3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
Size 4.8MB
Sample260712-rwbtnsbw9q
SHA256 3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6
MD5 214833da24e60b6a9643179f70636436
SHA1 56cdaae9c7bcdb513ae92fbd3e49aea446e1c884
SHA512 56c02c7c675955e48d667b783f0a81192ddf7f01633ccc96c741646f2e7d58f0f0191cff56b639a27f0f0aaf6b7d46ccc65d3d8419537cf1209e833e744e48e9
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwB7S:+0s420bTjzGlBrJTJb8QAMQai4SGy7S
TLSH
T1FE3623D6785E6ABBC00D2C7E8E178D2675AC1BB1CB604CD3EFD53EB64850C931762922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1036	UserSession.exe

Executes dropped EXE 21 IoCs

pid	Process
1036	UserSession.exe
3136	WindowsShell.exe
5584	WindowsShell.exe
6036	UserSession.exe
3940	UserSession.exe
3560	SystemTrayHelper.exe
4712	SystemTrayHelper.exe
4972	DesktopWindowManager.exe
4484	DesktopWindowManager.exe
2528	WindowsInternal.exe
5936	WindowsInternal.exe
4472	WindowsInternal.exe
2112	WindowsInternal.exe
4676	SystemTrayHelper.exe
1216	SystemTrayHelper.exe
2428	WindowsInternal.exe
3240	WindowsInternal.exe
3652	BackgroundTask.exe
2728	BackgroundTask.exe
1236	UserSession.exe
4408	UserSession.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\DesktopWindowManager.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsInternal.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UserSession.exe\""	3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsShell.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\UserSession.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\WindowsInternal.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SystemTrayHelper.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\BackgroundTask.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\SystemTrayHelper.exe\""	UserSession.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
89	raw.githubusercontent.com
1	raw.githubusercontent.com
20	raw.githubusercontent.com
44	raw.githubusercontent.com
62	raw.githubusercontent.com
92	raw.githubusercontent.com
105	raw.githubusercontent.com
118	raw.githubusercontent.com
27	raw.githubusercontent.com
54	raw.githubusercontent.com
71	raw.githubusercontent.com
79	raw.githubusercontent.com

Detect suspicious telegram bot 12 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c575-12.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c576-21.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c57d-94.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c584-137.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c585-177.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c588-212.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c58a-246.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c588-281.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c58a-314.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c58b-346.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c58c-375.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c58b-409.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3436	3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
3436	3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
3436	3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
3436	3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
3436	3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
3436	3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
3436	3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
3436	3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
1036	UserSession.exe
1036	UserSession.exe
1036	UserSession.exe
1036	UserSession.exe
1036	UserSession.exe
1036	UserSession.exe
1036	UserSession.exe
1036	UserSession.exe
1036	UserSession.exe
1036	UserSession.exe
5584	WindowsShell.exe
5584	WindowsShell.exe
3136	WindowsShell.exe
3136	WindowsShell.exe
3136	WindowsShell.exe
3136	WindowsShell.exe
5584	WindowsShell.exe
5584	WindowsShell.exe
5584	WindowsShell.exe
5584	WindowsShell.exe
5584	WindowsShell.exe
5584	WindowsShell.exe
3940	UserSession.exe
3940	UserSession.exe
6036	UserSession.exe
6036	UserSession.exe
3940	UserSession.exe
3940	UserSession.exe
6036	UserSession.exe
6036	UserSession.exe
6036	UserSession.exe
6036	UserSession.exe
6036	UserSession.exe
6036	UserSession.exe
3560	SystemTrayHelper.exe
3560	SystemTrayHelper.exe
3560	SystemTrayHelper.exe
3560	SystemTrayHelper.exe
4712	SystemTrayHelper.exe
4712	SystemTrayHelper.exe
4712	SystemTrayHelper.exe
4712	SystemTrayHelper.exe
4712	SystemTrayHelper.exe
4712	SystemTrayHelper.exe
4712	SystemTrayHelper.exe
4712	SystemTrayHelper.exe
4972	DesktopWindowManager.exe
4972	DesktopWindowManager.exe
4484	DesktopWindowManager.exe
4484	DesktopWindowManager.exe
4972	DesktopWindowManager.exe
4972	DesktopWindowManager.exe
4484	DesktopWindowManager.exe
4484	DesktopWindowManager.exe
4484	DesktopWindowManager.exe
4484	DesktopWindowManager.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 3136	1036	UserSession.exe	89
PID 5584 wrote to memory of 3940	5584	WindowsShell.exe	95
PID 6036 wrote to memory of 3560	6036	UserSession.exe	96
PID 4712 wrote to memory of 4972	4712	SystemTrayHelper.exe	99
PID 4484 wrote to memory of 2528	4484	DesktopWindowManager.exe	102
PID 5936 wrote to memory of 4472	5936	WindowsInternal.exe	105
PID 2112 wrote to memory of 4676	2112	WindowsInternal.exe	108
PID 1216 wrote to memory of 3240	1216	SystemTrayHelper.exe	113
PID 2428 wrote to memory of 2728	2428	WindowsInternal.exe	116
PID 3652 wrote to memory of 4408	3652	BackgroundTask.exe	119

C:\Users\Admin\AppData\Local\Temp\3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe
"C:\Users\Admin\AppData\Local\Temp\3e80741d0271a43c6c916593111a9c02141abfb0673ee40ae6885f0921eca4f6.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3436

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3136

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Users\Admin\AppData\Local\Temp\UserSession.exe
  "C:\Users\Admin\AppData\Local\Temp\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3940

C:\Users\Admin\AppData\Local\Temp\UserSession.exe
"C:\Users\Admin\AppData\Local\Temp\\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3560

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4972

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2528

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4472

C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4676

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3240

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2728

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4408

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1236
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe" --monitor
  2⤵
  PID:6048

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe"
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 282B
SHA256 f10a8ddb4f74066f4128a886a6e97dadeb4c9d02300b9fc666882e635aedd20a
MD5 d9bd9e41cbee66dcdbcb88fd93042ddf
SHA1 55ab53707b332386a028479b8b5d92b880800e88
SHA512 8b2317a24b3c87688aa8e53ca5114178c0af24ea7e1ce87c323c67c61c7a7b582022b636a6493a22af9024290aaf4800bf2d564e5d25b9a6b684f79e567b6d8f
TLSH
T1FFD09595D2BE5C413F33DD9085D2F138360174735190AC6D0C4CC14D5C51637BF4B110
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 315B
SHA256 801efea5e8821209ba505c53dd267ac1afcea2dbfb69d650464e8041feca6aa2
MD5 2467817bffe755f38ef53da58971f90c
SHA1 42c0a4d5f0cf1920b9a309f6025a4f63e18f267c
SHA512 f31959dbe6809bb683d6aaecb68071206341076f0dd9232c420579f404c95d74be00bfdd61678a4cdd3f03c7715c4e831ff1e52d6c51c79feff7337f69e21a8a
TLSH
T195E07D16B39DC5E573234F350651487F786D710C38C7520A383809C2CC0221AC20F01C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 70647366cd882037b5518dc2ac9d1a5a00317678d091eddba47720563de1224b
MD5 d1bc62e529f9732e6a6db363e263befd
SHA1 8a9125d18b44528e336fe26f85665cd274298963
SHA512 19475806f4e1cbb4007339634135ecc6eb2beab7497843f64c5eef745fa650d5f9f57c37bcbb438895979b0ce6ed7f2c731ff6881f959845f671ea428c1f2426
TLSH
T1AF41FAE91A083134FF82CF454475CA323E7CB2D0954594F935FB85B174D67912D2948C
MD5 SHA1 SHA512 TLSH

Submit Download

A8A4CE43DA65177907B85FEC6335160B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A8A4CE43DA65177907B85FEC6335160B
Size 82KB
SHA256 9e3c90396fd463577f72ca62818d15940c82cc991715513c364f562359093b66
MD5 dc58d4677ea1cbbd7847b32be06405de
SHA1 8cecfed3a3e009b0629786cc3933ec46eba02f2f
SHA512 46ee91b2c75b1a7b4e461c1759e699ae3f0372c6ba3dc77bce7b9f4f327a10506b2fae5b5408aeef4d0e5534a8359a0d1836b389ec690802775bd7e8eb348e5a
SSDEEP 1536:Q+PSAZjZIy181qV/iEZKO+UY+qek+zDDonusuYyF:RSA318EZiEFY+qyDonuCu
TLSH
T1CB832AA8AC77F661ED0A8FDA4EAEDE9E1EE551D71D01432E0E307E901C13A97EB57040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 60f17561d226190ecbfae17d8480591bdf86d35a2e516fbd6ad02ce62d76c1b7
MD5 5e8cd353e36038bdf42e8882046c070d
SHA1 6e8759ee69fb30ad1ec650382bc2c3743c4e2cf2
SHA512 f769076e3d7d840f39c558c9d26c1f908a07f5cb6de732f3a4485ee4f3668aef27e08ebe098bdf3f2fd90fc0fce4e622495ac2319baac9beab099daab8938c88
TLSH
T15A1121C36EE4B19085E356B0CAE8C2257CB874822DEE70C11CD1C8A6145A72D6B2A43F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 edc4a2193297d3c27ea66a2eb00dbb71846ad4ebc6a5d69f093a949674a553ef
MD5 99b818d8ee381a750acd4eab846a4302
SHA1 029efcdd7420b9cb6cc60d07406582e4fa6f1101
SHA512 e6dc04b8aa4312689222122141ca6f8ccd00c0303e8c198d680d3825d6b6a253e9cdeb5aae69e6f8373e57742057c8c4b80af539e78114691097e535fc8d3b38
TLSH
T13441C9FB1B0E38A4FE45DF8A19B5C5391E3CD4E4A2441892B5BBC4D711CA7812A0781D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 1fb22c99d1fd1511c388f9b34586ee0fb33b290e7dfe24e9adfd961bec871e11
MD5 f375179969bcdf5a2766d88dfdc76179
SHA1 d9f7c50eeebe20b7ab1da40742257bc750402354
SHA512 7d5526416db67002e860f8ab82188fee4eea23514cffba7a15433b25a2483c5355e3cc1f873dfd1853b6ecb19b4cda4a973d71b446d430d1cace35a2bcdaf781
TLSH
T172F05C30207C4124D0B2DE75C7D971AAD42AF10678065EB71DD702095F07C421C6643E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 88577e72f7940c17cae0f100b80a0379fa1f092748a2fd06b3b0ae840fa97692
MD5 242a17e9d7316254bfe3c546feffecdb
SHA1 92e69106f3ec62415525852164bd657e833058ca
SHA512 7ed363688168f8ca7efed4fc30e8019f7583646a000a3b9335d6a0e4e60848561c41c505a60b7d8cab7416912057bbd1d9df375be6f6cbd224ae5aa63b3a81f2
TLSH
T184C08C1C1AA20A06F2A8437C02C13A039B609541E2428F091AF12A08C99AB162838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 ae7d694cf1dafa3e41b13e3f141ac9b03d4f877e8426755d646c9cae60789eba
MD5 e3538537079cdade1cacc136795b8e13
SHA1 d0f76fd58fb5882ae4987937fe7c8ccd32f69e77
SHA512 080de321b0f1dd2ea37b7469d1e7f5e09fb3e9eba3d8799bffb5385889cb276b44d79caebdca58a55117c91dae243039a9ce45b56e9c07241019ceaf1f8a7846
TLSH
T1C6F0552C27FC816DE072CEB847D8E6D29C29F123280446E82BD1270CAA02E402CA253A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 96b44c9057d73424fe4e0e6975d546cd6ac92c9358d1a045cdc575c85e57a449
MD5 519a61ac7f4b432d5b3aae057fa93a0f
SHA1 3ec073ef1911a2ed509d44716af629e7bb7a4de7
SHA512 fee161ab7a071f809f04fb94572c6bef5ac71123fff33ab25d67ccbd06a6ff721d07b7d4a325c60e26f88db780a4220c19772587c0bc50fa6157a1b6facfc4fd
TLSH
T1FEF0225839FE90BBF06AEA35D3C561746437E22630822ABA3AF212082B12F606C2151D
MD5 SHA1 SHA512 TLSH

Submit Download

A8A4CE43DA65177907B85FEC6335160B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A8A4CE43DA65177907B85FEC6335160B
Size 246B
SHA256 d07eb6ed6d36719680cb60593ea20de3b8b2dc2988c2750775e21eca92337f0a
MD5 0a37658524042eef9a2495fbacdce396
SHA1 61a4138e6a13077a66bf59ab94b39f283e59537a
SHA512 67c197243a3bf566859eacd0445f1733361be1b4af579816009d9f67f21acf2ad665cb210b381102572ca00882edb1b69aa1ea3e2f5ebd8ea0154abebebd96fb
TLSH
T121D0C9750B910332F074A2B65A7A15C26A986509B5919B4D5B6A47194C2EF090C7185A
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 a1487e8f29af1d003ad350db6617f867883c01317a56fee60b07adeea595e2d2
MD5 b1ab67d44fff0cc7cea7cc1767c329d2
SHA1 d78e3b2b1d6264d0e148fcc23166a308b3ebed44
SHA512 add26b12ede6a0c67d4d684f936a5a59a7e28e41cb8b1782d3ce4008345b96b2e4aadf3ab99013617b5f22f653da5c78165d614ade41a8e5c177b71ecc5e4faa
TLSH
T149F0A32D56D6401EF6305B7845F563DBAE1DB3433401C95D27E5074BED03F401D22439
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 8a0d101219161db408836fa18c5bf274e24e2f5068b492517ecf7f42abbadf8e
MD5 289102da7e56478b07d65d793be14d99
SHA1 3eb9ae376e6be5b98592500829d73c900163d719
SHA512 02fbca0d4c399f6b42f1385bf7c5126564afd90782ec9129656f851d78c377cdcc2a571f082605b33141d0bc77367c4f5274cb7a3536ed3a087f1b377eb82b8e
TLSH
T12BF02B3838A7422EF226DBB802C511DB9966E6363105276DABA157093D45E40AEA1E16
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 c7380968c61411e32f4d2c1e3c2cac5686ea5f78fedec12735e87a1e357bac22
MD5 2c9051f40d0fb9405a67cabdc9b518e7
SHA1 c31fdf0d85a0aebe049ca93618cea232bc7391ae
SHA512 3722af096bcee40d0377df58482e6c08f73d359cf39eb382190f9e6beea697796ddba2581a6ebdbe416d8921ebf37b46ffb1e69089b28148e52e2a6d6243a438
TLSH
T158C08C1C06610606F2A893B802C229838A608110F3819F112AB12A08CD28F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
Size 5.5MB
SHA256 bb17ed66bb895f640adace2d2fbe7f1fb186ce044878b1516f2d4373935b5d87
MD5 6c9f8579564f16957e114557c27b1ab7
SHA1 0ff1c86b51be59586f5c6eea98870791759e1ea9
SHA512 d2625575cc74ec08a0446f596a36cef27e08703d03b55ecc5a8322f9aaa39015adcd0d80c842d82363eae504a546f0e30d4571046d8fc11084f7ead2224ab0f4
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwB7bg+u:+0s420bTjzGlBrJTJb8QAMQai4SGy7bU
TLSH
T1D54623D6789E6AABC10D1C7E8E17CD2675AC1BB1CB644C93EFC53EB64850C921733922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
Size 5.6MB
SHA256 80f401feeff41924e69ae1b48822b6b271973986cb63f34a033deaec3b49d00f
MD5 ba6123e6c2436bb7bd93509185f414c5
SHA1 9c6ec42fe93dad2199c9e576b55e5e5b2c7414f5
SHA512 9cfa59c94c9f99e4e750edb2b24dc1fb5584fe7a2febe53da293f0d81ad8a72c19975a3885fbb49152ef203dd3e128803f42f6f4b762dda7e47c77429707f59b
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwB7bg+o:+0s420bTjzGlBrJTJb8QAMQai4SGy7bS
TLSH
T1464623D5789E6AABC10D1C7E8E17CD2675AC1BB1CB608C93EFD53EB64850C921733922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Temp\UserSession.exe
Size 5.1MB
SHA256 668952205c98cebe1c9f00e3553469506f692766afd608448836dc7f38d831a2
MD5 04053f6d5c43d07a5596355ba1770965
SHA1 d888ca59965a5edadbfb79431684b611b4fbcaf3
SHA512 89eb24799aafbe16e1673ee2286669e29f6ac0fd9930b57b0d4cb7aa1d7dcd0d2b3098f04f87168fba1305c644b0ff85616e35c73e3473059e63034840571082
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwB7bga:+0s420bTjzGlBrJTJb8QAMQai4SGy7bD
TLSH
T18D4623D67C9E5AABC00D2C7E8E17CD2675AC1BB1CB605C93EFC53EB64850C921772922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
Size 5.4MB
SHA256 58a9ca437212b2d1f17700c3519b7412f3525e8db820623381abf2a1a40f0b5a
MD5 993c42a3cd4f9e4eeaee9fe9b0afe623
SHA1 28415c7101a5c0bdb151152dc2001c34efa1d796
SHA512 eba95c1fe8a4040cd18dbc47a49ba8b61356fdb9bb39d21a15fc795af2f0d6856e35c0679bd6f164511aa08fd06dcb1a63f9456bfe0b6e584c82c4c3d8a5a399
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwB7bg+K:+0s420bTjzGlBrJTJb8QAMQai4SGy7bs
TLSH
T1754623D6789E5AAFC10D2C7E8E178D2675AC1BB1CB604C93EFD53EB64850C921733922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
Size 5.8MB
SHA256 6469dcedd219e06b9486e0057bb02e0aede5c58d159347f0eecd85a5d66b70e9
MD5 56291ca18c84f1db5a8757b57d857ae8
SHA1 6df272a68da54bb0705228e13a5750409a76a330
SHA512 dd8e42cda7f0ba1f5ac102a3fb1c51a11eb7a119b321eff3399d59759c1ffa6ba2584871bca184b18e54472423a76a520c8f5a6b981cbca4ff0930b4ee3271ea
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwB7bg+x7j:+0s420bTjzGlBrJTJb8QAMQai4SGy7bP
TLSH
T13D5623E5789E6AABC10D1C7E8E17CD2275AC1BB1CB604C93EFD52EB64950C921733932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
Size 5.7MB
SHA256 ab9e75785f4aac89bb6310df013e28dbb073ec97c4127849426cba5e2d2e920b
MD5 dfa77bd287d9c8e8a095894627c840d5
SHA1 f46eff18d60e3f55efb5dcde9d2f4a6fd336bd0e
SHA512 3d1dab6e1b45340f350f239d7371260bef289927e05c60dac524903aea68edaad577142674b1d4b90ddcd7d8194780f1bf5918b302a2e7939ebdc63cc41c9909
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwB7bg+x6:+0s420bTjzGlBrJTJb8QAMQai4SGy7bK
TLSH
T1DC5623E5789E6AABC10D1C7E8E17CD2275AC1BB1CB604C93EFD53EB64850C921773922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe
Size 5.0MB
SHA256 6d772f720dca9c5e3da8031e7a47f4c7e5f46f46af7abc22f87884a9132c8491
MD5 d5c748b8b428bdae7c0d5ea798f85a4b
SHA1 4a6393f96ffbdcb2452fdb531d47d491bbe4436c
SHA512 6e631fb53c1cbda884ad53fe31644e78ebd08ff2315b688ea7634b778c05a24b0b7055e92b641e0a4fd9cfc0d50b953a58063e3969090cb80c3b5e3c44b05215
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwB7bJ:+0s420bTjzGlBrJTJb8QAMQai4SGy7bJ
TLSH
T15E3623D6785E6AABC10D2C7E8E178D2275AC1BB1CB604C93EFD53EB64850C921773922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
Size 5.9MB
SHA256 fa38834228a0bf8210dced183022059f9be6582b93ffd842061610becd9e1e4a
MD5 d685a54cfb8a3539c2935d50e0aa441a
SHA1 fe2eba855a80876795e922bd719bee28e9a89cda
SHA512 dfce3aa2af3846cd97b76ff7be7c62a8c41943f7c339a9a4e6381be0324de669e813e6033598f632b2021872bed1499b110a940833bacc852070456eb86de24a
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwB7bg+x7CcL:+0s420bTjzGlBrJTJb8QAMQai4SGy7bP
TLSH
T1545623E5789E5AABC10D1C7E8E17CD2275AC1BB1CB609C93EFD52EB64850C921733932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
Size 5.3MB
SHA256 35b775b41456e4c1708e9ff1b1059b7eb4e2e3ef883c9952e3dd01d99e17c048
MD5 d2069541f6b51c2f644d7c43634940c3
SHA1 344ac33ecddbe2377137f80624f2ee66f2971a7b
SHA512 4ffa35423f02685d09017691b496ee45285107c04c36c7f7cce23c95820017f64b6e3da567161cab38542db62f0b32808628db751082508561a659102e1b17f0
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwB7bgn:+0s420bTjzGlBrJTJb8QAMQai4SGy7b0
TLSH
T1864623D5789E6AAFC00D2C7E8E17CD2675AC1BB1CB604C93EFD53EB64850C921772922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
Size 4.9MB
SHA256 c87b9cc4b5b14f5b7b5be9bc9ad52cad502d906d9140411109cdfc37c83f00f1
MD5 4c16d0aa1c800da01b055706d03635c8
SHA1 be7736f66f3cf8ded450f890cf4e7ef37996fa3a
SHA512 585c40c863104e3f4c64e2e86d1260114093990160a0b06299ac375b0e616df19e3fed76a164773df355211b23959ce45a311a06d233a92ab00262ff692feff0
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwB7bP:+0s420bTjzGlBrJTJb8QAMQai4SGy7bP
TLSH
T1983623D6785E6ABBC10D2C7E8E178D2675AC1BB1CB604CD3EFD53EB64850C921732922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
Size 6.1MB
SHA256 6777d039507340ad1a5b06eab6bd64343eddf52938d95bae41c56938aa18eeec
MD5 4239af8389b77961c4599ff9e9ff2464
SHA1 d37737fe5ede888e01b3554c78436ae0638f6328
SHA512 287a9d1d1d44cb49efdb80a698b484b382832642386102a37cf0ed1aae2bfca32d614a661346bfca3c13ce30b5049e8044996d1b892280696063185a3d335f23
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGy7b37CICGm:TDpbgBr/4QAMQaTCNo
TLSH
T16A5623E5789E5AABD10D1C7E8E17CE2275BC1BB1CB604C93EFD52EB64850C921733922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
Size 6.0MB
SHA256 e05299dc69b3124c79f7e59acbf5ecae7330fd78b8b88f0955ad53c80f7c9f2f
MD5 98eb90d3f4eaccfa6e1f2d8cc068f467
SHA1 1da3fba790e64b0ceedbbabd9df6ff9c4ebe7e18
SHA512 f9d286c4331f3c7cfc444cd5d53e5a0eb9748929e9dbe40213be90d529a93b2fdf84a6471809176648d5b3b610a6ef1e8a53f8d6ae430be845f641d6e71dfa55
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGy7b37CY:TDpbgBr/4QAMQaTCP
TLSH
T1915623E5789E5AABC10D1C7E8E17CD2275AC1BB1CB609C93EFD53EB64850C921733922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download