12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
Size 5.6MB
Sample260818-v28blsae23
SHA256 12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5
MD5 05458b1ae3b1f5c46e622dc8c449c758
SHA1 8f99ad870797103ad73aa4f2bf6452b6d646e9aa
SHA512 0b7cc70299fc3c8b2bdd8638a9fb77cbd7ec5cdfdb5507f1de6b975d6f365752f1d1687b23b669f216f5099ec89b1d35be22b3040f866d11c51598405f7a46d7
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRncXImFomgZ/B0:+0s420bTjzGlBrJTJb8QAMQCgnx8kY
TLSH
T1D35623E67C9E6ABBC10A1C7A8E06CE2235AC57B1C7545DD3FFC53DB64810D931722A22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3680	SecurityCore.exe

Executes dropped EXE 22 IoCs

pid	Process
3680	SecurityCore.exe
2752	SecurityCore.exe
2496	RuntimeBroker32.exe
1992	RuntimeBroker32.exe
1936	ServiceHost.exe
5828	ServiceHost.exe
1484	WindowsShell.exe
2532	WindowsShell.exe
1164	WindowsShell.exe
4080	WindowsShell.exe
4404	WindowsHost.exe
4712	WindowsHost.exe
5940	UpdateService.exe
5872	UpdateService.exe
4776	WindowsShell.exe
5848	WindowsShell.exe
4720	SystemTrayHelper.exe
4068	SystemTrayHelper.exe
2540	UserSession.exe
4328	UserSession.exe
2832	BackgroundTask.exe
4056	BackgroundTask.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\SecurityCore.exe\""	12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\SystemTrayHelper.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsShell.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\UpdateService.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\WindowsShell.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsHost.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\RuntimeBroker32.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\BackgroundTask.exe\""	UserSession.exe

Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
81	raw.githubusercontent.com
87	raw.githubusercontent.com
123	raw.githubusercontent.com
14	raw.githubusercontent.com
38	raw.githubusercontent.com
69	raw.githubusercontent.com
97	raw.githubusercontent.com
107	raw.githubusercontent.com
117	raw.githubusercontent.com
1	raw.githubusercontent.com
28	raw.githubusercontent.com
49	raw.githubusercontent.com
55	raw.githubusercontent.com
78	raw.githubusercontent.com

Detect suspicious telegram bot 11 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c582-30.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c583-90.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c586-125.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c583-131.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016b0e-188.dat	suspicious_telegram_bot
behavioral2/files/0x0007000000016b0f-222.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016b0e-256.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001a36b-290.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001a36c-323.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001a36b-358.dat	suspicious_telegram_bot
behavioral2/files/0x000500000001a36c-392.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2484	12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
2484	12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
2484	12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
2484	12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
2484	12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
2484	12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
2484	12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
2484	12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
3680	SecurityCore.exe
3680	SecurityCore.exe
2752	SecurityCore.exe
2752	SecurityCore.exe
3680	SecurityCore.exe
3680	SecurityCore.exe
3680	SecurityCore.exe
3680	SecurityCore.exe
3680	SecurityCore.exe
3680	SecurityCore.exe
3680	SecurityCore.exe
3680	SecurityCore.exe
2496	RuntimeBroker32.exe
2496	RuntimeBroker32.exe
1992	RuntimeBroker32.exe
1992	RuntimeBroker32.exe
1992	RuntimeBroker32.exe
1992	RuntimeBroker32.exe
2496	RuntimeBroker32.exe
2496	RuntimeBroker32.exe
2496	RuntimeBroker32.exe
2496	RuntimeBroker32.exe
2496	RuntimeBroker32.exe
2496	RuntimeBroker32.exe
1936	ServiceHost.exe
1936	ServiceHost.exe
1936	ServiceHost.exe
1936	ServiceHost.exe
5828	ServiceHost.exe
5828	ServiceHost.exe
5828	ServiceHost.exe
5828	ServiceHost.exe
5828	ServiceHost.exe
5828	ServiceHost.exe
5828	ServiceHost.exe
5828	ServiceHost.exe
2532	WindowsShell.exe
2532	WindowsShell.exe
2532	WindowsShell.exe
2532	WindowsShell.exe
1484	WindowsShell.exe
1484	WindowsShell.exe
1484	WindowsShell.exe
1484	WindowsShell.exe
1484	WindowsShell.exe
1484	WindowsShell.exe
1484	WindowsShell.exe
1484	WindowsShell.exe
1164	WindowsShell.exe
1164	WindowsShell.exe
1164	WindowsShell.exe
1164	WindowsShell.exe
4080	WindowsShell.exe
4080	WindowsShell.exe
4080	WindowsShell.exe
4080	WindowsShell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2752	2484	12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe	90
PID 3680 wrote to memory of 1992	3680	SecurityCore.exe	93
PID 2496 wrote to memory of 1936	2496	RuntimeBroker32.exe	95
PID 5828 wrote to memory of 2532	5828	ServiceHost.exe	100
PID 1484 wrote to memory of 1164	1484	WindowsShell.exe	101
PID 4080 wrote to memory of 4404	4080	WindowsShell.exe	104
PID 4712 wrote to memory of 5872	4712	WindowsHost.exe	109
PID 5940 wrote to memory of 4776	5940	UpdateService.exe	110
PID 5848 wrote to memory of 4068	5848	WindowsShell.exe	115
PID 4720 wrote to memory of 2540	4720	SystemTrayHelper.exe	117
PID 4328 wrote to memory of 2832	4328	UserSession.exe	119

C:\Users\Admin\AppData\Local\Temp\12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe
"C:\Users\Admin\AppData\Local\Temp\12daa53faf7bd14c08b9c6eb200073e34b82a60d0280dbfa970f4d76a06937f5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2752

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1992

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1936

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2532

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1164

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4404

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Temp\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5872

C:\Users\Admin\AppData\Local\Temp\UpdateService.exe
"C:\Users\Admin\AppData\Local\Temp\\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4776

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4068

C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2540

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2832

C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 281B
SHA256 9342b56792fbd95afc46c0c706076ca878d09131366179fd6ffadf18bdbc1e81
MD5 2b0c840d73c0899c377df15488a33a79
SHA1 b6911787173bc43babf1a0ae784370f31740cfb9
SHA512 68bd1cfb1db1c9ec6a70227a192290072ef0f4e22e9a972310b4038000a189534cb6043353288599b52c6a2c31ed7b1e01ed49d3215115081c52c554361ead57
TLSH
T15BD0EBC603FFA9E26D73EF7044E295213002B45236B0A920684CC02A0820D286F11000
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 37765ce9f198a9aae9d465643b2a44aa150bd915040e834ed087ba4a8b396025
MD5 7ce71344583e9e5c80d0005cc3c4d6ca
SHA1 59289a8e0235271e27fbf45b8c23fb41f8eb31a5
SHA512 73de71472041529e39f8b7d589870c865ea9791317620f1390e3600d970a92e737b4e540947b557ffdd7d4ee76e97a916db89861f4bf0475115c297c5926dddc
TLSH
T101E0E722971F56D97223DF1003E050777E11511F14A0170E3C19C7E34C4216DC90725A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 a5f79b5e802ae2e40f18437c728d16dbec70066c529aded8c355c0ab32f8b330
MD5 9a4569181ae408d392f00bfb26683198
SHA1 3c5b055814c1df0f84e903be782240d9cd982618
SHA512 0a6d00ff82cd54038a78f858dabb0eefae09b16fab8a50efd70d87a370b1f2744f465fb1239da6f6665817a4b705cd8aa9a5f8890e0743f77e5e2811a60c59d7
TLSH
T15A41A8DA3B5C7068BF83DF8495BDCF312E38F1E0A940615671FB8472248AFD0295685C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 156KB
SHA256 7c6d4ef8832db254b7fcfbeb7550efa0b087d0d0b330f58da3b30683d731d3d7
MD5 a39bc5b51ea4c26dc9563c672efc5845
SHA1 103507918d9a2eb9e6f2e8ebafe7239378bfe50a
SHA512 467e59229b07ab014adacd80067708454ac87b9179a0b24258f531e944a1863623e0a0ef071d1dd9e55e62019697724765e249a01ab778ea8db0a6254738ce89
SSDEEP 1536:hPnfhePrWUK3O/to/6wuuAWN0rtbjSXvYx2YCt4zKNRg5t/AmZIAqzxA+Dj2/mh0:9nwPrnK3ksgIC1gYCU8I/AmAVgeR3EO+
TLSH
T1EBF32DA89C3BBAA39D07CF524D9EF69612E591C52912732E3E347E505C13ABFDA13C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 7a484b164322ad9b84df778cff481f2782b7384dda0682e26cd5ce8855adcfe3
MD5 a2dabe6d378561dcc5d6d0fc622642d1
SHA1 a5e4992380866565bea027241cab5b9451d25ea1
SHA512 31bf6a631606147caa74557158c77a4c06a7554e547016b0a67ff10f522c956dc71f057616ce8672d75900e35bf172eaf269e90dd9dde7db3bfe94fee048372d
TLSH
T16D11E5C25EE8A09199E29670C7E4C5727C7570856DFA75D01891C8D2209A71D6F1903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 0261210d00c7b108569b4c2b06697f9e53b6af589da3e586efee1950778c332c
MD5 34c56844b007a26b5867450f741d7a83
SHA1 2faf627c0e1130eaf1dae6e56bc7ee4531fd4089
SHA512 412fb93b080e4622d0463e0afda7f017cb257ce213917e62a9d195c188dc124b9f71902146541ce3be81a5f38ccb97a09658d83247186f6963e9e9ce7af503d2
TLSH
T15641FCDF6B4DB4E8EE018F464DFCC83A1D39905592840C51767780D610DE7D07F5584C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 535f0ebbff147d2010538569779065e78b49fbd042dd3b68fb9a6b895b292ff4
MD5 880ca544b484502b91456209cf7ab1f1
SHA1 b5658797518dce2060c7b9adfdf007bb2dc0e237
SHA512 140e423b170fd3f88ad14d438daaf6436af26ee0447336194c517ef295a17a903c5ca492323f639133b0d0b5163f466aa25434fc33a6cf052332fbe9b23ced36
TLSH
T114F0AB30347C4119E473D879DBDA70AABC19F21A3C15ABAB26AB07097A4AD401CA253D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 bc58ee025d33923ec206644d7e674ec6edeb12969c03a67afd985b3bcb90995b
MD5 ab99ea7cff9398422fb8c05aae88f422
SHA1 234250c0dfe887d832593c3981190e4e54749109
SHA512 415274542650e5745fa1b1ac42f6971de5e2618ae920e1b0d4f3999df5513f3aa2d9a9e7db3750fbf0589c3c979887c48ac9c6ffe0b84a73a0a6f5c13508c395
TLSH
T17CC08C2C1AA21A06FAA843BC02C17D439B208141E2418F051AF62A08D997B1A2978C6A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 fc0fb1f04d4d86d76505cc2d4f2aedcaff93421fd91a8f5abb70a293db369249
MD5 a631e9ac5c2af9ffb417f3be03eeb5e5
SHA1 6d504a5bb6652b96894d7afe9cb927680c1e4a06
SHA512 b00a7414ed68e6eb3a09742f13fe65e81b02288c82b6948ddcb1b4e0b27b1f4151777c76007a2bc38e3edb02660c4dd18b7c63de28924e817ca878b1e5770451
TLSH
T179F05C2C27FC412DE072EA758FDAA3919816F126285445AA0ED2464CA502E01AC8117C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 6ce6c3fe6fb7f3094e0d3757b42d91e8ce7dc312870b2903b279e7918183be92
MD5 c8316ebabb45bdb5178b3e095080715b
SHA1 caccf0d49c7950c28099c1b6ae613a3a64611f67
SHA512 90c462ce589d59b597e1e166dfd836b1dcdc01b075a413607d5c06fd71765cc11a6f0f104456872e2c2c7a2d4e32f0d2d18806e6e644727506f8c766aabefa3a
TLSH
T166F061143EFE517FF011A57587D7F2714D26E30A64072679357113442F16F11BC11919
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 cafeaf2ac336af638a9c0365550e82d4ac68666adfc0d1f5c3d1bd7ccfc23fed
MD5 0e845a44cbd97ed4b876aa8f811d88c7
SHA1 eb05e9d9ccedfbe8d6c288ff8c2c23842833213b
SHA512 b98f02e0f513c2adb876cb4c33dc617e066c9016da2df6ddadbb0941ed1c002b385b3dd8b7a5ba615215f4a50f5ff2bf3d19ba72a4bc88b68c1be3b01e615efe
TLSH
T19AD0231C27D11127FA648B3A546749D0FF14551574521B550FF3044D541DF112D91C0F
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 0540b35685c30c31615d5f128e1226f43ddd2e9d0dd4addfc483e9c595acbe93
MD5 0705b0609b965dd46fbdaf391f8b949e
SHA1 10c6d07913a59cd70d50b5202ce125ee8c6f5e26
SHA512 49a2b10ca5484c252dd1b18c7c8dd70dfa33c31e286493e971f3a0c50dfd1ad22dcd8e1bb40e286637af1ff5a29554a591e1d6657f2edd519e13bb0504ebba5c
TLSH
T10DF05C240BD2502EE6366B7649F553E9DA0BF2123405C09925D74609EA47E403D1153C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 7901f776167e81d256cedb4471074ef78db9f1c824453d3f05f49043e39141af
MD5 adf4acebe3104e605944108515379bb1
SHA1 bab869c217087145001beb00394d667a20151998
SHA512 ee652cac8f5e7ec9569540ccad4c3602e17c15eff5d5716df343e6c07331bb09854df366e967f66d0576d7acdd50a1922a90e9a68cda61178c2d25e903dee8eb
TLSH
T1FAF0AB3924FB000EF673DABC02E056CF5923F2373508266E29B243096E4AE40AA70A25
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 3e0ceae356ec61dabbe6d4620dd07908f09b8ff949e7e75ebd2737fefcc721a5
MD5 a33ba63a3dbb73a4849f897c7dd40df0
SHA1 e629da0284b455e302642c7ec82a77e3facb9772
SHA512 dddbff12d5422839f135264827362e38b387a80329edf5820ea7e083f342ec2c2fb02d17749eee383a45b2f668aa58582ff212f0024daca300b9891263b0c74f
TLSH
T11FC08C1C0A610607FAE893BC02C26E838B208210F3919F0126B62A08DD24F122878C29
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
Size 6.5MB
SHA256 ca6e43f05b56dbf0edfedf08118700f49789d7750c5dec2a1487c841e2632021
MD5 b1f262d2088b618c91e397e00c672c94
SHA1 5c69d9287c5046a5a22bf1202d98d4855865aada
SHA512 9b4ebefbb37368084104741f543df40fea829cb2048500edced5721d62aadb67670afce9f056a99fac62de39ddf399f3b7177ee112a03923a9c9522dab3dca82
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgnx8kpOQfuz7:TDpbgBr/4QAMQBK2W
TLSH
T1546623D67C9E6AABC10A1C7A8E06CE2235BC57B1C7544D93FFC93EB64C10D921732962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe
Size 5.8MB
SHA256 817f812d5e16ac00021f993263f796b1821746df170eb833101a557e6313b2d9
MD5 3be99990f4328470a8ac828dbb27dc11
SHA1 d1bca0be85e1479a4ef53c6a46de85c61c36a12a
SHA512 84d6ec7da3c6488bacf7ab6f1de2311cc4f223264a6df78e9b927890af6f97b9e3df932147cffaa36ddccd8ab23108f7949dcf545b05f45ca9081f8307800d5f
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRncXImFomgZ/B9:+0s420bTjzGlBrJTJb8QAMQCgnx8kp
TLSH
T16E5623E67C5E6ABBC10A1C7A8E46CE2235AC57B1C7544DD3FFC53EB64810D931722922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
Size 6.9MB
SHA256 fdb4ed161a6107ac1e69d234644c58f087a885c1c59382689bfa078aed618456
MD5 5735ef1901ef96b77935f3dae926c964
SHA1 bd7083fc50d38f0222f8e3522aabdd9f69c92c91
SHA512 0122abf014d044d5c2c1cb38b2ef691fe04409ee03a4d6b7b53c758108b7b3dd44620665eb97ab4369af864664051aae34f89470d9ea2597a6a8953b40c2a9f4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgnx8kpOQfuzH:TDpbgBr/4QAMQBK2K
TLSH
T1427633D67C9E6ABBC10A1C7A8E16CE2275AC07B1C7544DD3FFC92EB64C10D921732962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
Size 6.7MB
SHA256 d9180a7de1cc23b93dc9af48b6a3484188cc528a83e5440fea48222e4492c41a
MD5 46a24b78d627416da6641602a1cc0036
SHA1 f5df54eb73977118e31f6693cd09d0db1a470415
SHA512 bcd5437a6cbca1c444a9fa0c60addc32af4eb746d6a96806ad04f1d4767006cf080dae9a4d887582b89f4166c4c2f6b61e4d21c461b1495a9e151d250bd05b4f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgnx8kpOQfuzL:TDpbgBr/4QAMQBK2M
TLSH
T14B6623D67C9E6AABC10A1C7A8E06CE2275BC07B1C7544DD3FFC92EB64C10D921732962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Temp\UpdateService.exe
Size 6.4MB
SHA256 cafed1776ab185b2d8528bbed0cb62942c8c95dc59507f684d7169adc2ce8bba
MD5 6dae9b0030060d166456980fb54c1411
SHA1 67bbeb35058ddcf59c5352a854ab9d3160fc857f
SHA512 4c63580a9100342e1b6384e33f7b5f885e2ace68d22f32b288091699cfafda61e6312a3c2b71380ca5ff43802a2823fb9fcbe48d9b6618e18eef3634494765e4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgnx8kpOQY:TDpbgBr/4QAMQBKL
TLSH
T19E6623D67C9E7AABC10A1C7A8E06CE2235AC57F1C7544D93FFC93EB64810D921732962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
Size 6.2MB
SHA256 6e2d31106bbe35a1743ef34c31b2b7d3e48d18a89cfc9a837a256a2110964617
MD5 566bb18cc2581ab67322c52040922f50
SHA1 9a775500f9829df620f03201c2ea33b6cb7b0786
SHA512 53f9055880d345ab4f6bed058d5ef4292b18e559be7a090acf697b6a9f2af1efefe0a885391caa35545abc2ad45d11298e72d99b6fc60bb29e6ee94860775781
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgnx8kpOQC:TDpbgBr/4QAMQBKV
TLSH
T1286623E67C9E69ABC10A1C7A8E16CE2235BC57F1C7544DD3FFC93EB64810C921722962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
Size 5.9MB
SHA256 19a9d0282f2c0b3756555afaf8beda67917ab25e2c35ff62e4953d8849315afa
MD5 8ba6bc924618b1adfe709f84ee10f210
SHA1 c8e3e0b2e699df6a809f90a84ef72b86defdf302
SHA512 49c77b1ee70fdb85f5ef566a20f601878afbffcc3706be5a2590d7959c4937c53234e8c2069c5ffe21b5df4945722636bb551b92c4f3f72faa8fb3f13f9f3d3e
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRncXImFomgZ/BM:+0s420bTjzGlBrJTJb8QAMQCgnx8k4
TLSH
T14D5623E67C5E69ABC10A1C7A8E06CE2235BC57B187544DD3FFC93EB64810D921732A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
Size 6.1MB
SHA256 980c0100fdf570059b660ac4e927525909fafe0ed45bb9d68bf81367e0d6f58d
MD5 36d7d863ad7d9ca3267db3560285126b
SHA1 bddfc23449411d62b4358342ecc5f0ec6d3f3f1d
SHA512 39d8823be198a0194dd86c7620cac6035165591a46ee77161a909b8f724b01a61240093b7d91ad2a663cccac221d84cf787a67c3badc45b01d0091942856b2b2
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRncXImFomgZ/BlQDQ:+0s420bTjzGlBrJTJb8QAMQCgnx8kpOQ
TLSH
T16B5623E67C5E69ABC10A1C7A8E06CE2235BC57B1C7544DD3FFC93EB64810D921732A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
Size 6.0MB
SHA256 5adbfb174826efec7696279bbe7e7fef640bc1dc360d92abcf86ba3cecc7d517
MD5 839a9c528014b968bab77057e877093b
SHA1 505a37bd96d424d17834f022806e1d107053564b
SHA512 953de8764b1ac39f2e4906834779aa81b6341c7e2c573e34d3e21464e7b18bd23d35140a7cbed56280bf54e23c15c071e6830f26c3d97636591015579a1fb3cb
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRncXImFomgZ/Bl/:+0s420bTjzGlBrJTJb8QAMQCgnx8kp/
TLSH
T1125623E67C9E69ABC10A1C7A8E16CE2235BC47F187544DD3FFC93EB64810D921732962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
Size 6.8MB
SHA256 8e922a3a349e98c288bd40c9e57ef550300cb086ba20106428a90c5e65d4a7df
MD5 49a8fab5a19c0985ba00b394baeb0471
SHA1 0011c5a18192c6a670891fc6024a56b602c2c2fc
SHA512 e2187701e38214eb8d17f8150a1932d96b614e24f259a9a7e10729b85a3b6c6b291e9248b6ef1212f2697598698ce01bbc8edaf00e824ec06d6d87cc92709f86
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgnx8kpOQfuzP:TDpbgBr/4QAMQBK20
TLSH
T1ED6633D67C9E6AABC10A1C7A8E46CE2235BC07B1C7545DD3FFC92EB64C10D921732962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
Size 6.3MB
SHA256 eb046c217a404ad54f1e8a72e6c5179a9508e3d5b569f886e6cf9d4e37303a70
MD5 cc07971fd95f9f6e6b9c81f781f301ac
SHA1 a0de5785190fe01a2672fcc89838e5f7a50c5e96
SHA512 2be0cf384f4a93c730ad9132f41d88842f2703c7f3be4b556692ba3b9ad973a3317cf3e0b954ca8f98262a82ec117401415b0634791c876fc0514cdfb6310c6a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgnx8kpOQ4:TDpbgBr/4QAMQBK7
TLSH
T1E86623E67C9E69BBC10A1C7A8A06CE6235BC57F1C7544D93FFC93EB64810C921732962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download