Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 01:47
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
33 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
30 signatures
150 seconds
General
- Target 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe
- Size 14.4MB
- Sample260806-b72aps1dmb
- SHA256 4d6b422963811adb65620efe279c5293df40aad0ba517dd4e5c50c2d37aebd57
- MD5 26d62c1cedba3cb556d90458c0defbf5
- SHA1 7c615f0e343111e6eb5945a6b5e03afe68f99893
- SHA512 7867040981bb2336922ad6870d85f1ae3f4a037f26b45cd5b52d2e05adf4125953dd9274cce7691352260b33f73dfb0633e742192501dd8fe16df0287079054e
- SSDEEP 196608:lgPVXwhLpvPiM+Btyoh9CggQIPCj6NwjyXok:lFhLpvaMqLh9CggQI4mXok
- TLSH T1D8E67C47E8A101E5C0EED535C6669226BA713C885F3563D72B50FB282F73BE0AE79710
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/files/0x001000000001c483-281.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Windows security bypass 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
resource yara_rule behavioral2/files/0x001000000001c483-281.dat INDICATOR_SUSPICIOUS_DisableWinDefender - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x001000000001c483-281.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1204 powershell.exe - Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHostSvc.vbs 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Deletes itself 1 IoCs
pid Process 5232 winhostsvc.exe - Executes dropped EXE 6 IoCs
pid Process 4196 memreduct-3.5.2-setup.exe 5888 Windows10UpgraderApp.exe 3580 winhostsvc.exe 5232 winhostsvc.exe 3380 winhostsvc.exe 3172 winhostsvc.exe - Loads dropped DLL 2 IoCs
pid Process 5888 Windows10UpgraderApp.exe 5888 Windows10UpgraderApp.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHostSvc = "C:\\ProgramData\\WinHostSvc\\winhostsvc.exe" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe Set value (str) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHostSvc = "C:\\ProgramData\\WinHostSvc\\winhostsvc.exe" 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 7 discord.com - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_it-it.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_bg-bg.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_cs-cz.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktop.css memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\WinDlp.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_en-gb.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_fi-fi.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sl-si.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\ui-dark.css memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentOOBE.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_fr-fr.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_lt-lt.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_zh-cn.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ca-es.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_pt-pt.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ro-ro.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_nl-nl.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_tr-tr.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_germany_region.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_hr-hr.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_da-dk.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_en-us.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_pt-br.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ru-ru.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sr-latn-rs.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_es-mx.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_th-th.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\base.js memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_es-es.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_et-ee.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_he-il.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sk-sk.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_sv-se.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_de-de.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_hu-hu.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ar-sa.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_pl-pl.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_uk-ua.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_eu-es.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_fr-ca.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ko-kr.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_zh-tw.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_lv-lv.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_el-gr.htm memreduct-3.5.2-setup.exe File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini Windows10UpgraderApp.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_gl-es.htm memreduct-3.5.2-setup.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA\EULA_ja-jp.htm memreduct-3.5.2-setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language memreduct-3.5.2-setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows10UpgraderApp.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Windows10UpgraderApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Windows10UpgraderApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Windows10UpgraderApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Windows10UpgraderApp.exe - Detects videocard installed 1 TTPs 5 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 5660 wmic.exe 3376 wmic.exe 6052 wmic.exe 4936 wmic.exe 4328 wmic.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Windows10UpgraderApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Windows10UpgraderApp.exe Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main Windows10UpgraderApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Windows10UpgraderApp.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1672 schtasks.exe 3240 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4580 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 4580 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 1204 powershell.exe 1204 powershell.exe 5232 winhostsvc.exe 5232 winhostsvc.exe 2504 wmic.exe 2504 wmic.exe 2504 wmic.exe 2504 wmic.exe 4872 wmic.exe 4872 wmic.exe 4872 wmic.exe 4872 wmic.exe 5660 wmic.exe 5660 wmic.exe 5660 wmic.exe 5660 wmic.exe 480 wmic.exe 480 wmic.exe 480 wmic.exe 480 wmic.exe 2704 wmic.exe 2704 wmic.exe 2704 wmic.exe 2704 wmic.exe 2980 wmic.exe 2980 wmic.exe 2980 wmic.exe 2980 wmic.exe 3376 wmic.exe 3376 wmic.exe 3376 wmic.exe 3376 wmic.exe 4444 wmic.exe 4444 wmic.exe 4444 wmic.exe 4444 wmic.exe 4140 wmic.exe 4140 wmic.exe 4140 wmic.exe 4140 wmic.exe 6084 wmic.exe 6084 wmic.exe 6084 wmic.exe 6084 wmic.exe 6052 wmic.exe 6052 wmic.exe 6052 wmic.exe 6052 wmic.exe 2336 wmic.exe 2336 wmic.exe 2336 wmic.exe 2336 wmic.exe 3056 wmic.exe 3056 wmic.exe 3056 wmic.exe 3056 wmic.exe 5740 wmic.exe 5740 wmic.exe 5740 wmic.exe 5740 wmic.exe 4936 wmic.exe 4936 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1204 powershell.exe Token: SeBackupPrivilege 4196 memreduct-3.5.2-setup.exe Token: SeRestorePrivilege 4196 memreduct-3.5.2-setup.exe Token: SeIncreaseQuotaPrivilege 2504 wmic.exe Token: SeSecurityPrivilege 2504 wmic.exe Token: SeTakeOwnershipPrivilege 2504 wmic.exe Token: SeLoadDriverPrivilege 2504 wmic.exe Token: SeSystemProfilePrivilege 2504 wmic.exe Token: SeSystemtimePrivilege 2504 wmic.exe Token: SeProfSingleProcessPrivilege 2504 wmic.exe Token: SeIncBasePriorityPrivilege 2504 wmic.exe Token: SeCreatePagefilePrivilege 2504 wmic.exe Token: SeBackupPrivilege 2504 wmic.exe Token: SeRestorePrivilege 2504 wmic.exe Token: SeShutdownPrivilege 2504 wmic.exe Token: SeDebugPrivilege 2504 wmic.exe Token: SeSystemEnvironmentPrivilege 2504 wmic.exe Token: SeRemoteShutdownPrivilege 2504 wmic.exe Token: SeUndockPrivilege 2504 wmic.exe Token: SeManageVolumePrivilege 2504 wmic.exe Token: 33 2504 wmic.exe Token: 34 2504 wmic.exe Token: 35 2504 wmic.exe Token: 36 2504 wmic.exe Token: SeIncreaseQuotaPrivilege 2504 wmic.exe Token: SeSecurityPrivilege 2504 wmic.exe Token: SeTakeOwnershipPrivilege 2504 wmic.exe Token: SeLoadDriverPrivilege 2504 wmic.exe Token: SeSystemProfilePrivilege 2504 wmic.exe Token: SeSystemtimePrivilege 2504 wmic.exe Token: SeProfSingleProcessPrivilege 2504 wmic.exe Token: SeIncBasePriorityPrivilege 2504 wmic.exe Token: SeCreatePagefilePrivilege 2504 wmic.exe Token: SeBackupPrivilege 2504 wmic.exe Token: SeRestorePrivilege 2504 wmic.exe Token: SeShutdownPrivilege 2504 wmic.exe Token: SeDebugPrivilege 2504 wmic.exe Token: SeSystemEnvironmentPrivilege 2504 wmic.exe Token: SeRemoteShutdownPrivilege 2504 wmic.exe Token: SeUndockPrivilege 2504 wmic.exe Token: SeManageVolumePrivilege 2504 wmic.exe Token: 33 2504 wmic.exe Token: 34 2504 wmic.exe Token: 35 2504 wmic.exe Token: 36 2504 wmic.exe Token: SeIncreaseQuotaPrivilege 4872 wmic.exe Token: SeSecurityPrivilege 4872 wmic.exe Token: SeTakeOwnershipPrivilege 4872 wmic.exe Token: SeLoadDriverPrivilege 4872 wmic.exe Token: SeSystemProfilePrivilege 4872 wmic.exe Token: SeSystemtimePrivilege 4872 wmic.exe Token: SeProfSingleProcessPrivilege 4872 wmic.exe Token: SeIncBasePriorityPrivilege 4872 wmic.exe Token: SeCreatePagefilePrivilege 4872 wmic.exe Token: SeBackupPrivilege 4872 wmic.exe Token: SeRestorePrivilege 4872 wmic.exe Token: SeShutdownPrivilege 4872 wmic.exe Token: SeDebugPrivilege 4872 wmic.exe Token: SeSystemEnvironmentPrivilege 4872 wmic.exe Token: SeRemoteShutdownPrivilege 4872 wmic.exe Token: SeUndockPrivilege 4872 wmic.exe Token: SeManageVolumePrivilege 4872 wmic.exe Token: 33 4872 wmic.exe Token: 34 4872 wmic.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5888 Windows10UpgraderApp.exe 5888 Windows10UpgraderApp.exe 5888 Windows10UpgraderApp.exe 5888 Windows10UpgraderApp.exe 5888 Windows10UpgraderApp.exe 5888 Windows10UpgraderApp.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4580 wrote to memory of 4196 4580 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 90 PID 4580 wrote to memory of 1204 4580 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 91 PID 4196 wrote to memory of 5888 4196 memreduct-3.5.2-setup.exe 93 PID 4580 wrote to memory of 1672 4580 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 95 PID 4580 wrote to memory of 3240 4580 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 97 PID 4580 wrote to memory of 5232 4580 2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 102 PID 5232 wrote to memory of 3380 5232 winhostsvc.exe 103 PID 5232 wrote to memory of 2504 5232 winhostsvc.exe 106 PID 5232 wrote to memory of 4872 5232 winhostsvc.exe 108 PID 5232 wrote to memory of 5660 5232 winhostsvc.exe 110 PID 5232 wrote to memory of 480 5232 winhostsvc.exe 112 PID 5232 wrote to memory of 2704 5232 winhostsvc.exe 115 PID 5232 wrote to memory of 2980 5232 winhostsvc.exe 117 PID 5232 wrote to memory of 3376 5232 winhostsvc.exe 119 PID 5232 wrote to memory of 4444 5232 winhostsvc.exe 121 PID 5232 wrote to memory of 4140 5232 winhostsvc.exe 123 PID 5232 wrote to memory of 6084 5232 winhostsvc.exe 125 PID 5232 wrote to memory of 6052 5232 winhostsvc.exe 127 PID 5232 wrote to memory of 2336 5232 winhostsvc.exe 129 PID 5232 wrote to memory of 3056 5232 winhostsvc.exe 131 PID 5232 wrote to memory of 5740 5232 winhostsvc.exe 133 PID 5232 wrote to memory of 4936 5232 winhostsvc.exe 135 PID 5232 wrote to memory of 5380 5232 winhostsvc.exe 137 PID 5232 wrote to memory of 5920 5232 winhostsvc.exe 139 PID 5232 wrote to memory of 4860 5232 winhostsvc.exe 141 PID 5232 wrote to memory of 4328 5232 winhostsvc.exe 143 PID 5232 wrote to memory of 624 5232 winhostsvc.exe 145 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection Windows10UpgraderApp.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Creates a file in the Startup directory
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\memreduct-3.5.2-setup.exeC:\Users\Admin\AppData\Local\Temp\memreduct-3.5.2-setup.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe" /SkipSelfUpdate /SunValley3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:5888
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "exit 0"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN WinHostSvcLogon /TR \"C:\ProgramData\WinHostSvc\winhostsvc.exe\" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:1672
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN WinHostSvcBoot /TR \"C:\ProgramData\WinHostSvc\winhostsvc.exe\" /SC ONSTART /RU SYSTEM /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:3240
-
-
C:\ProgramData\WinHostSvc\winhostsvc.exeC:\ProgramData\WinHostSvc\winhostsvc.exe -cleanup-source C:\Users\Admin\AppData\Local\Temp\2026-08-06_26d62c1cedba3cb556d90458c0defbf5_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\ProgramData\WinHostSvc\winhostsvc.exeC:\ProgramData\WinHostSvc\winhostsvc.exe -watchdog 52323⤵
- Executes dropped EXE
PID:3380
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,LoadPercentage /value3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory,TotalVisibleMemorySize /value3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_VideoController get Name,AdapterRAM /value3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
PID:5660
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get Model,InterfaceType,MediaType,Size /value3⤵
- Suspicious behavior: EnumeratesProcesses
PID:480
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,LoadPercentage /value3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory,TotalVisibleMemorySize /value3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_VideoController get Name,AdapterRAM /value3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
PID:3376
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get Model,InterfaceType,MediaType,Size /value3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,LoadPercentage /value3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4140
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory,TotalVisibleMemorySize /value3⤵
- Suspicious behavior: EnumeratesProcesses
PID:6084
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_VideoController get Name,AdapterRAM /value3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
PID:6052
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get Model,InterfaceType,MediaType,Size /value3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,LoadPercentage /value3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3056
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory,TotalVisibleMemorySize /value3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5740
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_VideoController get Name,AdapterRAM /value3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
PID:4936
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get Model,InterfaceType,MediaType,Size /value3⤵PID:5380
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,LoadPercentage /value3⤵PID:5920
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory,TotalVisibleMemorySize /value3⤵PID:4860
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_VideoController get Name,AdapterRAM /value3⤵
- Detects videocard installed
PID:4328
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get Model,InterfaceType,MediaType,Size /value3⤵PID:624
-
-
-
C:\ProgramData\WinHostSvc\winhostsvc.exe"C:\ProgramData\WinHostSvc\winhostsvc.exe"1⤵
- Executes dropped EXE
PID:3580
-
C:\ProgramData\WinHostSvc\winhostsvc.exeC:\ProgramData\WinHostSvc\winhostsvc.exe1⤵
- Executes dropped EXE
PID:3172
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
- Size 3.5MB
- SHA256 3d6675649b66674a9488f399898df788e7693f7a622ba66db3ef9296c23c1953
- MD5 1c4c26433d7dfad06a6d58a19f8b8d2f
- SHA1 c3a54496d49f1dd85902a50f500f0a1828aeeb58
- SHA512 e9bf314d150be4ee27897dbe14ff8db365cdc6ce2d0a8849f078a7055087c22f579ceb69f234cce805c8a02e6710e079dbac7e0e8ce750503eb832ea4075cb06
- SSDEEP 49152:X5CkppwlOZP7S0JqAUnQQZr5ydpekLPd/PdpAS0JGBpQQZV35w7dDo:Bpd
- TLSH T1EB06D75382F49A24D4F7E2679A5B3A36445E5C3C5722D3C6F20C888E6BD4EAC8770376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll
- Size 364KB
- SHA256 68c5094087050d61a4c882fae31baa7af896b82bb9c32baffa331bb6f684466b
- MD5 8d348553876b2862f87a82e75fb4f704
- SHA1 40eafcf277b35b2c2389b588c9a28103a20233b2
- SHA512 eaf29f41e135da0219814d7e28b9be04aebcf67f6f35e6b581baf6411c983b93cc8358cb78b05cc95a214b596f3c70d71c8a31b3b00ad4e1bc5306501683a7f2
- SSDEEP 6144:KjQieS8vJED4SFQEE5gby/kDzYtMZPNtcOp7HmC8Uh9Pm9Qqo4:RK8vJ7PARDzWMZP3JpjmCBmG0
- TLSH T1E6841800A7418135D8F728F46ABD617E552CB9A00B7090DB63C85BFFAA756D1BE30B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll
- Size 199KB
- SHA256 a08c6fe5feddbb534659baf002c244c173e03aa947bc30dba1f698ff841b21a9
- MD5 74a68460ddc67986a5045a2fb1aae374
- SHA1 bb2c3d04ea96fe59f997c310b345189d308a864b
- SHA512 a2a43cb924b64e798561f14a9c0fbae8bf777af42496f290e61faa60a56513d0d78fd54175b978e54ecd2560a36c898739dd6b3679783f4d0e5932d70d2de5ed
- SSDEEP 6144:Ej4UFGJ+RglWkyWw7KU9evkCEnoP143DyZgQ:24M5kfOKbEl3DySQ
- TLSH T115148C16E78060BED6FB3570113B6F3568BE9B352F908DC313648952A9307C4DA3AB5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\WinHostSvc\.defender_state
- Size 402B
- SHA256 b70a61855df355d3c89bc48e94f685a21d2fb21833c4a36e83250926fcffb749
- MD5 09897827e61bc3626611a98b6da9ee16
- SHA1 f769be95df973da004f4cbe049f8a37fa307ab0d
- SHA512 bc5454d2dac99e6de07a92357a37eaae7d627b553f30772d3eeb987c5c0c45c119fe27cee1172116cabd033dc3cd54a7918ae8bbe1e53e6713485b1ccd4bc853
- TLSH T1B0E09A20C4582CFA259282BDC86D9193BB328A736C1C3D38B409064C3F1D33E35BAEE0
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\WinHostSvc\winhostsvc.exe
- Size 14.4MB
- SHA256 4d6b422963811adb65620efe279c5293df40aad0ba517dd4e5c50c2d37aebd57
- MD5 26d62c1cedba3cb556d90458c0defbf5
- SHA1 7c615f0e343111e6eb5945a6b5e03afe68f99893
- SHA512 7867040981bb2336922ad6870d85f1ae3f4a037f26b45cd5b52d2e05adf4125953dd9274cce7691352260b33f73dfb0633e742192501dd8fe16df0287079054e
- SSDEEP 196608:lgPVXwhLpvPiM+Btyoh9CggQIPCj6NwjyXok:lFhLpvaMqLh9CggQI4mXok
- TLSH T1D8E67C47E8A101E5C0EED535C6669226BA713C885F3563D72B50FB282F73BE0AE79710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\WinHostSvc\winhostsvc_errors.txt
- Size 1KB
- SHA256 ce43a6dd6ccc71aebb4a97af75ff1cccf6dcfddbab74d9ce3bf14e396e8c3629
- MD5 38e606003b5b763d87be01b8fc098ce7
- SHA1 c596030cda57f980fbb162669e3fac2f01849cbd
- SHA512 b07a9efe54613ef3bd0cc33262a7564db1cde65a687644753d8f26f93f923460dbb7dc77a19eda74c936f4a1b09d441880b99a470b8d6f1b9bf3785d7e010103
- TLSH T134319D1086FF8E76F806D68FC2A528956AD2767E9B6C2250EF4449CA550E80B373F831
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\WinHostSvc\winhostsvc_errors.txt
- Size 2KB
- SHA256 a61e8f22d61ced875e14f3207c5367bfcdc4d4e8a83f016253194f34da21190a
- MD5 3c4831a839e22584a83684ba0f068d12
- SHA1 57c8622a5dfd40341154504a1585247ff061e75c
- SHA512 63c651f0dd3ca5df8ee5ec9f63cd5c8930d022e6b1d9a67cd4df8f496fd66dc54bb2370a66b85eb8af475f94f84065199c4cad2bc09f4ed794dafeefd15bc6a6
- TLSH T19F51DF0096EF8DBAF407CB8EC2662C9665D7767D976C2211FF4444C6650A4073B3E831
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\WinHostSvc\winhostsvc_errors.txt
- Size 3KB
- SHA256 2411ec8bf4eff8857bf2774066adec984adf7092196caf918e68de2b23be7e2f
- MD5 3e7df9a66039b4a289e8684b5e585bff
- SHA1 21d126cf44bdfbf4b1c9a1790813fea1362b5b58
- SHA512 046fbb21bbedc936cb2df00ba82fa0fa435da33a92b54c90d50a6a6ea1ea3ce99d0cf8e7f33807e451ce4ccd87f92d0626040b74a562b75c5263d4456f587fda
- TLSH T12671E20452DF4AB5F806CBCDD2562D9266D7717E936C2210FF8954D6790E4073B3E831
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\WinHostSvc\winhostsvc_errors.txt
- Size 5KB
- SHA256 d10138f6304a74ef37d09627a53aeeb74c6189a98adfb4336df43359433b7e0c
- MD5 c5dfdbbbccb94bcc78ef9c356a265bff
- SHA1 db723e19ad517beb21f71c19e19965992e29a0e7
- SHA512 51354c9a4439d9c457da758f9cc81faafb20aa49d9e5a79ffa53294f778390067c819ba08d085d1e65d771fbfc7ea91a238b9fd949454b2a5e6abe1be34c803c
- SSDEEP 96:KRxrMdIP0DtD6z2R+p0DEQ0D+OYON96j5TrgbhNqHUiM0DKt0DYxkciVrH8DGg:WryI8d66rIx1YOH6j5TrgbnqPu68SdHq
- TLSH T191B1D10496DF4A76F807CBCEC2591DA26AD7B27EA36C2211FF4954D6690E4073B3E831
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\WinHostSvc\winhostsvc_errors.txt
- Size 5KB
- SHA256 d5e8e391e762214eb2b65341d40a35be045f6c292ec0478a60b76f0f5a1778be
- MD5 a407facd2d18f6f1196a42d49f305fea
- SHA1 16c38cd78f07bb9537e04786204bc725c15605fd
- SHA512 c6e9305e59093401e270d473902ecd13798eea51d0a8b18d576a1841e1a0c471f9de1f75405da8f08d8c0e82d023525c2c4ed65c49e8714781a0a8c8cfa9d845
- SSDEEP 96:KRxrMdIP0DtD6z2R+p0DEQ0D+OYON96j5TrgbhNqHUiM0DKt0DYxkciVrH8DGLJ:WryI8d66rIx1YOH6j5TrgbnqPu68SdH/
- TLSH T1B9B1F20496DF4A76F807CBCEC2591DA22AD7B27EA36C2611FF4554D6A90E4073B3E831
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WXU4397.tmp\resources\ux\EULA\EULA_en-us.htm
- Size 68KB
- SHA256 49aa5fe536281681d0bf933c59622910753c0ee4eb26d96f548cf4b2d752129f
- MD5 05627bc6899f8853de9a63f304d1937a
- SHA1 11ccb451025a9b3d1f58b44b730521a7652fdb74
- SHA512 2a0c6569b1dbf7a6754cb870325eefc028f69a758ca44c78da9ac77b03f60feba862e1bdd230ab6b78efb64e0da056917a50b18dd9adadd7e79f1fbb164eef9b
- SSDEEP 1536:hbn9+hdP3oOhsv6QEpCdCwj/Rk/JpPBS05Qi2om2ox0BhX3yFIuuYP59ELPIoGbW:WJ4MXjpEQN
- TLSH T1D263B705E3111302C27341BA70D766DAB8111DA9C35BC792F476962D7887EEC2BBA3ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WXU4397.tmp\resources\ux\EULA\EULA_es-mx.htm
- Size 78KB
- SHA256 2cd165a4c0828c814c27b1ce07c3e4d8f254cda4eb2e91cf87b242c53002f312
- MD5 75c32dd12eb6a303f16b4561aa4a3720
- SHA1 628b9c1504abc72296821575f769a14d4635841f
- SHA512 b6759d223f0bef67f36ca74bd519e3f2cbf8dbb97ff218fb2f236cf41facaa08cdd6e8949adb4e22c75a00dd19e048c7d2fb68ef3d9d7f790ab7b49ba44b42f6
- SSDEEP 1536:hiG4cNWcgaNLWhbnCXCWR/au/d4Z7FNx76bvKVIuWIQX2fBC/6yxzCeECTisF3xc:gJHU6U3U/WTHLo
- TLSH T1B773C610D5900702C27382A6F1C3A68AF8404AC9C64BD793F176975EB4CFEDC9A5A7ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WXU4397.tmp\resources\ux\EULA\EULA_fr-fr.htm
- Size 82KB
- SHA256 531ae3e6ae92c7d173415fb7a3a95fdf61fb3e3fcb703a4606c9590225f03aca
- MD5 b0bbf69d2d7a34f86e0acea9bd678ea7
- SHA1 c0343796308bdfe623eb1f0caf99538eb58b76fb
- SHA512 7bc0b314cf4eb625aa56e6134f1cd544ce1f38b84c7a478ba2f34a484ab41328f820a1601a8d0f5ee602a59ace1e496f69c2820ce472b8d57a5dfa5fc8be69be
- SSDEEP 1536:houCUvS27oDVMcCKjU0ChCho3nN/sOMHaOBtxoGEjTrECtmVt4SJubHH16UlWN4z:2fPu7V3edSKdHQ
- TLSH T16D83EA08C5900605C27380B6F6C257DBAC08CA848397D751F5B76A5AA9CBC9CFBC97ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WXU4397.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css
- Size 40KB
- SHA256 c6dd0940a263382fb735f1cdc8550234f9c081625bfe2e5363cb8bb65cc06440
- MD5 415d4bb726c52bd91be8f3afd81e50cc
- SHA1 9732e1e6aeb13a6f180b21bb5bd8a4acf7d96dbd
- SHA512 c7a8b805027906d8b67d50773a7e362f2e87d3af61b23fab33aec929e21f42610a35f857ede9a17772c5f2b42c1382f8daf7240b76f3996aa65988a87c367847
- SSDEEP 384:xncKR5kFm3/tsDQdI4WEe3/ybrFP3DgYSqAxQ4Z:2eY
- TLSH T1320322DC511C731443B22B74F3DA5C01EB6041B78F4AA1AA78A1247EB1C44D96B7BFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\memreduct-3.5.2-setup.exe
- Size 4.0MB
- SHA256 837f97852c2e8f4242cde4dbf863ed0db117082d2eebfb7c3f1f37f9b6e89758
- MD5 8eb03b7f178eccb8bd71ca6390e924cc
- SHA1 8ac232df39c6c1a9caa1b35dc521df7bc3dbde6b
- SHA512 cf37bf2ba5d720b6c435d5eb98822565cf2192dcba709655e8fdd9e80661c67a6a4101be676e826c7a3cd0b2ee7163cd5639ed56403ae66ce3911ce483dbb9d8
- SSDEEP 98304:egiywctyoh4cCg2/b0NN2dR1UjICj63dzBEVht5f/LyXtcH/i:RBtyoh9CggQIPCj6NwjyXv
- TLSH T1D816E0C366E40129E5FF6A345A79127D446BBD6C5BF3C18F12870DA81B30AACED34726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc-history-1772543155.sqlite
- Size 160KB
- SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
- MD5 ea2f1147ca310fa5d8e3dc3cca218f60
- SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
- SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
- SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
- TLSH T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc-history-2652566792.sqlite
- Size 5.0MB
- SHA256 419ccaaa8dfff9f7d7e4116b450a2aa99977364519cc28798644017f6af93f12
- MD5 bf69609e47220a1bccfa217b7c823c2e
- SHA1 0f70d24861f0956b159c7d37d8805b6c8eca0e4e
- SHA512 6cf1839f99c09e434f28af1bee425dec68cb034d5a1995de328e8434d555c39ae96d80c0164cad47daea97ca35c75482a8a0ce3459e87d8f53b31192036ae1eb
- SSDEEP 192:M8rJQaXoMXp0VW9FxWHbTes62X82xDbZm:M8r54w0VW3xWHT8
- TLSH T15D361F1F7A201150C5DAA232ACE32F15687F70168A3376933DA4256D4EE0723B96DCFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc-history-3788391261.sqlite
- Size 224KB
- SHA256 53989f3e363c23980ab2a8571ba0b43ca8e63679215dd29c12daf46e9db15128
- MD5 4c2d9fe57645816af4c01cb1a6b66b95
- SHA1 30e885518e5d5032b9c28965f46c94ddfc0935a4
- SHA512 32144801bfe43383e0159cd0d4131400194a6d400027cda6418e93ae4bc062c86b99a2c21c9297d2b829b4fdaed8960e322801f5e5b5cdc89de595ccc50c47f6
- SSDEEP 96:b6imFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqD:bTlH+bF+UI3iWGVoWN3qL/9VVV63
- TLSH T1B324EE4E5F343722CDBD913668E644A35C7CF03F8B5366DA686114B4CEE2652A02C8BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc_errors.txt
- Size 6KB
- SHA256 b6aead577d9fcec1e91f78fa65fe70f3d06a670c79e35cfc674c8505f834b93e
- MD5 f093a76f42f790a633e74db191b512be
- SHA1 30f61d36d754c6bb10c880845203cbdb68b49187
- SHA512 4672f7a3d5867a3b418042618b31294794e91595e02a6bdaea7ebb9751f17fbf6429c10db3671af95ee728cb9b23c95e5e96aa17ac842e6fd626319fea3d8572
- SSDEEP 192:WryI8d66rIx1YOH6j5TrgbnqPu68SdH8IQPs+Zofiy:WryIu660XvA5GqGNSdH8IQPs+Zofiy
- TLSH T136D1D00096EF5A76F807CBDEC2191D632BD7B67E625C2611FF4864D6A90A4073A3E831
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winhostsvc_errors.txt
- Size 6KB
- SHA256 284fb2362fdac4c6c490a1346ce2c1809ae9eb60e0071f892f345143b8eee71d
- MD5 9fe6fe052cc02030cb75b4fbc6ad8b38
- SHA1 c60f85fb043fdcc57130a3adbab83ab1b316ec17
- SHA512 189c77ead7268b560d728c59989a8d19f69c5613c0d186dc0d077c77159f500bc9861e0aac65dfc2633fc40ad626b1ad5ab3cc9bfeeee5497c760a84d256118b
- SSDEEP 192:WryI8d66rIx1YOH6j5TrgbnqPu68SdH8IQPs+ZofiLm:WryIu660XvA5GqGNSdH8IQPs+Zofii
- TLSH T127D1C10096EF5A76F807CBDEC2191D632BD7B67E625C2611FF4864D6A90A4073A3E831
- MD5 SHA1 SHA512 SSDEEP TLSH