salatstealer | ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338

Analysis

max time kernel
14s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe
Size 43.9MB
Sample261030-afpbdsvs2l
SHA256 ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338
MD5 c35654598bdde344f7e7f469568ab3e1
SHA1 3f25a9e96f627c0757eb243453510f86414e0c61
SHA512 0db8dd05b0bae9034709241516a99527a7ed1ef4fed6f93cc8a19a797f235886cb5080a12e535e787739c2a89fb03166039c19ec4d598ec020e98339d73f10bb
SSDEEP 786432:zgHEsg/Y2enhCVf0ah0KTUku84Oqqn34f1ABapHHqdWdjRvGCx+cmgE0T:FAgVcah06UfN+349A8HH7rGk+c2S
TLSH
T189A733C5B4BF84ADEA24B1366443B851B2AFCF056F962F974882307437A229451CFE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution salatstealer xmrig miner persistence stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detect SalatStealer payload 13 IoCs

resource	yara_rule
behavioral2/memory/6028-92-0x0000000000BE0000-0x0000000001835000-memory.dmp	family_salatstealer
behavioral2/memory/6028-141-0x0000000000BE0000-0x0000000001835000-memory.dmp	family_salatstealer
behavioral2/memory/6028-201-0x0000000000BE0000-0x0000000001835000-memory.dmp	family_salatstealer
behavioral2/memory/6028-207-0x0000000000BE0000-0x0000000001835000-memory.dmp	family_salatstealer
behavioral2/memory/6028-233-0x0000000000BE0000-0x0000000001835000-memory.dmp	family_salatstealer
behavioral2/memory/6028-239-0x0000000000BE0000-0x0000000001835000-memory.dmp	family_salatstealer
behavioral2/memory/6028-240-0x0000000000BE0000-0x0000000001835000-memory.dmp	family_salatstealer
behavioral2/memory/6028-247-0x0000000000BE0000-0x0000000001835000-memory.dmp	family_salatstealer
behavioral2/memory/2660-254-0x0000000000AF0000-0x0000000001745000-memory.dmp	family_salatstealer
behavioral2/memory/2660-263-0x0000000000AF0000-0x0000000001745000-memory.dmp	family_salatstealer
behavioral2/memory/2660-306-0x0000000000AF0000-0x0000000001745000-memory.dmp	family_salatstealer
behavioral2/memory/2660-309-0x0000000000AF0000-0x0000000001745000-memory.dmp	family_salatstealer
behavioral2/memory/2660-331-0x0000000000AF0000-0x0000000001745000-memory.dmp	family_salatstealer

Windows security bypass 2 TTPs 64 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\rt\MicrosoftUpdateWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftCacheHealth.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftCacheAssistant.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftCacheAssistant.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SettingsSync.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SRBMiner-MULTI.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\SRBMiner-MULTI.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\SettingsSync.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SRBMiner-MULTI.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\xmrig.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\checker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\miner.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\watchdog.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftCacheHealth.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\MicrosoftUpdateWorker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\miner.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftCacheAssistant.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftCacheWorker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\checker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftCacheHealth.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\MicrosoftCacheWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\miner.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftCacheHealth.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\checker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\watchdog.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\SRBMiner-MULTI.exe = "0"	SearchProtocolHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftCacheHealth.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\watchdog.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\rt\MicrosoftCacheAssistant.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\xmrig.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateHealth.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\xmrig.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\watchdog.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\checker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe = "0"	SearchFilterHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\rt\miner.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\checker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\MicrosoftUpdateHealth.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\checker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftUpdateHealth.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\rt\MicrosoftUpdateHealth.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\rt\xmrig.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\MicrosoftUpdateWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\xmrig.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0"	SearchProtocolHost.exe

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c482-168.dat	family_xmrig
behavioral2/files/0x000d00000001c482-168.dat	xmrig

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2148	netsh.exe
4340	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
5692	ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe
3248	SearchFilterHost.exe
3860	SearchProtocolHost.exe
6028	g3.exe

Windows security modification 2 TTPs 64 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\SettingsSync.exe = "0"	SearchFilterHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\MicrosoftCacheWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\MicrosoftUpdateWorker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\MicrosoftCacheWorker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\xmrig.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\checker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\miner.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\miner.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\MicrosoftCacheHealth.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692 = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\checker.exe = "0"	SearchProtocolHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\watchdog.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftCacheWorker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftCacheWorker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\xmrig.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\checker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\watchdog.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\miner.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\miner.exe = "0"	SearchProtocolHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\xmrig.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\rt\MicrosoftCacheAssistant.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\rt\checker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\MicrosoftCacheWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\SRBMiner-MULTI.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\MicrosoftCacheAssistant.exe = "0"	SearchFilterHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\miner.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\watchdog.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SRBMiner-MULTI.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SRBMiner-MULTI.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\watchdog.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\checker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\SearchProtocolHost.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftCacheAssistant.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SRBMiner-MULTI.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\SRBMiner-MULTI.exe = "0"	SearchFilterHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftCacheWorker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\SettingsSync.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\miner.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\checker.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\miner.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftCacheHealth.exe = "0"	SearchFilterHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe = "0"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftCacheWorker.exe = "0"	SearchProtocolHost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Update\\MicrosoftUpdateAssistant.exe\" --mnr-task"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsCache = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\MicrosoftCacheAssistant.exe\" --mnr-task"	SearchFilterHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
10	pastebin.com
11	pastebin.com

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c473-36.dat	upx
behavioral2/memory/6028-37-0x0000000000BE0000-0x0000000001835000-memory.dmp	upx
behavioral2/memory/6028-92-0x0000000000BE0000-0x0000000001835000-memory.dmp	upx
behavioral2/memory/6028-141-0x0000000000BE0000-0x0000000001835000-memory.dmp	upx
behavioral2/memory/6028-201-0x0000000000BE0000-0x0000000001835000-memory.dmp	upx
behavioral2/memory/6028-207-0x0000000000BE0000-0x0000000001835000-memory.dmp	upx
behavioral2/memory/6028-233-0x0000000000BE0000-0x0000000001835000-memory.dmp	upx
behavioral2/memory/6028-239-0x0000000000BE0000-0x0000000001835000-memory.dmp	upx
behavioral2/memory/6028-240-0x0000000000BE0000-0x0000000001835000-memory.dmp	upx
behavioral2/memory/2660-248-0x0000000000AF0000-0x0000000001745000-memory.dmp	upx
behavioral2/memory/6028-247-0x0000000000BE0000-0x0000000001835000-memory.dmp	upx
behavioral2/memory/2660-254-0x0000000000AF0000-0x0000000001745000-memory.dmp	upx
behavioral2/memory/2660-263-0x0000000000AF0000-0x0000000001745000-memory.dmp	upx
behavioral2/memory/2660-306-0x0000000000AF0000-0x0000000001745000-memory.dmp	upx
behavioral2/memory/2660-309-0x0000000000AF0000-0x0000000001745000-memory.dmp	upx
behavioral2/memory/2660-331-0x0000000000AF0000-0x0000000001745000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
856	cmd.exe
960	cmd.exe
3968	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SearchFilterHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SearchFilterHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SearchProtocolHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SearchProtocolHost.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g3.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5860	schtasks.exe
5736	schtasks.exe
5444	schtasks.exe
476	schtasks.exe
6076	schtasks.exe
2140	schtasks.exe
2212	schtasks.exe
5664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3860	SearchProtocolHost.exe
3860	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 5692	2952	ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe	89
PID 5692 wrote to memory of 3248	5692	ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe	90
PID 5692 wrote to memory of 3860	5692	ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe	91
PID 3860 wrote to memory of 6028	3860	SearchProtocolHost.exe	93
PID 3860 wrote to memory of 2212	3860	SearchProtocolHost.exe	94
PID 3248 wrote to memory of 2140	3248	SearchFilterHost.exe	95
PID 3860 wrote to memory of 5664	3860	SearchProtocolHost.exe	99
PID 3248 wrote to memory of 5860	3248	SearchFilterHost.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe
"C:\Users\Admin\AppData\Local\Temp\ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\SearchFilterHost.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\SearchFilterHost.exe"
    3⤵
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCache /XML "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\mnr_WindowsCache.xml"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2140
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCacheBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe\" --mnr-excl"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5860
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall delete rule program="C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe"
      4⤵
      Modifies Windows Firewall
      PID:2148
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe"
      4⤵
      PID:3124
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCache /XML "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\mnr_WindowsCache.xml"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:476
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCacheBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe\" --mnr-excl"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6076
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\SearchProtocolHost.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\SearchProtocolHost.exe"
    3⤵
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\g3.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\g3.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6028
    - - C:\Users\Admin\AppData\Local\Mozilla\WmiPrvSE.exe
        
        C:\Users\Admin\AppData\Local\Mozilla\WmiPrvSE.exe
        5⤵
        
        PID:2660
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        6⤵
        
        PID:4300
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdate /XML "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\mnr_WindowsUpdate.xml"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2212
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5664
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall delete rule program="C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
      4⤵
      Modifies Windows Firewall
      PID:4340
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"
      4⤵
      PID:4588
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdate /XML "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\mnr_WindowsUpdate.xml"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5736
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5444
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe" --config="C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\config.json"
      4⤵
      PID:4544

C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe
1⤵
PID:2416

C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe" --mnr-task
1⤵
PID:5428

C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
1⤵
PID:4512

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe" --mnr-task
1⤵
PID:3804

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe"
1⤵
PID:4576

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
1⤵
PID:4752

C:\Windows\System32\RuntimeBroker.exe
"C:\Windows\System32\RuntimeBroker.exe" --x 632757353b32011f1a3200000000001d251d192a20100c35222e070c05320c0d0e1b01320b0b1d32160d030d013617313c1e2505190c320c0d0e1b01320b0b1d3b31000c1d0b160b1f020b334a08110b634440440d2e0a0b00097c462e53321417081b1d1d250904072f382c191e05051908320d0b0e08021d29040a1c2e17020f1a1d3304070a2e131e353b31000c1d0b1d07020708280343031d2e0a4f
1⤵
PID:3156

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --disable-worker-watchdog --disable-gpu-intel --gpu-disable-oc --log-file gpu_srb.log --log-file-mode 0 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pcvxa54ardgnvv74z9tvraewszv4447pm2jpuj5sr774vx8m858cq6rc7j8 --worker WORKEREU2 --password x --tls false --api-enable --api-port 41981 --api-rig-name WORKEREU2
1⤵
PID:1652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:856

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --disable-worker-watchdog --disable-gpu-intel --gpu-disable-oc --log-file gpu_srb.log --log-file-mode 0 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pcvxa54ardgnvv74z9tvraewszv4447pm2jpuj5sr774vx8m858cq6rc7j8 --worker WORKEREU2 --password x --tls false --api-enable --api-port 41981 --api-rig-name WORKEREU2
1⤵
PID:5348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:960

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --disable-worker-watchdog --disable-gpu-intel --gpu-disable-oc --log-file gpu_srb.log --log-file-mode 0 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pcvxa54ardgnvv74z9tvraewszv4447pm2jpuj5sr774vx8m858cq6rc7j8 --worker WORKEREU2 --password x --tls false --api-enable --api-port 41981 --api-rig-name WORKEREU2
1⤵
PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftCacheHealth.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe
Size 469KB
SHA256 35ccf785771128430a697211d1192b1ea31e51b51d3f5f0ac2df0fd9e70b6ee0
MD5 159b94514366442e6502065be7de7a5e
SHA1 3b746385dd3e167bad03a25fb2e25a13ddd6565c
SHA512 bf4dd42c5b7a4548764252a6de9ed6aee951d56193e2ec2165d617db81a8d7219b49cca72deea69c749d9a89782b07bcbcabb9f5024158119717acb08e32da39
SSDEEP 6144:kT2ZU2ybG43kC8U34+q0SYxHueaXOUqRmOoh8EnDWrgKimdYDPJHT04nnBwtTTfU:kTPy43k0346faXBDhPnDWsK0
TLSH
T152A42A0777E89DE6DC626138969B670D9736FCB007A696CB43101222AE07BDC9D2FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftCacheWorker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
Size 36.5MB
SHA256 d58ec118de0db7c28382f3d7c290aa49fc786dfd4af572d1a59e5421015489c4
MD5 b2cdc273ca925f11a0e142d698282ef1
SHA1 79785cfe08e6d204df93f76e805f41fc99c305c5
SHA512 7cf97b8d87b1563461dff66c33c843bd2d4457e445798894573bf40e6f0fa9cf1421e8e8eb3df911853111820562f59074e37226ec03a06a209a2be7ea96ba16
SSDEEP 786432:VDNXaWWczq/zsW/8NnZLrEe3ONwPyELYzi5wWzGjrgWOhlFQpyH:VDJaJoq0bh3CKKz6UKh
TLSH
T1648733048B7C0F2BE4E37733072541BA9999DF568D1DE69A8DB825F1C77BA238C4A170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\build.json
Size 2KB
SHA256 39e9f28e535d31061679c16ae71a62d93f6e1eb090f2649f395a36bba5b7cce8
MD5 28887e67a1069cbee0a37ead9b98418d
SHA1 2a9fbae217caa36f224201187d6f6324cf65a8f9
SHA512 cd4627334961cb78d6a597675dc38edcf8f20be5b4eb37742fdb66fba68d4fb391e8e9b03649fbda099744c485c3efd9f417d2870adfd34a20d1cc65ae961b61
TLSH
T1DD41DD3AC9180A721AD1A5496CBA9F5346534D33390ABCA877C7920C5F4D73F21BCABD
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_route.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_route.json
Size 77B
SHA256 762f5d35568e0884f9019fdb748d88b9816324c6dd23373297a9dfcf32f757da
MD5 5ed42a206de2a727056ab3477631d421
SHA1 0cc0b3414c78088e82a38cd6e837a471d55d2d85
SHA512 1481d40b791d35dfa0afb3948abe1c981f4e4bc2fff059875e67763a0a4fd658c78721b31d53796d488903d4926e127fee2b2823648997d299acd63f8f0e6541
TLSH
T15FA02405704D00F300F111533150473D730CCD5700CC304040D7300C050F51471F4031
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_srb.log

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_srb.log
Size 274B
SHA256 b999e4f14e0f7f5888f2a42b6c8637374c8ca3d9b9da26298f4f6053a4d2e9ca
MD5 7bc676601b2a81002670af9990720186
SHA1 f524ca3af795ce34dec68a661a418975b30b2854
SHA512 d1882ccaf51ec380b7e70761ac799de1bdba89e8c8170e50e8a318994fb54c1cf8b97254697ae0c231dd43ce93257e29a9985f9c36bd11c051da8ebb10ad7d75
TLSH
T143D0170608A9C5BE0004131112BE1DEABF7EB13730F51B9C238183C4A49AD1ECF170C0
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_stage.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_stage.json
Size 61B
SHA256 1442846d9cbde4612d2b6c6afbf43183e087d3c5fa43b9513f91ef63718d0fc7
MD5 e0785451c0c2877b4984a1b48fbe4f9e
SHA1 b415720f71512b5d5a6d50b15911b9a378c0f8f5
SHA512 d20a6810eaec8a1db57ce44da23ec518379cf0fa63158e258fe88da2732aad9dc7b0c8e14ad77a8708a5a6c5c79b11293322313303cc27667c074fe8ec9c6371
TLSH
T1BBA0028055458CAD07718DB1185805440712B7C385A61A19E66E9E26358251EA018044
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_status.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_status.json
Size 139B
SHA256 4123655785c497aafdb19f35e32d7a644312af0b3bedf2062b08fd7ec1f86919
MD5 2f03deba06722f957487f956b3588650
SHA1 a941bb799c620eaa5bc41bf15a933973757cf70a
SHA512 d6c7e019f6566569d7857e30d579389d7b7adbf213e531df3f194a6a98fe9ea1fb0044c5828814fdf6c2ebe1299d9c31d7eaef7092bb58751a7747cee3523903
TLSH
T17BC02B36F03112715F687301014799B24B28386108C43034F34A9BCC900C43D1D24001
MD5 SHA1 SHA512 TLSH

Submit Download

last_donate.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\last_donate.json
Size 268B
SHA256 a1ddfe7150fd128c20fe37dbecf76079b24eb64cee69e248bb63ac2a6e0cc008
MD5 b103bb32cf39f3195b061397b39552de
SHA1 17022e9552779ed269f37a8d07c5bd042bee541b
SHA512 bcaa69ba6f65f5736b0d64d7e6af584840afbcbf2fd972842b34e11a769ec3793f4d82cef47eec0400404c18394158bffa2cfeef30bdc47b41db1fa984386af8
TLSH
T154D097A98289807307D333970D92C2FEB2EE4C363249B0F052C34290308DF3CA2B4179
MD5 SHA1 SHA512 TLSH

Submit Download

last_user.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\last_user.json
Size 335B
SHA256 adfeebd9590d8a47ce5af990d802e01fb85aac7efaec449022db53eec267f645
MD5 8a78ee60da20e9a24974fb7dc3780841
SHA1 f50bdd6405c091455b417821ba3514dcb74889dc
SHA512 e9ea262ade30c254b04745d45012d0e996d49971e0ac5cfa539439a90d73072a6c58ca969f7ab5169efcb0be9df6d296882fdba3968373b72edd3dba24078b33
TLSH
T10CE0CD78FA68559319C1234B2569917F7B1D1D63034CF8B557D38706118E97468725D0
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\runtime.json
Size 2KB
SHA256 f0b4a6c54cec9b4f746e58506643de6658afbaf8031d3dc788a5ee9f537f61b6
MD5 00232ad1fddfec8f2bd59f14e110b07e
SHA1 71783567680ba2c23d86e5666aa811573b72ad2f
SHA512 85554652253f0727e279e19e415776feef966d16442d1d9ba4444d016f31c335bb1c19931c33dce29a2e45be688dcb02ffdf3c5ebf7812103129aed801522405
TLSH
T14C410033C4180A7216F161491CBA9353F6530F3BA30ABC6A7677810C5E6D33A21BCAB9
MD5 SHA1 SHA512 TLSH

Submit Download

taskmgr_hook.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\taskmgr_hook.dll
Size 14KB
SHA256 e999d9b27e4bc343a623aa96f33daac941c492d60c5f7175fd9a59deab1a9f66
MD5 6779238c1190fdfaa35e6c583782fbf7
SHA1 348e09bc1528a49666cd83518f0c69b047e6a961
SHA512 255ce6dca4c38e1d1057687770eb51819fe06a4c1574d295dbe98d2a4d57997db4a0e0a6c807e08cf3ae9c733dd94c4c39328895e9d4296bc8fe9a425d025bf7
SSDEEP 192:OvbwZ92ZNJGwRhCIhv9Kx+RBJYzlmrG2GS4V4lc:Ovb/XJ5qIrQ+pRoV4l
TLSH
T18362DA0D37A24BADD65FFC3441FB8F38AAB1F8109D82962D4134E5B60EA1B666735F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftUpdateHealth.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe
Size 469KB
SHA256 bfb6d3670268fc19a53a8a1c4e2977c7114ba3fcda96732059d5ebc13b4708ff
MD5 d08e8fe77012dbe74f30d7b88383b2d9
SHA1 1b4e5da4dcc4589940c6ce56efeb569f1b774a3a
SHA512 fdd9b89d25a02e1824ea00a6bc817caaab599d2c39670138f2ba6249a911630e8a29e1116031dead72a51054d182214da46ae7dc70caee40e628d40bcfb76dc4
SSDEEP 6144:cNI0cUBbSp3kFfUiOFc0iobPeGQ5UqRDOoh331DwnDWrgKimdYDPJHT04nnBwtTg:cNIyi3k2iO6GQush3twnDWsK0
TLSH
T1B3A43B0777E49EE6DC616138959B670D9736FCB007A696CB47201222AE07BEC8D2FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\build.json
Size 2KB
SHA256 0031aa5658f47f78258e62a1dbca80923ad84c83c4742e8bf4625fd55c54255f
MD5 af02985c6878c00a91eace5eb3a8ffe2
SHA1 97f31c726e4695f209742dae201e28f97d756e22
SHA512 2fc3a1a98519cc2d9c443827ecd3ccf7e7e967f18e885d646381b8ac2510af1e105af703422e90b91cc9c4d248d15999a52eb9c7d8bd40cd78b6f2390846d553
TLSH
T1B341CB2AC8180AB626D0A4486CB99F4345570D733A4ABCA877C7960C5F4D73F20BCABD
MD5 SHA1 SHA512 TLSH

Submit Download

ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe
Size 43.7MB
SHA256 b2c7599de17485ff770d87eaaf327206049fc5dc6271163e0405cac99387d2f5
MD5 91a7cd46fc0c319e3ba7ad13dc46a039
SHA1 4cf435e84edc2c0f43b519e85e4fd90b98d0c4ae
SHA512 9e1db01e6ea8392dc875510bb1ba2425898159af7a6c75734e8a963441e66f9cfac8925175160643c2e826e07b4f54ddb15d8aed3ca1607ff1beec63dd448221
SSDEEP 786432:7VIpFZXEWzcBlP+u+dyGRXmH7Ro9+tE7gWtjVptT+LkxL3x:7OpFEBgu+dtAo8OEARptT+g9h
TLSH
T19EA73302B7F88DE6DC21A138919B5308AA32BCA0479757DB532527229E237D8DD3FF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\config.json
Size 849B
SHA256 23eecc3b07e031eb4f44ad9dd06dca0dc6795dc476f6be49db8a9213b4154e33
MD5 9e753a6b3b980baf807be6b539c36b0b
SHA1 a25410382d190e4837f0660b9872cd4032cbeaa9
SHA512 c6214c8fb49ddfc7eb28035bb670edd2b92d4e56b2fb617e04660ec479d91672b073a1b0a44dbe50d1493bb9096058042bf8c51ca906d3d4867e86da74c39372
TLSH
T192014623C5180CFBBBD56D5C5C386383575CC583924C3C3CA247B960B25E7375535AA4
MD5 SHA1 SHA512 TLSH

Submit Download

cpu_status.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\cpu_status.json
Size 28B
SHA256 75a83a674fb728255a1cb4f94d0fef3c22ec3635b324707f75e2daa77796bd87
MD5 a6f37f26935df119a18c2835281e818e
SHA1 d2ca2b580fa0f38d8fa6bdf50635e4e223505ca2
SHA512 25ac8e49a0289eea760009267a7ea3822980c5324aa208bd6035446a6d9e133790f18af133580f97b480523facc02ae2155286df9e948eab8f088de11a1830e9
MD5 SHA1 SHA512

Submit Download

cpu_status.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\cpu_status.json
Size 27B
SHA256 c83bd458695971eb056ab6c95b6649046f7d8df9eb574a81430f93c8a7937cfa
MD5 79814f6ad7ce9e7a2d65d919d964db27
SHA1 c918a6ca1034522636ac4b46a97af3e210fa42b3
SHA512 18aae515c7d889651c648d28947451afd21e96ab6c942c34e44c0afa98c06cb97dcd9d6f87dc8a0bdd0e04b53875624f7c46aafbc1f77356a7f8de4c5add66be
MD5 SHA1 SHA512

Submit Download

last_donate.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\last_donate.json
Size 295B
SHA256 cdc4505450ad792fd2ab53e02d8e96e0e26339187e59b0b4984ebd75ddd2085b
MD5 0c02af8dd7b9c014273dfb597ad78f5f
SHA1 5337ec9079a38f61d582a5407f02d5f9834bab04
SHA512 20c2c16dad0a90921afc2674a76fcf8822d6b55066eb06f074660bd2a303e6ddf8e873170ee2b2956709694e33b28ea0be6e98490ab6ab10ff21eda155de0bbe
TLSH
T1D8E02BF6C60980A706E3529A5EA185AD30DE4D35B3C970F047C32E4500CEB3C903C379
MD5 SHA1 SHA512 TLSH

Submit Download

last_user.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\last_user.json
Size 363B
SHA256 1a63ab7b0edc6560a9f16ea8fb2162c8030a517b267fb8d66c16c2ba581174b2
MD5 7b543e5877313488e0ead14a5f3c3195
SHA1 030c587612e32f1e69ce16036e304d301069f460
SHA512 511be69a09965e43514ef5a1aaddde2f9054878fc0bec6c0b15ab1fb78c713b91d587bed74e8c77c793f78d18e24414808fe5116eeeec61afe32dde01795ee45
TLSH
T1CEE0D8B8990D029717C05B4A2525676FB79A0E934348F97213D39741924D938A4715A1
MD5 SHA1 SHA512 TLSH

Submit Download

SearchFilterHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\SearchFilterHost.exe
Size 37.1MB
SHA256 c972dbd858151caecb09c63dd452d04618053cb9ec83dbaefb41c7f31cc50df9
MD5 526fb4b7ac629ec41ef971e2a550ee54
SHA1 9a3c3652d1464649c60d4e6c79f198288abf50d0
SHA512 964758b8d33d592114fd35f130fa27060c9b419beb5c10d623a66667e72ea70f30f3a0fd2b5dd6ceec38ca3d0002eb90ed6772dbc780e57f90769c92cbaf58fa
SSDEEP 786432:LEWzcBlP+u+dyGRXmH7Ro9+tE7gWtjVptT+LkxL34:aBgu+dtAo8OEARptT+g9I
TLSH
T1F2873305E7BC4DAACC21A279916B53086B317C90839397DB533527229E233D8AD7FF19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchProtocolHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SMX5692\SearchProtocolHost.exe
Size 6.2MB
SHA256 aab286a7a1f85e80a7adbf8506f367ad43e3746cf2f2f3a76f15f4a50eb509c2
MD5 b704a2eb41cd058ad6ccee5b63b4ae2d
SHA1 255aa355814c02bad1e8b005fcd3b8b23a959904
SHA512 4f762da6f3c2fdfb0d5f842cb2125270327094d824ac0975453e9ac0b6c9902b6cf01ab9741e0776d11df899b9c3b16828d7f77c3ab70ff72014f6b53b343fa6
SSDEEP 98304:UcfpU7Wq2lkljZbHVcu6i5fmQyoIs6htw7zvNSghYKM6WnOixaHxpo/9946LD7v4:M4Wdfn6Hw7zvwMYKM6WrsLm067Q
TLSH
T1D6662302A7E58EEADC21A13891CB9318EA35BCE05B9762CB535026325D277DCDD3FB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g3.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\g3.exe
Size 3.4MB
SHA256 1c32ac56e8f9d490e49305adc30bdcb8343ad2d18b9ff8100940ae6d6e129038
MD5 053cd98a47d2fb0f7b833da3e2784c83
SHA1 ea3191afb8dce803b1cec3a9a68d86a81a15efc9
SHA512 0058a5aced4d2aa5f166c5672fac1161b67685b086d66ac655e5f1562235bd9226bac55888d3a2488343b4c1434087a2aea4d8fd4b0cd14b68dc7bffc9faffee
SSDEEP 98304:GoIs6htw7zvNSghYKM6WnOixaHxpo/9946LD7v/:f6Hw7zvwMYKM6WrsLm067
TLSH
T165F533D18ECA0340EFA06770F4984916E2DF5C52B60F201CB9CA6FFC453664AF4A666F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_eonftf2t.nvl.psm1

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\__PSScriptPolicyTest_eonftf2t.nvl.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mnr_WindowsCache.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\mnr_WindowsCache.xml
Size 1KB
SHA256 40cd90a2e1b487494f4d04d6c0e9fdf6af4bc31c3fbb750f4947ccdbc77fcb2e
MD5 eac4dd6665c3cc4f2af206c2c5a6f1b4
SHA1 599804f7865ed8f30784e2e2bd3e088a200b820b
SHA512 d3f98351443757fc3711a145f9cd837a0302d15687b239f08f626005c6c614e8d861bfd7dbec995437331b856678eaaa3e19d5923088c91f0dfc913e362a5480
TLSH
T1EF416983ABFD2209F2F36B6CBEB668415AB6FC591D24C8AD0174050D0475D71C9B0B3B
MD5 SHA1 SHA512 TLSH

Submit Download

mnr_WindowsUpdate.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\mnr_WindowsUpdate.xml
Size 1KB
SHA256 d1665ccd1efc31ef963cd1bc6cc1ebe328ab38e5b5a3b6bec5d1791dde955182
MD5 b1a00bebf496b7a1d07ff56787c12046
SHA1 8c68dc9b059fcd388dd91f94be4cdff0beb3acbb
SHA512 4dd56615f67a3d87345a884727e3c07986238d0f23a839e797a7466cdbd8b6789d88c023cb3b72cad4f68cb0ea045c2a9f7da68f57c023f43d60ebadbe9ec89c
TLSH
T1E6417C836BFD2209F1F36B6CBEB6684159B6FC592D24C8AD0174050D0475D71C970B3B
MD5 SHA1 SHA512 TLSH

Submit Download

sm85EF.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\sm85EF.tmp
Size 6.2MB
SHA256 0eadb9cc8098d0fb1ac1e80f13de901435a4c5e974ea0dc7306e037178e84ee0
MD5 e8a7266e92b8409445d9161d17d41e6c
SHA1 59d7e0b94180530a6136a7da4ae8db26a176c440
SHA512 f4c71cb9a4f6529e3263b0de123f999b3b138bd153b844ff2707170bc13510364ef68b1d694ce8cb0e3ae30e486e292f979fbff23a1cb70bbcea0614008f8d65
SSDEEP 98304:SqFp6S568NMyOefiH7cXdHkByf1WCseto4tMQXfXDox+Sxw427x2vHkZvfl3TDQF:SRC/NM0rDoxrix2PkZvdAv5n1gpgR
TLSH
T19C569D26B7A401E8C87AC53CC6469A13E7F2B81A5370A7DB17B0567A1F336D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runtime.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\runtime.json
Size 2KB
SHA256 d6bc366b4ba747f612617aa5d4479311a344e3dd7a634ea55f7534c48f31095b
MD5 5f6ebc18d8e1eaee162ce3b94ce321cd
SHA1 a63241a6d46a2a1ddadfce6c7fe698f35ed87c10
SHA512 f67aae1c8833e913028e26d8b3c7275bbc891d9b86adeb8242efef80955adb33b28302677b4467e08490f3051491e984f177decf362ab334eec965a06188ed94
TLSH
T1D941DE23C8180A7216F0A4481C799743E5570F7BE34ABC6677B7960C5F6D73A20BCA79
MD5 SHA1 SHA512 TLSH

Submit Download

taskmgr_hook.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\taskmgr_hook.dll
Size 14KB
SHA256 d7d5d1138c79ac55e54ce36bbb24cc0dcecd1e97dca5c0756d28aea53963eec6
MD5 8f0870dbcf68dc17fd81fbf9aa1ac7ff
SHA1 b7c0b96226307951315890af9c31740388324e97
SHA512 f8cb4d1a4e366dc66f4132f58681d6a7bbda7ebf60a45c47fe6b31f4cc366e3d93176e5ecdf1ea1966d2401b5973a42453682759448327e3d6da8d3c3398b28a
SSDEEP 192:hvbwZ92ZNJGwRhCIhv9Kx+RfYzlaLy2GTV4lU:hvb/XJ5qIrQ+RtQV4l
TLSH
T1AD62D90D27924BA9D65FD53C41FF8B3CFEB3F8129942922C41A5E9320DA1A676735F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1652-218-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/1652-220-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/1652-206-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/1652-214-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/1652-215-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/1652-217-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/1652-237-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/1652-197-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/1652-219-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/1652-221-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/2660-331-0x0000000000AF0000-0x0000000001745000-memory.dmp

Download

memory/2660-309-0x0000000000AF0000-0x0000000001745000-memory.dmp

Download

memory/2660-306-0x0000000000AF0000-0x0000000001745000-memory.dmp

Download

memory/2660-263-0x0000000000AF0000-0x0000000001745000-memory.dmp

Download

memory/2660-254-0x0000000000AF0000-0x0000000001745000-memory.dmp

Download

memory/2660-248-0x0000000000AF0000-0x0000000001745000-memory.dmp

Download

memory/4300-319-0x00000000061A0000-0x00000000061BE000-memory.dmp

Download

memory/4300-333-0x0000000070040000-0x000000007008C000-memory.dmp

Download

memory/4300-344-0x0000000008A20000-0x0000000008FDA000-memory.dmp

Download

memory/4300-343-0x0000000007C90000-0x0000000007CB2000-memory.dmp

Download

memory/4300-342-0x00000000078B0000-0x0000000007946000-memory.dmp

Download

memory/4300-320-0x0000000006240000-0x000000000628C000-memory.dmp

Download

memory/4300-341-0x0000000007800000-0x000000000780A000-memory.dmp

Download

memory/4300-339-0x0000000007DE0000-0x000000000845C000-memory.dmp

Download

memory/4300-340-0x00000000077A0000-0x00000000077BA000-memory.dmp

Download

memory/4300-332-0x0000000007610000-0x0000000007646000-memory.dmp

Download

memory/4300-334-0x00000000701A0000-0x00000000704FB000-memory.dmp

Download

memory/4300-337-0x0000000007650000-0x0000000007670000-memory.dmp

Download

memory/4300-338-0x0000000007670000-0x0000000007713000-memory.dmp

Download

memory/4300-328-0x0000000006590000-0x00000000065D8000-memory.dmp

Download

memory/4300-307-0x00000000028F0000-0x0000000002926000-memory.dmp

Download

memory/4300-308-0x00000000054D0000-0x0000000005B1A000-memory.dmp

Download

memory/4300-311-0x0000000005400000-0x0000000005466000-memory.dmp

Download

memory/4300-312-0x0000000005B20000-0x0000000005B86000-memory.dmp

Download

memory/4300-318-0x0000000005DA0000-0x00000000060FB000-memory.dmp

Download

memory/4300-310-0x0000000005360000-0x0000000005382000-memory.dmp

Download

memory/4544-213-0x0000026839730000-0x0000026839750000-memory.dmp

Download

memory/4904-330-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/4904-327-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/4904-321-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/4904-322-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/4904-323-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/4904-324-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/4904-325-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/5348-282-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/5348-283-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/5348-278-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/5348-279-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/5348-281-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/5348-280-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/5348-285-0x00007FF665310000-0x00007FF6686BE000-memory.dmp

Download

memory/6028-207-0x0000000000BE0000-0x0000000001835000-memory.dmp

Download

memory/6028-247-0x0000000000BE0000-0x0000000001835000-memory.dmp

Download

memory/6028-37-0x0000000000BE0000-0x0000000001835000-memory.dmp

Download

memory/6028-141-0x0000000000BE0000-0x0000000001835000-memory.dmp

Download

memory/6028-201-0x0000000000BE0000-0x0000000001835000-memory.dmp

Download

memory/6028-92-0x0000000000BE0000-0x0000000001835000-memory.dmp

Download

memory/6028-233-0x0000000000BE0000-0x0000000001835000-memory.dmp

Download

memory/6028-239-0x0000000000BE0000-0x0000000001835000-memory.dmp

Download

memory/6028-240-0x0000000000BE0000-0x0000000001835000-memory.dmp

Download