sparkrat | 7453159bfac8edb8223b06ce4105b98a92878a261488efc0c84c9e8627fb5e67

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/08/2026, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client(4).exe
Size 21.4MB
Sample260817-k3t59sgp21
SHA256 7453159bfac8edb8223b06ce4105b98a92878a261488efc0c84c9e8627fb5e67
MD5 bd96b02ceabb2f205a9610141bc18fff
SHA1 a06b412cbd014b65a8ae96b98bffcc3e0cf92564
SHA512 a646e8664704aab8f06bc7cb9451621cd52bdda7f689493412fbbb293e967f4bb5abae151530504f82241594d1d88e530390dfabf02e2a73d383aa6cd465cc31
SSDEEP 98304:hxoy8d0Dw+Z9Ckkta4hHWI74zcsEbjbsBEle6otFkrAC4fMtEU3H:hqYwg9CkYth2KljbsBEl6FkcC4fM+U3H
TLSH
T161374A47E9A101E4C4ADD531C5729222BB727C485B3423D76F64FA292F73BC0ABBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion execution sparkrat persistence

Malware Config

Signatures

Family: Sparkrat
Sparkrat is a cross-platfrom backdoor written in Golang.
backdoor sparkrat

family_sparkrat 1 IoCs

Detects Sparkrat payload

resource	yara_rule
behavioral1/files/0x001b00000002b4b4-2.dat	family_sparkrat

Executes dropped EXE 2 IoCs

pid	Process
1776	UpdateService.exe
3852	UpdateService.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\logs\webrtc_signaling.log	UpdateService.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3864	sc.exe
5232	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1628	powershell.exe
4840	powershell.exe
1620	powershell.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5684	cmd.exe
2736	cmd.exe
492	cmd.exe
1632	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5740	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5756	taskkill.exe

Modifies data under HKEY_USERS 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	UpdateService.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5860	schtasks.exe
3404	schtasks.exe
5564	schtasks.exe
2300	schtasks.exe
5168	schtasks.exe
2292	schtasks.exe
5244	schtasks.exe
2460	schtasks.exe
4796	schtasks.exe
228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3456	client(4).exe
3456	client(4).exe
1776	UpdateService.exe
1776	UpdateService.exe
1776	UpdateService.exe
3852	UpdateService.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3456	client(4).exe
Token: SeDebugPrivilege	3456	client(4).exe
Token: SeDebugPrivilege	5756	taskkill.exe
Token: SeShutdownPrivilege	1776	UpdateService.exe
Token: SeDebugPrivilege	1776	UpdateService.exe
Token: SeShutdownPrivilege	3852	UpdateService.exe
Token: SeDebugPrivilege	3852	UpdateService.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2508	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1240	3456	client(4).exe	79
PID 3456 wrote to memory of 5756	3456	client(4).exe	82
PID 3456 wrote to memory of 2952	3456	client(4).exe	85
PID 3456 wrote to memory of 5244	3456	client(4).exe	87
PID 1776 wrote to memory of 5336	1776	UpdateService.exe	90
PID 3456 wrote to memory of 2736	3456	client(4).exe	94
PID 2736 wrote to memory of 492	2736	cmd.exe	96
PID 1776 wrote to memory of 5860	1776	UpdateService.exe	97
PID 1776 wrote to memory of 3852	1776	UpdateService.exe	99
PID 3852 wrote to memory of 2456	3852	UpdateService.exe	100
PID 492 wrote to memory of 5740	492	cmd.exe	102
PID 1776 wrote to memory of 3404	1776	UpdateService.exe	103
PID 1632 wrote to memory of 3864	1632	cmd.exe	107
PID 1776 wrote to memory of 5564	1776	UpdateService.exe	108
PID 1776 wrote to memory of 2460	1776	UpdateService.exe	111
PID 1776 wrote to memory of 5572	1776	UpdateService.exe	113
PID 1776 wrote to memory of 1620	1776	UpdateService.exe	114
PID 1776 wrote to memory of 4488	1776	UpdateService.exe	115
PID 1776 wrote to memory of 1628	1776	UpdateService.exe	116
PID 1776 wrote to memory of 4796	1776	UpdateService.exe	117
PID 1776 wrote to memory of 4136	1776	UpdateService.exe	119
PID 1776 wrote to memory of 4840	1776	UpdateService.exe	120
PID 1776 wrote to memory of 2300	1776	UpdateService.exe	121
PID 5684 wrote to memory of 5232	5684	cmd.exe	125
PID 1776 wrote to memory of 228	1776	UpdateService.exe	126
PID 1776 wrote to memory of 5168	1776	UpdateService.exe	128
PID 1776 wrote to memory of 2292	1776	UpdateService.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\client(4).exe
"C:\Users\Admin\AppData\Local\Temp\client(4).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:1240
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM UpdateService.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5756
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /TN WinUpdateSvcWatchdog
  2⤵
  PID:2952
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5244
- C:\Windows\system32\cmd.exe
  cmd.exe /C start /b "" C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1786957715394634900.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1786957715394634900.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:492
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5740

C:\ProgramData\Microsoft\Update\UpdateService.exe
C:\ProgramData\Microsoft\Update\UpdateService.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:5336
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5860
- C:\ProgramData\Microsoft\Update\UpdateService.exe
  "C:\ProgramData\Microsoft\Update\UpdateService.exe" --ui-only
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\system32\cmd.exe
    cmd ver
    3⤵
    PID:2456
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3404
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5564
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2460
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --width 120 --height 30 --signal 0x650 --server 0x60c
  2⤵
  PID:5572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1620
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --width 120 --height 30 --signal 0x5e4 --server 0x608
  2⤵
  PID:4488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1628
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4796
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --width 120 --height 30 --signal 0x69c --server 0x630
  2⤵
  PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4840
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2300
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:228
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5168
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2292

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5948

C:\Windows\system32\cmd.exe
cmd.exe /C "C:\ProgramData\Microsoft\Update\start_service.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\sc.exe
  sc start WinUpdateSvc
  2⤵
  - Launches sc.exe
  PID:3864

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2508

C:\Windows\system32\cmd.exe
cmd.exe /C "C:\ProgramData\Microsoft\Update\start_service.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\system32\sc.exe
  sc start WinUpdateSvc
  2⤵
  - Launches sc.exe
  PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UpdateService.exe

Path C:\ProgramData\Microsoft\Update\UpdateService.exe
Size 21.4MB
SHA256 7453159bfac8edb8223b06ce4105b98a92878a261488efc0c84c9e8627fb5e67
MD5 bd96b02ceabb2f205a9610141bc18fff
SHA1 a06b412cbd014b65a8ae96b98bffcc3e0cf92564
SHA512 a646e8664704aab8f06bc7cb9451621cd52bdda7f689493412fbbb293e967f4bb5abae151530504f82241594d1d88e530390dfabf02e2a73d383aa6cd465cc31
SSDEEP 98304:hxoy8d0Dw+Z9Ckkta4hHWI74zcsEbjbsBEle6otFkrAC4fMtEU3H:hqYwg9CkYth2KljbsBEl6FkcC4fM+U3H
TLSH
T161374A47E9A101E4C4ADD531C5729222BB727C485B3423D76F64FA292F73BC0ABBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 6KB
SHA256 b63b7b6690303b537662302d67173b6b31c6192843e645c586cadcf30d65f230
MD5 703d2011144f3057003844034149643c
SHA1 7df1cfeb8106b88d0eb8a37c637e775706bbff3c
SHA512 ab9cff8c24e95f1c25332e8fa7fa22474963131d1b999c8b9c81269ed1cbe74c4e78c9df7942c5fecb34950ef791114a74e0864b4ca7458a584c0a649013cbbd
SSDEEP 96:/yqNeY189Aq4yf4dj2OBvsTt/sQ6hCanpnuREdzO9u13oKrcKr:KoSATyf4daysTt/7aoncb
TLSH
T10FE1700572D93CB1BD868BCFCD16415A1B5CA2FDB208BA60B3ED1B844D4B819AB3F1D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 4KB
SHA256 94135b7fc6b1a1e63ee8ab109a4e0deedd2b8b4ba8be2f21374d1fce537a24dc
MD5 29fdbd1499131d47b5526e9c549e6c1d
SHA1 d0c1673540f2e6aa4a37eb6b9f24a961a199a680
SHA512 99017eca1550cc7ada9730eec9919fabef32ad4603070c66c3459743c933a3fdb69a5b80bc64dd22d9b22bf880f0796432ebed255c76e312c263fae11d08424c
SSDEEP 48:FtbpyvBv7GKO2xjFQTFUKgSViGXaihkjviptmioADids0NRRs4ixxf4J99yCaJwG:/yqNeY189Aq4yf4dj2OBvsTt/sQ6hp
TLSH
T183914C0573D53CB1BE858B9FCD53411A1A0CA2FDA20C7A2073DE1B885C47818AB3F1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start_service.cmd

Path C:\ProgramData\Microsoft\Update\start_service.cmd
Size 44B
SHA256 288893fb4b5598c4904c5af6fe12662560e574e5cbd0734ac42d94268d2710e9
MD5 256fecaa188c1065ad336c6b1017404e
SHA1 3d89461b3229f57cc77c3d52a4937deb4ffadd3b
SHA512 e5fa37ed5d0e6dc671732ad71f04c4c680aba71d8fd6e043396e1ebe214417abb9d0037e51b870a8a43879370c3784f983031efb0a13f8aa2a3ef5d6838b3507
MD5 SHA1 SHA512

Submit Download

svc_cleanup_1786957715394634900.bat

Path C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1786957715394634900.bat
Size 143B
SHA256 5c4e0d74e098d0baacbb15a01fa9725d88f5af1432975ba4b5539b5def0cf896
MD5 90b03896aee9b19f2fae0ed25d3ac8ee
SHA1 01349de086420f44ba7d45b1ff7002842fb4ac6a
SHA512 2fff6058d230ff89d629d344f7b89dc08d6aa9ec799765e7a5829a0a37df146abf7b3dbf632b49e29b2b955b8e6107fd29ca1b48f19088497c73b189ff08b977
TLSH
T1F5C08C0B344A8E88000030E144FF204402BE02865D41BBC085C28068680632A8346EC8
MD5 SHA1 SHA512 TLSH

Submit Download