xmrig | 0acde40816e0756db5bc5f3a7d06b497f2664041f89bf04195d3396c3e227343

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Size 18.1MB
Sample260930-tae1babh78
SHA256 0acde40816e0756db5bc5f3a7d06b497f2664041f89bf04195d3396c3e227343
MD5 e1cf636e43a2f22de4ff099063ab5316
SHA1 bcd396f59a608bd0dbde0c74ebfbcce8dd983f52
SHA512 39299ee88448f4c3b226aeea9cf7e0c6917b26fba42583446cf8dfd37ed540af7712c1fcbd760f28216d35233c214c6322cb39bc14dae0c6330ce0615aa42e22
SSDEEP 196608:JRC/NM0rDoxrix2PkZvdAv5n1gpgogUFrpu2G35EQKqwq1A02u8Ru:Jhex2PkZvdm51PogUF4ZyQKqQfu8k
TLSH
T16C176C57B27600DDC4BAC03886577233FAB17C58833467AB569097652F72BA86F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/files/0x000e00000001c5b1-0.dat	family_xmrig
behavioral2/files/0x000e00000001c5b1-0.dat	xmrig
behavioral2/memory/2832-2-0x00007FF692110000-0x00007FF693247000-memory.dmp	xmrig
behavioral2/memory/3324-3-0x00007FF639ED0000-0x00007FF63B007000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5b6-15.dat	family_xmrig
behavioral2/files/0x000c00000001c5b6-15.dat	xmrig
behavioral2/memory/5308-46-0x00007FF639ED0000-0x00007FF63B007000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4696	powershell.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe	2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe	taskhostw.exe

Executes dropped EXE 4 IoCs

pid	Process
5308	taskhostw.exe
3324	taskhostw.exe
2908	svchost32.exe
1744	sys_net.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host Process = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHost\\taskhostw.exe"	2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host Process = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHost\\taskhostw.exe"	taskhostw.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3640	cmd.exe
432	powercfg.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000e00000001c5b1-0.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5744	cmd.exe
4780	cmd.exe
1764	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	taskhostw.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1388	schtasks.exe
2800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2832	2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
2832	2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
2832	2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
2832	2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
2832	2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
2832	2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe
5308	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5308	taskhostw.exe
Token: SeShutdownPrivilege	432	powercfg.exe
Token: SeCreatePagefilePrivilege	432	powercfg.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeLockMemoryPrivilege	2908	svchost32.exe
Token: SeLockMemoryPrivilege	2908	svchost32.exe
Token: SeIncreaseQuotaPrivilege	4696	powershell.exe
Token: SeSecurityPrivilege	4696	powershell.exe
Token: SeTakeOwnershipPrivilege	4696	powershell.exe
Token: SeLoadDriverPrivilege	4696	powershell.exe
Token: SeSystemProfilePrivilege	4696	powershell.exe
Token: SeSystemtimePrivilege	4696	powershell.exe
Token: SeProfSingleProcessPrivilege	4696	powershell.exe
Token: SeIncBasePriorityPrivilege	4696	powershell.exe
Token: SeCreatePagefilePrivilege	4696	powershell.exe
Token: SeBackupPrivilege	4696	powershell.exe
Token: SeRestorePrivilege	4696	powershell.exe
Token: SeShutdownPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeSystemEnvironmentPrivilege	4696	powershell.exe
Token: SeRemoteShutdownPrivilege	4696	powershell.exe
Token: SeUndockPrivilege	4696	powershell.exe
Token: SeManageVolumePrivilege	4696	powershell.exe
Token: 33	4696	powershell.exe
Token: 34	4696	powershell.exe
Token: 35	4696	powershell.exe
Token: 36	4696	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	svchost32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1764	2832	2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe	89
PID 1764 wrote to memory of 1388	1764	cmd.exe	91
PID 5308 wrote to memory of 5744	5308	taskhostw.exe	94
PID 2832 wrote to memory of 3324	2832	2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe	96
PID 5308 wrote to memory of 4780	5308	taskhostw.exe	97
PID 5308 wrote to memory of 3640	5308	taskhostw.exe	98
PID 5744 wrote to memory of 2800	5744	cmd.exe	101
PID 5308 wrote to memory of 2908	5308	taskhostw.exe	102
PID 4780 wrote to memory of 4696	4780	cmd.exe	104
PID 3640 wrote to memory of 432	3640	cmd.exe	105
PID 5308 wrote to memory of 1744	5308	taskhostw.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe"
1⤵
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1388
- C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe
  "C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe"
  2⤵
  - Executes dropped EXE
  PID:3324

C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe
C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsHost'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsHost'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\system32\powercfg.exe
    powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe
  "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe" --config="C:\Users\Admin\AppData\Roaming\WindowsHost\config.json"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2908
- C:\Users\Admin\AppData\Roaming\WindowsHost\sys_net.exe
  "C:\Users\Admin\AppData\Roaming\WindowsHost\sys_net.exe" -f "C:\Users\Admin\AppData\Roaming\WindowsHost\net.cfg"
  2⤵
  - Executes dropped EXE
  PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path C:\Users\Admin\AppData\Roaming\WindowsHost\config.json
Size 3KB
SHA256 b5addf994a60eaeeff17afdf8d681438806b940833c123a462f321dae2b58341
MD5 c394324480f8d87725288148b3f73363
SHA1 6e7e33aafd31a86c432e6cc5e9f4905e0bf70b51
SHA512 b2fc215f214352babb9b538adb883fc5e37dd712df48d1acf52d8952c209dc74022a6b15ebc8da6d20ba61dc1fe98ed55cd398535b969455098abc2300a457e2
TLSH
T1D461D025C9640CFF09B8A19C9678A393DA18831B23440C3F71FC999C2F776367542FA5
MD5 SHA1 SHA512 TLSH

Submit Download

net.cfg

Path C:\Users\Admin\AppData\Roaming\WindowsHost\net.cfg
Size 368B
SHA256 fb32338b2f3ba5a49502f9dee558f1a9fcda4cc32d24a566880405486fcb9d51
MD5 b42d12cf3ca0740eeb645bf7dd2c2f93
SHA1 56642089571a53e6d5a3ffb3287bb8ad0f817889
SHA512 e94627b2ed2f36b300331dac8b12de463c4410eaee387f0c5b3a792aa1b7f945c40c6665d80cded82cc51411aad5e31d8174e7680cecac69c8a239e57014a4b0
TLSH
T11BE0D86922F8B157C4DB9306C5B5A1B486D293C1245E36275B21518C2E284936B64604
MD5 SHA1 SHA512 TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Roaming\WindowsHost\net_data\cached-microdesc-consensus
Size 3.2MB
SHA256 f7b84b51647a4159ec8d379bffde956047dc03750629083fa0ffa63a3ba2d19a
MD5 bf70fe0ff5c8d0ffc14eddfd359ec4db
SHA1 0ea12b9014027da9049274a874f2f24bf47e9da2
SHA512 6763a04afa7cca4768ba0e951c28ef1f938aa60cee50e08ba06017760c2a4b4dd7340d22b4e2aca4954f5a533e35cf438bfac82b0a2dcc2fda48c0751e03a348
SSDEEP 12288:jD54dgUBUay76GpePSn79QBzi9n7X4SdrZMnXW2hOfppoWMCv5NOhVXTq9DSyFVQ:Hud0aTGnn79Q27XTpZMn2fpyu6V29O5n
TLSH
T133F543EA97124DFAD32A09DBE510FB7BF33F5725C2486B94286F48FA7205091762093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\WindowsHost\net_data\cached-microdescs.new
Size 35.4MB
SHA256 4ac9d8fd10e0bfa51dcd124fdf17e18e8a77296f6106615931f4ed5784c61e33
MD5 849678e712b5d48e22e454e7b6b36324
SHA1 bee1d08db6e99788a8666ec1dced4a7361b49e41
SHA512 d428cc0286972715b51b5b33d1aaf12a7a87673961cb2c3da7a8970eba29e8ad0b3ee62148a5d6a73f9ea42ec7156d78fc9ef4bf12755fafd9e823281ff89c65
SSDEEP 24576:z4VH9PQ8z/+9W4mEB90trpM8aNV2tt/Ehgb0mmzdjpcHppC94u83t+nq6Wsqy4zK:a9+9aAgdXpPaZHFzYxCHjP+r0g8r
TLSH
T1DB87AEDA899B04C14E09E7CDEC2607C7DF144A3E0A6041A176AAF5677F3329FC15EA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state

Path C:\Users\Admin\AppData\Roaming\WindowsHost\net_data\state
Size 233B
SHA256 c6bb47c184f22486b0048a83797318fb00a9c5bdef081b37a8af720005850bf8
MD5 1f5a13773d0980a4e502ca8e5f279228
SHA1 047ff55caaa95f30675a2d58b5975874011e1ee2
SHA512 c84e0bd5d2a5e5a88d11079bba44649a151f941586c393166899f51f27833e415b4d4677dd77dd69acdb44070d21a5843eb4134625017b13b3906ca259d279b4
TLSH
T1CAD0A7A06AA692EB385D03E0CB05E5D9A751A52E510CAE26315E502B616052F05DD075
MD5 SHA1 SHA512 TLSH

Submit Download

svchost32.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe
Size 6.7MB
SHA256 ace346f051ffd5b05bee82944725d1e25520bc21982527115eea57efe938139a
MD5 248d2d229578caf79681bd03bc5b73c5
SHA1 5e823637a189a2506acfdb011e42ddc244d51c4f
SHA512 f0dd2f778a6480e448e746289019d007801c5b9fdbf7dbffbda5a47ac4dd397fbdd0e2da0618249878b983b698d844cb1aa328e424da03a507d07d68d7d6890a
SSDEEP 196608:lRC/NM0rDoxrix2PkZvdAv5n1gpgogUFx:lhex2PkZvdm51PogUFx
TLSH
T1CA66AE26B7A401E8C87AC53CC6469A13E7F2B81A5370A7DB17B0567A1F336D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_net.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHost\sys_net.exe
Size 9.7MB
SHA256 60c45b01938c799862e511a9a5bab12f959a819c6264a24502edc342165f570c
MD5 4edd2723154608d3d13f4c93a1c007ef
SHA1 f064ae020b89e4bf4f0a6e6289d0560f34050ccb
SHA512 babb21d145a6ffbaebcd18b6c839d684b9c165c00557cf0b397b4d3b0a8401a4171d2774d341eea41158f73e3ab4b99c026737e846b9d41ca6ccd5f1cd99db5b
SSDEEP 98304:XE7pu2Nw3522D4eSYizAmIJCQKeVuOwPS1A0mYwnQjGTuPjd+u:8pu2G35EQKqwq1A02u
TLSH
T114A62947F27710DDC5BAC07892177223F9A13C9C81346B6B599097A62B70B68AF3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskhostw.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe
Size 18.1MB
SHA256 0acde40816e0756db5bc5f3a7d06b497f2664041f89bf04195d3396c3e227343
MD5 e1cf636e43a2f22de4ff099063ab5316
SHA1 bcd396f59a608bd0dbde0c74ebfbcce8dd983f52
SHA512 39299ee88448f4c3b226aeea9cf7e0c6917b26fba42583446cf8dfd37ed540af7712c1fcbd760f28216d35233c214c6322cb39bc14dae0c6330ce0615aa42e22
SSDEEP 196608:JRC/NM0rDoxrix2PkZvdAv5n1gpgogUFrpu2G35EQKqwq1A02u8Ru:Jhex2PkZvdm51PogUF4ZyQKqQfu8k
TLSH
T16C176C57B27600DDC4BAC03886577233FAB17C58833467AB569097652F72BA86F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2832-2-0x00007FF692110000-0x00007FF693247000-memory.dmp

Download

memory/2908-17-0x00000242FE200000-0x00000242FE220000-memory.dmp

Download

memory/3324-3-0x00007FF639ED0000-0x00007FF63B007000-memory.dmp

Download

memory/4696-21-0x000002A1EF4A0000-0x000002A1EF4C2000-memory.dmp

Download

memory/4696-28-0x000002A1EF530000-0x000002A1EF54E000-memory.dmp

Download

memory/4696-29-0x000002A1EF550000-0x000002A1EF602000-memory.dmp

Download

memory/4696-30-0x000002A1EF820000-0x000002A1EF82A000-memory.dmp

Download

memory/5308-46-0x00007FF639ED0000-0x00007FF63B007000-memory.dmp

Download