BP4pN+7WXg75BWRtH/Wsw/sjgm9/DDDy:3UTbQVEXdr+7WE23wrqO
- TLSH T141726BC6F7690788DE3A387034ED0356673880F2B4AD623F901AAF46BA8673778C2455
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png
- Size 2KB
- SHA256 f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f
- MD5 afeed45df4d74d93c260a86e71e09102
- SHA1 2cc520e3d23f6b371c288645649a482a5db7ccd9
- SHA512 778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d
- TLSH T1BC513CF6C09872B3FC1905C687E7D788F80A45471F9D4C409DAB8EF52C66F064056B15
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\WinHostSvc\.defender_state
- Size 400B
- SHA256 8f1cbc1812e1908265f4bb7217191ff4906b95fe90e786e70aba7f6ccfeadd62
- MD5 fad7fe58b9b53bdac8be7a1e35d54575
- SHA1 4944979c1d51a0fbd3fdaa623b8dd4e2639d16d4
- SHA512 efda14b62e4be3a4a37cc643668f92f5fc4dbb1d8e434e99f0e9da92ec15db67bd895ce95e61f2ea12e52804cbe2501ba5bf3954ed4e1455db708a831f3f229a
- TLSH T190E06D20C4542CFA149182ADC86D9193BB328A335C1C3C28B4454A4C3F5D33E35B9DE0
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\WinHostSvc\winhostsvc.exe
- Size 14.4MB
- SHA256 4d6b422963811adb65620efe279c5293df40aad0ba517dd4e5c50c2d37aebd57
- MD5 26d62c1cedba3cb556d90458c0defbf5
- SHA1 7c615f0e343111e6eb5945a6b5e03afe68f99893
- SHA512 7867040981bb2336922ad6870d85f1ae3f4a037f26b45cd5b52d2e05adf4125953dd9274cce7691352260b33f73dfb0633e742192501dd8fe16df0287079054e
- SSDEEP 196608:lgPVXwhLpvPiM+Btyoh9CggQIPCj6NwjyXok:lFhLpvaMqLh9CggQI4mXok
- TLSH T1D8E67C47E8A101E5C0EED535C6669226BA713C885F3563D72B50FB282F73BE0AE79710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\WinHostSvc\winhostsvc_errors.txt
- Size 6KB
- SHA256 159b6f0d617b6f2e6384e4f150c7c58a09f32d4fb37bbc1af0176c1f8538f179
- MD5 8490d65c1fd85e9ba096f13df0871293
- SHA1 e168be0f7f4789be859e6fb577985adb5013ee16
- SHA512 b962037b5483dec850d2b296a3571cbcc40a3900782c726a1b68ce8df1d57f4b4690405e68a9a284b9577b0e8fa265590779aa949104e540c740ba30198185c5
- SSDEEP 192:6M/8p6IPZYXEsotcq5reUcty8otcq5rewctyaotcq5resctyEovcq5reIKccyL:6M/cBxLs0Do0DS0DI+DVb
- TLSH T13EE18408C7DF436BD20E898E949349152181777A27ED2551FE8C937B271284BEFA393A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
- MD5 d85ba6ff808d9e5444a4b369f5bc2730
- SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
- SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
- TLSH T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 bf03dc62778904c036025f4b63a6e7ad2ee8cae91f7a9281489e7b9a95d97ceb
- MD5 6245e3d49a19add03734aa3fb00bcb6f
- SHA1 8d15f445868ec81bb0270e15ddc1c4f6116d6614
- SHA512 47b69234be0674ef7ea6605b0cd125683565232c78d74098ae20978b392b50b3e35b31075b703a439e33b70bb9ed7886b9291939b2580424577c788346df19f4
- TLSH T125112633F38C8961CC861639509DAC51727687CB819EDF9F7BC0C210E1BF585CB61194
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
- MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
- SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
- SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
- TLSH T183112223F38C8921CC961639509DAC5172B586CB81AFDE9F7FC0C210A1BF584CB61194
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
- MD5 d28a889fd956d5cb3accfbaf1143eb6f
- SHA1 157ba54b365341f8ff06707d996b3635da8446f7
- SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
- TLSH T1AB112223F38C8921CC961639509DAC5172B586CB81AFDE9F7FC0C210E1BF584CB61194
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
- MD5 77d622bb1a5b250869a3238b9bc1402b
- SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
- SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
- TLSH T111112223F38C8921CC961539509DAC5172B586CB81AFDF9F7FC0C211A5BF584CB61194
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WXU4428.tmp\appraiserxp.dll
- Size 364KB
- SHA256 68c5094087050d61a4c882fae31baa7af896b82bb9c32baffa331bb6f684466b
- MD5 8d348553876b2862f87a82e75fb4f704
- SHA1 40eafcf277b35b2c2389b588c9a28103a20233b2
- SHA512 eaf29f41e135da0219814d7e28b9be04aebcf67f6f35e6b581baf6411c983b93cc8358cb78b05cc95a214b596f3c70d71c8a31b3b00ad4e1bc5306501683a7f2
- SSDEEP 6144:KjQieS8vJED4SFQEE5gby/kDzYtMZPNtcOp7HmC8Uh9Pm9Qqo4:RK8vJ7PARDzWMZP3JpjmCBmG0
- TLSH T1E6841800A7418135D8F728F46ABD617E552CB9A00B7090DB63C85BFFAA756D1BE30B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WXU4428.tmp\resources\ux\EULA\EULA_en-gb.htm
- Size 68KB
- SHA256 49aa5fe536281681d0bf933c59622910753c0ee4eb26d96f548cf4b2d752129f
- MD5 05627bc6899f8853de9a63f304d1937a
- SHA1 11ccb451025a9b3d1f58b44b730521a7652fdb74
- SHA512 2a0c6569b1dbf7a6754cb870325eefc028f69a758ca44c78da9ac77b03f60feba862e1bdd230ab6b78efb64e0da056917a50b18dd9adadd7e79f1fbb164eef9b
- SSDEEP 1536:hbn9+hdP3oOhsv6QEpCdCwj/Rk/JpPBS05Qi2om2ox0BhX3yFIuuYP59ELPIoGbW:WJ4MXjpEQN
- TLSH T1D263B705E3111302C27341BA70D766DAB8111DA9C35BC792F476962D7887EEC2BBA3ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WXU4428.tmp\resources\ux\EULA\EULA_es-es.htm
- Size 78KB
- SHA256 2cd165a4c0828c814c27b1ce07c3e4d8f254cda4eb2e91cf87b242c53002f312
- MD5 75c32dd12eb6a303f16b4561aa4a3720
- SHA1 628b9c1504abc72296821575f769a14d4635841f
- SHA512 b6759d223f0bef67f36ca74bd519e3f2cbf8dbb97ff218fb2f236cf41facaa08cdd6e8949adb4e22c75a00dd19e048c7d2fb68ef3d9d7f790ab7b49ba44b42f6
- SSDEEP 1536:hiG4cNWcgaNLWhbnCXCWR/au/d4Z7FNx76bvKVIuWIQX2fBC/6yxzCeECTisF3xc:gJHU6U3U/WTHLo
- TLSH T1B773C610D5900702C27382A6F1C3A68AF8404AC9C64BD793F176975EB4CFEDC9A5A7ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WXU4428.tmp\resources\ux\EULA\EULA_fr-ca.htm
- Size 82KB
- SHA256 531ae3e6ae92c7d173415fb7a3a95fdf61fb3e3fcb703a4606c9590225f03aca
- MD5 b0bbf69d2d7a34f86e0acea9bd678ea7
- SHA1 c0343796308bdfe623eb1f0caf99538eb58b76fb
- SHA512 7bc0b314cf4eb625aa56e6134f1cd544ce1f38b84c7a478ba2f34a484ab41328f820a1601a8d0f5ee602a59ace1e496f69c2820ce472b8d57a5dfa5fc8be69be
- SSDEEP 1536:houCUvS27oDVMcCKjU0ChCho3nN/sOMHaOBtxoGEjTrECtmVt4SJubHH16UlWN4z:2fPu7V3edSKdHQ
- TLSH T16D83EA08C5900605C27380B6F6C257DBAC08CA848397D751F5B76A5AA9CBC9CFBC97ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WXU4428.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktop.css
- Size 39KB
- SHA256 03a724309e738786023766fde298d17b6ccfcc3d2dbbf5c41725cf93eb891feb
- MD5 5ad8ceea06e280b9b42e1b8df4b8b407
- SHA1 693ea7ac3f9fed186e0165e7667d2c41376c5d61
- SHA512 1694fa3b9102771eef8a42b367d076c691b002de81eb4334ac6bd7befde747b168e7ed8f94f1c8f8877280f51c44adb69947fc1d899943d25b679a1be71dec84
- SSDEEP 384:xncKR5kFm3/tsDQdI4WEe3/ybrFP3tgYSqAxQ4g:2Mh
- TLSH T19E0322DC511C731443B22B74F3DA5C01EB6041B7CF4AA1AA78A1247AB1C44D96B7BFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zwsyhhhg.err.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\memreduct-3.5.2-setup.exe
- Size 4.0MB
- SHA256 837f97852c2e8f4242cde4dbf863ed0db117082d2eebfb7c3f1f37f9b6e89758
- MD5 8eb03b7f178eccb8bd71ca6390e924cc
- SHA1 8ac232df39c6c1a9caa1b35dc521df7bc3dbde6b
- SHA512 cf37bf2ba5d720b6c435d5eb98822565cf2192dcba709655e8fdd9e80661c67a6a4101be676e826c7a3cd0b2ee7163cd5639ed56403ae66ce3911ce483dbb9d8
- SSDEEP 98304:egiywctyoh4cCg2/b0NN2dR1UjICj63dzBEVht5f/LyXtcH/i:RBtyoh9CggQIPCj6NwjyXv
- TLSH T1D816E0C366E40129E5FF6A345A79127D446BBD6C5BF3C18F12870DA81B30AACED34726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc-history-2081798614.sqlite
- Size 5.0MB
- SHA256 3e725217d922a32e9cd028f51675265a20de29926051c6ad09260f0e3ad78abe
- MD5 ff0af51b58b86a5085209349d90aeadb
- SHA1 ac5e626a30249e65864d9f92b918b83814dda645
- SHA512 9f43d01493d0c2cddc5c132b8f061cf84406db9036efd6688b5f8ff16f0b638ed4da5761d016b07d00fa2c8af98a896ccd5f80e2d4637e5b27e048909743ee87
- SSDEEP 96:D4k1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ8Q:M8rJQaXoMXp0VW9FxWHt7sKWKKL0Zm
- TLSH T12F36101F7A201154C4DAA232BDE36F29183F70169A3376933A94656D4DD0723B92DCBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc-history-2186007602.sqlite
- Size 160KB
- SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
- MD5 ea2f1147ca310fa5d8e3dc3cca218f60
- SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
- SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
- SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
- TLSH T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc-history-4081719319.sqlite
- Size 204KB
- SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
- MD5 0f709d9a7125f5d69ba52e8846867f41
- SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
- SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
- SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
- TLSH T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc_errors.txt
- Size 1KB
- SHA256 233c960816438c144bebda8694f53f9b717d900cde94eb96d823daee1daa9f8d
- MD5 0dde07c57acada20bca3bc565cc93a9b
- SHA1 25400d0d51bbbd03f3ad44b419f109e84210810f
- SHA512 9c36f137d956944086ea29cad9f54b288347a8599efa69766f99f9f869895d1cd4237565fb5bfa71ba7daf9d65ae277efbdb3a8e57244626320b642a238fe9bb
- TLSH T18431E24486EF4B76E80FCA4F86645C9645D2777B5F882210EF44B4E87A4680F363F931
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc_errors.txt
- Size 13KB
- SHA256 517c2ef2506cc71f8b67bb6dc915b5b5eeaa2c6da585b5bffbb26cd0b1345fd0
- MD5 37f8604b380dac617877d7eb962f35f9
- SHA1 269bcace147ff00e3c53a3f5da294923863bb096
- SHA512 aa77ea2e8332233369ee11e9c7a24b15132e1a3cf2d610fbf584aeb3dbe33babd99bee6179d1386326ab19f309014ae5f20a13f0770b783458a2e5ba73ebb894
- SSDEEP 384:6M/cBxLs0Do0DS0DI+DVzH+DH0DEc0D2Oan6/+U/R/K:Rcfs080+0M+dH+z04c0COi6/+U/R/K
- TLSH T18E52A40887DF436BD20E8A8E905309552181777E23DD2551FE8C96BB2712847EFABD3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc_errors.txt
- Size 14KB
- SHA256 65257580dc7bea2eda8240a285fbfc66df5b863151b6ad76bc13b3d8e9beaf10
- MD5 b6dc9fc1ac947210c997979b1cbadcd0
- SHA1 995a23ca3b5244e4817d49037976c757e50ffc3c
- SHA512 131638cbcb3cf592faba25a641d991835427a94cd52c983dade0a5d1f9e37a691baba8f565a320a49f6de43e9232f0ed529e1a61bd0bc5f4ef83ec24c8b29a62
- SSDEEP 384:6M/cBxLs0Do0DS0DI+DVzH+DH0DEc0D2Oan6/+U/R/Wm0qQP1nKW:Rcfs080+0M+dH+z04c0COi6/+U/R/Wmi
- TLSH T12D62B50893DF476BD20E8A8E8057095521C2777E23DD2451FE8C56BB2712847AFBB93A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc_errors.txt
- Size 14KB
- SHA256 c39d9a79ecc649f7aaf359f5c02db2089ce65d33a7ac71dbd1ac2a82ef283960
- MD5 0020721dd217c0f1e713065c981ecb13
- SHA1 93a745174db2bc8327e177d1e91cd49a73e25225
- SHA512 1b80e635ef769fa70ba5ab3770f12ccdb695192055461b3ba5c14ff4fb42f5715ff14a63ca73de02957dfd197fb50f43355714ade1fa625ff110aa3a90aecc60
- SSDEEP 384:6M/cBxLs0Do0DS0DI+DVzH+DH0DEc0D2Oan6/+U/R/Wm0qQP1nKqwVj:Rcfs080+0M+dH+z04c0COi6/+U/R/Wm7
- TLSH T13F62A60893DF476BE20E8E8E8057095121C2777A23DD2411FE8C56BB6712847AFBF939
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc_errors.txt
- Size 15KB
- SHA256 ecd87c327bdd1d5d63f3496faa52ed465195a0c56e2b88f50bca58b255ac3bbe
- MD5 f1d8d64af5b656e413a7991434661534
- SHA1 525bcb1cb1a35a3467883651094a05aa177dcc32
- SHA512 aa8acaed54344a7a48eccb33f9a519d06b29f2c37c639805bac3f6d949219f7452bd332dc912eb8f7e056a16db68198d824817edf2ae877a94a9862364cc6cc4
- SSDEEP 384:6M/cBxLs0Do0DS0DI+DVzH+DH0DEc0D2Oan6/+U/R/Wm0qQP1nKqwVV0Ug:Rcfs080+0M+dH+z04c0COi6/+U/R/WmU
- TLSH T14662950893DF476BE20E8E8E8157095121C2777A23DD2411FE8C56BB6712847AFBF939
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc_errors.txt
- Size 15KB
- SHA256 08fd7112a8f3cb26ffef0f386cc25d3ffc8cd05cdf2f141d26eec737096d2916
- MD5 c9baf88e1d4297202b22dade17bbe167
- SHA1 c4496ad1fcb3d9edaad2369f025f882de5db640b
- SHA512 dca777486cec3924c7b453ba0cb92a1488c155d93a6f0b22a61160fb2386d473f56dfe79114a7a49bce4a85481b2f938ce0d5f8648e48bc3cc3abbf6fccf3598
- SSDEEP 384:6M/cBxLs0Do0DS0DI+DVzH+DH0DEc0D2Oan6/+U/R/Wm0qQP1nKqwVV0Uus:Rcfs080+0M+dH+z04c0COi6/+U/R/Wmb
- TLSH T19D62A60893DF476BE20E8E8E8157095121C2777A23DD2411FE8C56BB6712847AFBF939
- MD5 SHA1 SHA512 SSDEEP TLSH