sparkrat | edaff13bad2401227db98e70ecef36c910a4ad7079796b03da6a7977e3b7713c

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 21.4MB
Sample260816-fpca3sbd33
SHA256 edaff13bad2401227db98e70ecef36c910a4ad7079796b03da6a7977e3b7713c
MD5 1b2a175200122f454727a714983ff031
SHA1 be5efc57105950733b8cf6295a6e4e3913b0076b
SHA512 621cfc2dcc7953770092f51180f8a4eafd6b04d802c5f2b0d3a1c52809b38a07032041dd0dd2109b9594e69b486ce6b80d17edde637a1449c10cc7b92f60bcba
SSDEEP 98304:WUsWPAE4wyXb42e/pLrJhFm6NnpeKvlp5QVk2sV6TOgn/G03CcfMtEyzoN:WU5DyL42eJ9hUoQVk2sCL/X3CcfM+yzQ
TLSH
T16C374A43E9A505E8C4ADD534C6669223BB717C484B3427D72F64F6293FB7BC06ABA700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion execution sparkrat persistence

Malware Config

Signatures

Family: Sparkrat
Sparkrat is a cross-platfrom backdoor written in Golang.
backdoor sparkrat

family_sparkrat 1 IoCs

Detects Sparkrat payload

resource	yara_rule
behavioral2/files/0x000e00000001c45b-2.dat	family_sparkrat

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c45b-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 5 IoCs

pid	Process
3020	UpdateService.exe
4592	UpdateService.exe
3528	UpdateService.exe
1332	UpdateService.exe
5508	UpdateService.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4636	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
236	cmd.exe
4160	cmd.exe
3392	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2260	timeout.exe

GoLang User-Agent 6 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	22	Go-http-client/1.1
HTTP User-Agent header	25	Go-http-client/1.1
HTTP User-Agent header	29	Go-http-client/1.1
HTTP User-Agent header	13	Go-http-client/1.1
HTTP User-Agent header	16	Go-http-client/1.1
HTTP User-Agent header	19	Go-http-client/1.1

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
5744	taskkill.exe
5220	taskkill.exe

Modifies data under HKEY_USERS 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	UpdateService.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1732	schtasks.exe
2872	schtasks.exe
6080	schtasks.exe
912	schtasks.exe
4616	schtasks.exe
4668	schtasks.exe
4292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1364	2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1364	2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
4592	UpdateService.exe
3020	UpdateService.exe
4592	UpdateService.exe
4592	UpdateService.exe
3020	UpdateService.exe
1332	UpdateService.exe
1332	UpdateService.exe
1332	UpdateService.exe
5508	UpdateService.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1364	2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeDebugPrivilege	1364	2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeDebugPrivilege	5744	taskkill.exe
Token: SeShutdownPrivilege	3020	UpdateService.exe
Token: SeShutdownPrivilege	4592	UpdateService.exe
Token: SeDebugPrivilege	4592	UpdateService.exe
Token: SeDebugPrivilege	3020	UpdateService.exe
Token: SeShutdownPrivilege	3528	UpdateService.exe
Token: SeDebugPrivilege	5220	taskkill.exe
Token: SeShutdownPrivilege	1332	UpdateService.exe
Token: SeDebugPrivilege	1332	UpdateService.exe
Token: SeShutdownPrivilege	5508	UpdateService.exe
Token: SeDebugPrivilege	5508	UpdateService.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 4880	1364	2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 1364 wrote to memory of 5744	1364	2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91
PID 1364 wrote to memory of 4832	1364	2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	94
PID 1364 wrote to memory of 1732	1364	2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	96
PID 3020 wrote to memory of 5048	3020	UpdateService.exe	103
PID 4592 wrote to memory of 6120	4592	UpdateService.exe	105
PID 1364 wrote to memory of 236	1364	2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	107
PID 4592 wrote to memory of 2872	4592	UpdateService.exe	109
PID 4592 wrote to memory of 3528	4592	UpdateService.exe	111
PID 3528 wrote to memory of 5604	3528	UpdateService.exe	112
PID 236 wrote to memory of 4160	236	cmd.exe	114
PID 4160 wrote to memory of 2260	4160	cmd.exe	116
PID 3020 wrote to memory of 5220	3020	UpdateService.exe	115
PID 3392 wrote to memory of 4636	3392	cmd.exe	121
PID 1332 wrote to memory of 4252	1332	UpdateService.exe	123
PID 1332 wrote to memory of 6080	1332	UpdateService.exe	125
PID 1332 wrote to memory of 5508	1332	UpdateService.exe	127
PID 5508 wrote to memory of 5948	5508	UpdateService.exe	128
PID 1332 wrote to memory of 912	1332	UpdateService.exe	130
PID 1332 wrote to memory of 4616	1332	UpdateService.exe	132
PID 1332 wrote to memory of 4668	1332	UpdateService.exe	134
PID 1332 wrote to memory of 4292	1332	UpdateService.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_1b2a175200122f454727a714983ff031_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:4880
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM UpdateService.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5744
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /TN WinUpdateSvcWatchdog
  2⤵
  PID:4832
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1732
- C:\Windows\system32\cmd.exe
  cmd.exe /C start /b "" C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1786856580012993300.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1786856580012993300.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2260

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3720

C:\ProgramData\Microsoft\Update\UpdateService.exe
C:\ProgramData\Microsoft\Update\UpdateService.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:6120
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2872
- C:\ProgramData\Microsoft\Update\UpdateService.exe
  "C:\ProgramData\Microsoft\Update\UpdateService.exe" --ui-only
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\system32\cmd.exe
    cmd ver
    3⤵
    PID:5604

C:\ProgramData\Microsoft\Update\UpdateService.exe
C:\ProgramData\Microsoft\Update\UpdateService.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:5048
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM UpdateService.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5220

C:\Windows\system32\cmd.exe
"cmd.exe" /C "C:\ProgramData\Microsoft\Update\start_service.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\System32\sc.exe
  sc start WinUpdateSvc
  2⤵
  - Launches sc.exe
  PID:4636

C:\ProgramData\Microsoft\Update\UpdateService.exe
C:\ProgramData\Microsoft\Update\UpdateService.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:4252
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6080
- C:\ProgramData\Microsoft\Update\UpdateService.exe
  "C:\ProgramData\Microsoft\Update\UpdateService.exe" --ui-only
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\system32\cmd.exe
    cmd ver
    3⤵
    PID:5948
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:912
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4616
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4668
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UpdateService.exe

Path C:\ProgramData\Microsoft\Update\UpdateService.exe
Size 21.4MB
SHA256 edaff13bad2401227db98e70ecef36c910a4ad7079796b03da6a7977e3b7713c
MD5 1b2a175200122f454727a714983ff031
SHA1 be5efc57105950733b8cf6295a6e4e3913b0076b
SHA512 621cfc2dcc7953770092f51180f8a4eafd6b04d802c5f2b0d3a1c52809b38a07032041dd0dd2109b9594e69b486ce6b80d17edde637a1449c10cc7b92f60bcba
SSDEEP 98304:WUsWPAE4wyXb42e/pLrJhFm6NnpeKvlp5QVk2sV6TOgn/G03CcfMtEyzoN:WU5DyL42eJ9hUoQVk2sCL/X3CcfM+yzQ
TLSH
T16C374A43E9A505E8C4ADD534C6669223BB717C484B3427D72F64F6293FB7BC06ABA700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 10KB
SHA256 1ada94bf861b8447e63dddbaad2740ffd927d1cdd1b3f575922f08a5c2829dad
MD5 f453b4db3b3f37941071870a371af0a9
SHA1 7ce0084912bb0163b097f3bbbb4613e908248993
SHA512 1a018d2efc1f0b09d2e0c672cdc6caa65c439324c4b9144dff6816ed64ee022ed54d266ed275912ed9e4ca658c9c078014c8b9d914d9f41fd41cb5971535dc34
SSDEEP 96:clcer6+NtYpft+4MfVR2LejVEq9Aei/KMmCPorW/bLVsqtDNce3aKHp7ZdzBFXse:ALr6nFtvMfVQLm8zSaHZ7XXwQv5K27SE
TLSH
T15D328D1572DA39F1EDC59DCECD0F23DA1284F275B20EB86463E90A89D44D8192B3F1E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 13KB
SHA256 b8278222038e1d70b8d02620e3d44498f7a1d298b9c804c67d9f751b80a11238
MD5 4de40d1d66c5120fad54638e2e6212c8
SHA1 78a61a291ce04b2f8fefba5a7786a2cf6c6771af
SHA512 1bc1e368592e66d37cb53edb677149ba63b9b2c1ae5eddbe4ac358b6086b23ce780fd587d58d5d44fed2c6693209bee877a5067256c9fc40a927ad0528d0f160
SSDEEP 192:ALr6nFtvMfVQLm8zSaHZ7XXwQv5K27SCTD53:AfmFtvmVQLm8zSWXwi5K22m53
TLSH
T105529B0572DA79F1ADC598CFCD1E13DA1294F375B20EB864A3F50A85C44E8292B3F1E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 6KB
SHA256 3fbd554f29c11b8950810d8e1a06f3fefbf4d656347a589abad22cd3b6ded8f4
MD5 5484e34380e20eb0caa2f128f2308593
SHA1 31454975bbd054ed72494027a127fe8f6b7cb252
SHA512 b2942915521209cd645eba6aa94aca55721b9cfc0390948700f29f0285c0b58ef1ffdbbf35074866b0da89ca5ac24a1f592594643941b368c5cf15e1aeff0689
SSDEEP 96:clcer6+NtYpft+4MfVR2LejVEq9Aei/KMmCPorW/bLVsqtDNceJ:ALr6nFtvMfVQLm8zSaHJ
TLSH
T106D16B2572D63DB2BDC55DCECD0F53DA1284E276A20EB86463D90988D44D8193E3F2E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 6KB
SHA256 fad5204b84b0410f489f66550863cfdb07ef90de5a34c712f6ef774104c45c4e
MD5 16b7114982ef35725b07cb05ce2becad
SHA1 16bd5ba6068a4bdcd82c1fe821ece0823cf09563
SHA512 4396e8db3c08e9bb7c557fc46d46eb00b1b7c5bf869f3a5108f7db1577fdfa2c09c5ddafd04a3331d62d5820be6efcfaa8154de2c7d819f0a628cb530083d704
SSDEEP 96:clcer6+NtYpft+4MfVR2LejVEq9Aei/KMmCPorW/bLVsqtDNce3ah:ALr6nFtvMfVQLm8zSaHo
TLSH
T179D16B1572D63DF2BDC95DCECD0F53DA1284E276A20EB86463D90988D44E8197E3F2E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start_service.cmd

Path C:\ProgramData\Microsoft\Update\start_service.cmd
Size 44B
SHA256 288893fb4b5598c4904c5af6fe12662560e574e5cbd0734ac42d94268d2710e9
MD5 256fecaa188c1065ad336c6b1017404e
SHA1 3d89461b3229f57cc77c3d52a4937deb4ffadd3b
SHA512 e5fa37ed5d0e6dc671732ad71f04c4c680aba71d8fd6e043396e1ebe214417abb9d0037e51b870a8a43879370c3784f983031efb0a13f8aa2a3ef5d6838b3507
MD5 SHA1 SHA512

Submit Download

svc_cleanup_1786856580012993300.bat

Path C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1786856580012993300.bat
Size 234B
SHA256 3523cb00c719fbb583e083e8bc068583f52cf4d2836ee080b24ad47312d74d93
MD5 e646678bb4651dbe261983942a9d95f6
SHA1 326e5ae7dfcd88297fd6ec4add7354a86291b8bf
SHA512 56f016313b93e5c953ad391cf506490b8594bca07a939adf3b58f369845b3eae8e28cd1479a9f95782a9512ecd487721c6f9afc5f9eef8ebfa4f0862e11b9dfc
TLSH
T1F6D0A70B68AD8F98444231E685FF109546DF27C79D0837C1C2C1C5EC640B36B158AEC8
MD5 SHA1 SHA512 TLSH

Submit Download