a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
Size 2.6MB
Sample260724-w92z8swerd
SHA256 a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0
MD5 423aa146685e85d209aa06fe7f2a2770
SHA1 38bddfda2096fe5ca67f7f3bc9e1f2c280173cef
SHA512 600da26ec808593c6e66f4d879b80a4723191924c75382aadb2799ee8d7b2cee11a87e1faec88b5e2fb7630b43a42838e490d1752bb0317b29069208e7c0c840
SSDEEP 49152:+eWUGHITpj2h0VZrG+G6vATCj86J2fkVkS9BoLenxvdLV3Az+y8ZoIbO/:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yf
TLSH
T13FC512E1785A6ABBC00A1C7A8D56CE6270EC57B1CB504CA7FFD53EBA4950CD31633922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4960	NetworkHelper.exe

Executes dropped EXE 20 IoCs

pid	Process
964	NetworkHelper.exe
4960	NetworkHelper.exe
1952	WindowsHost.exe
1884	WindowsHost.exe
3156	UserSession.exe
4356	UserSession.exe
5432	WindowsShell.exe
2708	WindowsShell.exe
1780	WindowsShell.exe
4388	WindowsShell.exe
2460	SecurityCore.exe
996	SecurityCore.exe
4492	CoreSystem.exe
5880	CoreSystem.exe
1404	UpdateService.exe
2856	UpdateService.exe
3196	DesktopWindowManager.exe
2968	DesktopWindowManager.exe
2528	UpdateService.exe
3132	UpdateService.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UpdateService.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\UserSession.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\CoreSystem.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsHost.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsShell.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\UpdateService.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\DesktopWindowManager.exe\""	UpdateService.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
58	raw.githubusercontent.com
74	raw.githubusercontent.com
87	raw.githubusercontent.com
3	raw.githubusercontent.com

Detect suspicious telegram bot 10 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c50d-10.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c50e-68.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c511-87.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c50e-137.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c511-171.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c518-205.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c51a-240.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c524-283.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c51a-317.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c524-358.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	UserSession.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	UserSession.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1816	a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
1816	a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
1816	a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
1816	a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
1816	a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
1816	a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
1816	a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
1816	a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
4960	NetworkHelper.exe
4960	NetworkHelper.exe
4960	NetworkHelper.exe
4960	NetworkHelper.exe
964	NetworkHelper.exe
964	NetworkHelper.exe
964	NetworkHelper.exe
964	NetworkHelper.exe
964	NetworkHelper.exe
964	NetworkHelper.exe
964	NetworkHelper.exe
964	NetworkHelper.exe
1952	WindowsHost.exe
1952	WindowsHost.exe
1884	WindowsHost.exe
1884	WindowsHost.exe
1884	WindowsHost.exe
1884	WindowsHost.exe
1952	WindowsHost.exe
1952	WindowsHost.exe
1952	WindowsHost.exe
1952	WindowsHost.exe
1952	WindowsHost.exe
1952	WindowsHost.exe
4356	UserSession.exe
4356	UserSession.exe
4356	UserSession.exe
4356	UserSession.exe
4356	UserSession.exe
4356	UserSession.exe
4356	UserSession.exe
4356	UserSession.exe
4356	UserSession.exe
4356	UserSession.exe
4356	UserSession.exe
4356	UserSession.exe
3156	UserSession.exe
3156	UserSession.exe
3156	UserSession.exe
3156	UserSession.exe
3156	UserSession.exe
3156	UserSession.exe
3156	UserSession.exe
3156	UserSession.exe
5432	WindowsShell.exe
5432	WindowsShell.exe
5432	WindowsShell.exe
5432	WindowsShell.exe
2708	WindowsShell.exe
2708	WindowsShell.exe
2708	WindowsShell.exe
2708	WindowsShell.exe
2708	WindowsShell.exe
2708	WindowsShell.exe
2708	WindowsShell.exe
2708	WindowsShell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 4960	1816	a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe	91
PID 964 wrote to memory of 1884	964	NetworkHelper.exe	94
PID 1952 wrote to memory of 4356	1952	WindowsHost.exe	98
PID 3156 wrote to memory of 5432	3156	UserSession.exe	99
PID 2708 wrote to memory of 4388	2708	WindowsShell.exe	104
PID 1780 wrote to memory of 2460	1780	WindowsShell.exe	105
PID 996 wrote to memory of 4492	996	SecurityCore.exe	108
PID 5880 wrote to memory of 1404	5880	CoreSystem.exe	111
PID 2856 wrote to memory of 3196	2856	UpdateService.exe	114
PID 2968 wrote to memory of 2528	2968	DesktopWindowManager.exe	118

C:\Users\Admin\AppData\Local\Temp\a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe
"C:\Users\Admin\AppData\Local\Temp\a488fbe8c6f4b8291ae1ed92728d64e79508b6b9be54a72e2a635d6a9d58ceb0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4960

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:964
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1884

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:4356

C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5432

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4388

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2460

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4492

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1404

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3196

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2528

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 281B
SHA256 08af1e2a0e48fecea8f38ddb1ff94dfa273b023f0c601a072900c9710372a75d
MD5 acb9062dadaebc65bb03b8a9ee75215a
SHA1 d50b20f463825dd2f2a89a35ac516e51730b3dc6
SHA512 0489553e2e7b568eb5df7e74b690519c9d4acf54b1acf3bf8de131d78613e4cd95f5f565572f774aea23c846346f66e18b4a67a7c1fd99b6add3dc18873d705d
TLSH
T18BD0C29112BDBCD76EA39B9542E28428340267B113D63A659C29991A982097B1B02210
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 438cde784fda454be529856cb81b400531e2b737c994e280ec332ed0df73e90d
MD5 26a56fe8e6dc0be55c651e3b1aa85721
SHA1 4a23c72a4a83a29b56e7c99f2531555d4853784f
SHA512 75c8ba218df1f79a60bfa1cfba6da098d0f9553b6512e5bd253b6c802e8bf5897fc2516f8ede1a9bc3fb6f44259763aff8d04e7dfd493661ce7fff974d86417e
TLSH
T1CBE07D13BB68899BBD33442406E304BEB8B1548A44C54715382A02CE4C9223F8603115
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 9ecedfda1150790f5ee98d6ffb61ef83a40ed54266893a00ea5f6802e5a4c04e
MD5 b54e42cc8940180828f7d0f4f990d114
SHA1 d9be2770232e1d5c3073db14b9e8368825d3e1f0
SHA512 d718e6b983d0958fc7d77bd8e6398b48970fa8526f3a349242b97848340ecbeec53863140663f21c52d66ecb77c8ab3340fe867cbe0b7ad107d6112517661faa
TLSH
T18A41B7DA1B2D74247F828F445B78CB362D3DF181AA84619971F784A22057BC62E578AC
MD5 SHA1 SHA512 TLSH

Submit Download

892BD135CF0BA5A31C6B8A7554540845

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\892BD135CF0BA5A31C6B8A7554540845
Size 858B
SHA256 1ab42df7ff94edc9105817829a735c4248286e0c3ab56c6b5295d20d1208ee7f
MD5 052f0a7671a1a767288f72a649d33946
SHA1 63a711d730fa773cf874b4192ae56a219269c461
SHA512 4125e587f2cc2e7aa6019520e84859b482fdf34bc5e7c08915edc3809219764e70e73acc4cd10d54dd5e36d95422a195a852b08ab11bbff89aa64ec5d85ac48b
TLSH
T1D811804414493173DC42BE39C6DDEC93ADF037856BD5D08ACA429B823822F9E1F4A2B6
MD5 SHA1 SHA512 TLSH

Submit Download

A8A4CE43DA65177907B85FEC6335160B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A8A4CE43DA65177907B85FEC6335160B
Size 103KB
SHA256 5ff613e49b0152f4a401b1a6803a5e484361ea3ce371f1dc42766a52bf8ff8d4
MD5 b0cba813de65cfe6bc67ad5c689df34f
SHA1 dcb47502e47a05db5bf7d78a18998161e976b3dd
SHA512 6fa26795bf295a006ee8c7744e7cb544d24ecf7dcc53f7f7302c9045f1e876706c7b0a532a27608d6882465243d93f0586e99634e00cc98ee3f2e0591902899b
SSDEEP 1536:i+PhLXQjZILT8duUIiEziqUYEDzk+eFf5gxTD4atChMGVRoGw5S:3hLXpT8MxiEAYED4f5gxT1KjVD
TLSH
T177A31BA89C77FA61ED0B8FD64EAEDE9E1EF651D71D01822E0E307E509C13A57EA17040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 cd2e3e04980cdf8bc9e083033d3cec6d2677d6cf2a1ba84fe7bb9c2ae1ed8b9a
MD5 436d84cebee13ae4bdf9511af6c7154c
SHA1 62fff049b4e4ad1a15a6acf218dff016bcc70d90
SHA512 be80b213d45c0e5d432a7e40e956cba59b4cb749299373afcc99d2652c310de537c85cc3ddd98becb77db6fc42297cec578e80eb2f79b82539f6e9d678c564e3
TLSH
T13A41C9DB1A1EBD61EF47CF8B29B9C53A3C789564518018B5B8F7C4C204EAB842D1BD4C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 7d0ee8e73876d78c6d86593313b6be9288a9abd30dd062ba7cb772ccd899d281
MD5 d953ef5138a578e7938a9b836db64cf1
SHA1 7c9973b36e623f083e088015f7802bb9907edf01
SHA512 31ac8b329ab54c895b61f5556450673dad2376dd0c1cb80d663835cfb5dc7337ba746148e3a11918ba8c93b3c6531dd3c37b453676fd93545e67843303ebe881
TLSH
T190F05C14347C4118E272D87DC7E5716AFC29F1127C047B633B9312065A01F001C6782E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 71a6ef434b3ae94fc7745f2813d05a82ffd66cc0bea0ccee926aa4beabf700de
MD5 0e7e9ad413e83809243907557cd1d57b
SHA1 e76ba4d58c69ede4b80f68ad5dfbc5387962661f
SHA512 935ba22ee1abe75d1e505d53c70e514d08c99e1f75b3f8ad5f2b2375db2111dc349a70cbe34de1fa9788f6186676e1f5917fcfb8d6b418cd44b63934d8f607a3
TLSH
T1E4C08C1C1EA24A16F2A8437C02C239139B609511E2458F051BF12A08CA96F166838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 07884c1a6b7c76c5186ade9d19acd0ff4b787f4a5b4d0ab7c3a68bb96b89321f
MD5 c88bc2b8e96200df771b4f775bc214e3
SHA1 39f47bcffb73dcfe38682d6e213f69504c4219fb
SHA512 66b5a752d21a694deef5ba141a0d647d32c43156befc39c955317e979c26781c34c62f0d2992588080d25b05608f5098b0493a5dee3962f93390e5a800e8e772
TLSH
T140F05C2C16BC907DE176DB758AC4B3919C16E133284895D90BE30A489602E026CA157D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 3419777e122875513ab59c2e1da8fa457b4ac0d65af5ca41202d8dc9c72cd47e
MD5 d6a01913f2cc2ba95fd4545758c84328
SHA1 58851d111247061a9bdb9829c917e44706a11721
SHA512 8c8d06850e5fab43e7a9f4223e8557be3bc255ae4cfa77e59fdc02bfd252f1a5e8ba5ab8d9cb395b6358da688cff63c21e641c163f628095994d9c46f5b4b18e
TLSH
T118F0223839FB847BF022DA784BE622B18766B32320023FB816B053082E12F157C8251C
MD5 SHA1 SHA512 TLSH

Submit Download

892BD135CF0BA5A31C6B8A7554540845

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\892BD135CF0BA5A31C6B8A7554540845
Size 330B
SHA256 0aa87d38ab4776ad60708900b986b7f2d976ae4452ccf431deed9e099875d7b2
MD5 22f6156af6d77ac1e73b4a1f6e349bd2
SHA1 606c70a0b93376122cc27b038d1cf17054c7128c
SHA512 2709510b925f038932f6895638f813d4ef09627061c0611ad5f378ec23c9e48902b1971129055c31f7eda6a45412663d8ee390c7d6f61fdd80bd3b27668f0720
TLSH
T1C3E0C234ABA80213F77E16B90C715D94A827786FB608C6190BF6010C6835F409CB1D19
MD5 SHA1 SHA512 TLSH

Submit Download

A8A4CE43DA65177907B85FEC6335160B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A8A4CE43DA65177907B85FEC6335160B
Size 246B
SHA256 ce3e0b96f47bce33b6d6dd5f95f54f0cbcc51ab3b6ee199127a442008f7bf8bf
MD5 0ad2cc36c348f3d6971fce3f0883d377
SHA1 cc1dd8954d4d10df1fa341f1820e18f40a46d518
SHA512 fd3851f7640ecdd8217f88cec45a99fc915de3dcb31a8b0a19e58d2deff608a2d515e99fab99412b7b71e515694806f06c81e1cddc33f38714be3db6be0ba5a8
TLSH
T165D022142B981290F620CB7668A101D16E606013F0A15B0A2FA94B4C0C2EF985E20D0C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 c147366b933ec21eb4f17b170416313c2ced060d9f938d0a7b1d2ef980bb5c1f
MD5 0fdddf8de0fa53d45bb58a394502d96e
SHA1 ecc28acaa523777594feb3f45d39efd5fe657bbe
SHA512 49623e0fb436cbba0553474780f6909c383f24b2646cb6bf2091dba4fa1241e991586ca2b10b7fdfa6b33a9dc3696217eaaf85a752ce9bcbcd199a38e2bb63fc
TLSH
T105F0AB6818EB110EF263EABC12C101D61AB2E63231183665356003042F41D027E71A12
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 c60e383b9ff03a8a06f6e9d04ee702166696482a173661e36b3ebbfaa10a16e8
MD5 4def72e8a09a315d38088e841a5af052
SHA1 020290090ce55e0d99af59c8538e12035dfd68fd
SHA512 291ad2d855692f5147100604abbe2d1fc52baf919cbd0e8cb21cefd39b3e832d4260de26ad84b212555a0d2f3193de33b47a1b3ad502cc371a4276d37d1a183c
TLSH
T150C08C1C16624606F2E887B952C269938A218120F3819F0127B12A08CD24F122C34C29
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
Size 3.6MB
SHA256 a3397460a67bba96044165ffa913f09d1e04d9ad5e6162fa73b5dad4a57e947a
MD5 f98614580f3f02e405642461658c4504
SHA1 fa1946b00a1801b35c2034972f22b388450df2d0
SHA512 b0fec474b91b33d0cd592e37cafa7efa672f4b23b15757f1f5dbee2a11b39e4b9b7f7b69700dda221a866f7d7b4a15bc29381207db0f09526e5b476116fd7477
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGotVmMrvNev:+0s420bTaw+i0k1oZBtVVzcv
TLSH
T1AE0623E5781F2ABFC00A1D7A8955CE6274AC57B1CB505CA3FFD53EBA4940C931A22D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
Size 3.4MB
SHA256 2794b3dba99e4375b287b3eaa4d2f25e750e567053708d091d37654e138dd2c8
MD5 e93f40723b8f46400146dfa20f4685ac
SHA1 6f3adadb341cf9cf14962028d97b80985ca9ea2d
SHA512 b36e99a2cf651db84ddf5be1419db43fde5f6cd4393ff6e3c40542ebe65d10160584ae5611182f2d2a183837ac02d49c47acc604bebc955a40a328402dd5ceae
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGotVmMrvNel:+0s420bTaw+i0k1oZBtVVzcl
TLSH
T159F512E5781F2ABBC00A1D7A8955CE6274AC57B1CB505CA3EFD53EBA4940CD31A32D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
Size 3.7MB
SHA256 b29a6c0ec93262929c59355311aac5ff51514dde80d3bf40863ea4f2b0cf5c1f
MD5 ba2fc9db9490b3063e62d87542a922c8
SHA1 4ad9507b923b632b5fb317a19253ac04b96205ac
SHA512 2e3cdb861ac3495893f210c001af6ab284fe4873e3a2e1122c2e6e4f89a71d933b5d7d001ea92a85c41f5c8337f22e70f2465df21e58a45eba3b02ee482678ce
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGotVmMrvNeR:+0s420bTaw+i0k1oZBtVVzcR
TLSH
T11E0623E5781F2ABBC00E1D7A8955CE6274AC57B1CB505CA3EFD53EBA4940C931A32D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
Size 3.0MB
SHA256 407a692135fac0ace3a39b22eac08a9f8593173fa906bd12c0f408bb428ddfd0
MD5 c3fb79989d03a8a1b25249b72e402a4d
SHA1 49e940aeeec36856f4b0f93241868295c226b317
SHA512 a80353fa1714ba2386957f521ece6c1e23802c9d8cdb47b5ec4ef6e9d12815a1e8b2d311e0ac1758139f5b613028aabc0de8ea0da32611c6a663c2d6d1be71fb
SSDEEP 49152:+eWUGHITpj2h0VZrG+G6vATCj86J2fkVkS9BoLenxvdLV3Az+y8ZoIbOVUILyw8:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yC
TLSH
T12CE512E1785E7ABBC00A1D7A8955CE6270AC57B1CB504CA7FFD53EBA4950CC31632A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 3.3MB
SHA256 076bb3e6895b1940e95d9d20c920d83d7b325430584ef8fa2fa5b311e025f687
MD5 c4c62fc30e124de61fb5776a77eb866d
SHA1 c2a871f1310df4d6c0ec5f74653c344f3c7b3a03
SHA512 7a74e27756b14234e58a7550e8c083604fcf73398c11c47edb0db90569b673061bc5d98c205cbc1dad8dd4e7d4198846beee5a39141c3dfb585f2bb5d5509519
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGotVmMrL:+0s420bTaw+i0k1oZBtVVP
TLSH
T169F512E6781F2ABBC00A1D7A8955CE6274AC57B1CB505CA3EFD53EBA4940CD31632D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
Size 3.8MB
SHA256 a0a3ae8e0e4f803a0c49639b02ccaa9d9ee8e84531e04859c299694eaee524c2
MD5 e6d1c9a6ac3ca6fba8060ed0cb02fdec
SHA1 396c8d4bde7d78bc7bf115c5e99c56e6b2cef441
SHA512 7fc6bca8b2c4002f307434e093b54c1c0ead0aeff86f3eedfc8010e8cdb0428fa68bc638ccf216f81d3917baa87ef70a2d76c29e1ea24a5a2d6fa5c80e928c46
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGotVmMrvNe9Cl:+0s420bTaw+i0k1oZBtVVzc9Cl
TLSH
T13B0623E5781F2ABFC00E1D7A8955CE6270AC57B1CB505CA7EFD53EBA4940C931A22D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
Size 2.8MB
SHA256 3e4aecbf0dfa5f680e441c5bb8cbb34cd39f989205339e72a629a1764fd82522
MD5 d86bfe6113e925d0170677054d19b92c
SHA1 7972f0fef3f1a1d399d2b9c87e38395b85e03f56
SHA512 fdc3dd6a01ae0cfccf1cc24006ebef6daaacef2dfb2441c7c1b0782e517a7f2c727aa6e76abb41086e29f2d539fedf2aa039ad7542fea1e23066923f6cc3caf9
SSDEEP 49152:+eWUGHITpj2h0VZrG+G6vATCj86J2fkVkS9BoLenxvdLV3Az+y8ZoIbOVUIv:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yL
TLSH
T19ED512E1785E6ABFC00A1D7A8955CE6270AC57B1CB504CA7FFD53EBA4950CC31632A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
Size 3.1MB
SHA256 e77a9303352fb2fbb249c36a95d12460fa5035d91990c78280bb826e195be804
MD5 8d259ff3906d3fc00d231c6fbd959b42
SHA1 40bcdac0dd8c1c88bbd9fd3df40fbe2d82c69fcb
SHA512 a1d64e871d82c1968b96844cbbe27f3f839e269e4f978e537cd89637787aeb0fd54c32380eb842c1427e4c10a200470c1151db3767c974046cb1c58514f4a6e1
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGotVme:+0s420bTaw+i0k1oZBtVN
TLSH
T160E512E5781E6ABBC00A1D7A8955CE6270AC57B2CB504CA3FFD53EBA4950CD31632D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
Size 2.7MB
SHA256 367ca7e50ca313bb10f2887cd1abef3811d476c2cddb1814bffcd3b20ea9f9a3
MD5 8b94822b384be70e381e065d30b2990a
SHA1 35955122b1b52e9cec73f99b18164034f644e8e3
SHA512 af41d22ca74c7021706d921e2f33d8a4af62752f95766719a01ebcee83baa5b54ef401cd9f4d2973aa80321a9128d316a4d50a6148e4e7b5ea0508dae607a8bd
SSDEEP 49152:+eWUGHITpj2h0VZrG+G6vATCj86J2fkVkS9BoLenxvdLV3Az+y8ZoIbOV6:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yE
TLSH
T112D512E1785E6ABBC00A1C7A8955CE6270AC57B2CB504CA7FFD53EBA4950CD31633932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
Size 3.2MB
SHA256 c1747abca5bcc72839c77654fb6a676025b889938bca14ac1fde4c96d1696428
MD5 205cc4ca5fde7343c3d63203b18512a8
SHA1 48517826747a936ab51ec91d7598ed11c0dee1df
SHA512 6fb9fe70aa9c58078a964aee2ee195de7f04aaaede9a12b52b0ea61a50061c99cdc1b8b2520988edddb9cbc7bbbcb71f1a9ea61cf6e16a4dcc20d25e8a30295c
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGotVmMrw:+0s420bTaw+i0k1oZBtVV0
TLSH
T140F512E1781E6ABBC00A1D7A8955CE6274AC57B2CB505CA3FFD53EBA4940CD31632D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download