e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
Size 10.3MB
Sample260910-ydt1vsverd
SHA256 e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd
MD5 2fc9b33046bbe1dda165d643e5822433
SHA1 d0f20f426fd626eb450056444ca37fd257ea0f56
SHA512 4b504cc954021a1eebb471994ce8c1961e3d42e5c06e6489d82595b07fc814c239400c3084322ede9106bfeb88244726ef73708fda51210a44e7d4b6cfc713e7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6d:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLfS
TLSH
T169B633E67D5F2ABBC10D1C798D16CD2239AC57B1CB545CA3EFD53EB60840C532B22A62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	DesktopWindowManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	WindowsHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	BackgroundTask.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	UpdateService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	ServiceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SecurityCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	UserSession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	RuntimeBroker32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	UpdateService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	UserSession.exe

Executes dropped EXE 22 IoCs

pid	Process
2384	WindowsHost.exe
3192	WindowsHost.exe
3648	SecurityCore.exe
3356	SecurityCore.exe
2400	UserSession.exe
2768	UserSession.exe
1300	RuntimeBroker32.exe
5052	RuntimeBroker32.exe
116	UpdateService.exe
1872	UpdateService.exe
1348	BackgroundTask.exe
3344	BackgroundTask.exe
2584	UpdateService.exe
4900	UpdateService.exe
396	UserSession.exe
3500	UserSession.exe
3220	DesktopWindowManager.exe
3420	DesktopWindowManager.exe
1044	ServiceHost.exe
4716	ServiceHost.exe
1960	SystemTrayHelper.exe
4092	SystemTrayHelper.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\RuntimeBroker32.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\BackgroundTask.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UpdateService.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\UserSession.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ServiceHost.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsHost.exe\""	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UpdateService.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UpdateService.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\DesktopWindowManager.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\SystemTrayHelper.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SecurityCore.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UserSession.exe\""	SecurityCore.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
121	raw.githubusercontent.com
126	raw.githubusercontent.com
136	raw.githubusercontent.com
149	raw.githubusercontent.com
38	raw.githubusercontent.com
65	raw.githubusercontent.com
105	raw.githubusercontent.com
161	raw.githubusercontent.com
37	raw.githubusercontent.com
78	raw.githubusercontent.com
92	raw.githubusercontent.com
110	raw.githubusercontent.com

Detect suspicious telegram bot 11 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x0007000000024525-12.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024532-74.dat	suspicious_telegram_bot
behavioral1/files/0x0008000000024547-130.dat	suspicious_telegram_bot
behavioral1/files/0x0008000000024549-175.dat	suspicious_telegram_bot
behavioral1/files/0x0003000000000723-206.dat	suspicious_telegram_bot
behavioral1/files/0x0003000000000727-241.dat	suspicious_telegram_bot
behavioral1/files/0x0004000000000723-277.dat	suspicious_telegram_bot
behavioral1/files/0x0004000000000727-312.dat	suspicious_telegram_bot
behavioral1/files/0x0006000000000729-347.dat	suspicious_telegram_bot
behavioral1/files/0x0005000000000727-378.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000000729-413.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SecurityCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UserSession.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UpdateService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	BackgroundTask.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UpdateService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	DesktopWindowManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	RuntimeBroker32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UserSession.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2120	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
2120	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
2120	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
2120	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
2120	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
2120	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
2120	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
2120	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
2384	WindowsHost.exe
2384	WindowsHost.exe
2384	WindowsHost.exe
2384	WindowsHost.exe
2384	WindowsHost.exe
2384	WindowsHost.exe
2384	WindowsHost.exe
2384	WindowsHost.exe
2384	WindowsHost.exe
2384	WindowsHost.exe
3648	SecurityCore.exe
3648	SecurityCore.exe
3648	SecurityCore.exe
3648	SecurityCore.exe
3356	SecurityCore.exe
3356	SecurityCore.exe
3356	SecurityCore.exe
3356	SecurityCore.exe
3356	SecurityCore.exe
3356	SecurityCore.exe
3356	SecurityCore.exe
3356	SecurityCore.exe
3356	SecurityCore.exe
3356	SecurityCore.exe
2768	UserSession.exe
2768	UserSession.exe
2768	UserSession.exe
2768	UserSession.exe
2768	UserSession.exe
2768	UserSession.exe
2768	UserSession.exe
2768	UserSession.exe
1300	RuntimeBroker32.exe
1300	RuntimeBroker32.exe
1300	RuntimeBroker32.exe
1300	RuntimeBroker32.exe
5052	RuntimeBroker32.exe
5052	RuntimeBroker32.exe
5052	RuntimeBroker32.exe
5052	RuntimeBroker32.exe
5052	RuntimeBroker32.exe
5052	RuntimeBroker32.exe
5052	RuntimeBroker32.exe
5052	RuntimeBroker32.exe
1872	UpdateService.exe
1872	UpdateService.exe
116	UpdateService.exe
116	UpdateService.exe
116	UpdateService.exe
116	UpdateService.exe
116	UpdateService.exe
116	UpdateService.exe
116	UpdateService.exe
116	UpdateService.exe
3344	BackgroundTask.exe
3344	BackgroundTask.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3192	2120	e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe	93
PID 2384 wrote to memory of 3648	2384	WindowsHost.exe	95
PID 3356 wrote to memory of 2400	3356	SecurityCore.exe	100
PID 2768 wrote to memory of 1300	2768	UserSession.exe	103
PID 5052 wrote to memory of 1872	5052	RuntimeBroker32.exe	108
PID 116 wrote to memory of 1348	116	UpdateService.exe	109
PID 3344 wrote to memory of 2584	3344	BackgroundTask.exe	112
PID 4900 wrote to memory of 396	4900	UpdateService.exe	115
PID 3500 wrote to memory of 3220	3500	UserSession.exe	118
PID 3420 wrote to memory of 4716	3420	DesktopWindowManager.exe	123
PID 1044 wrote to memory of 1960	1044	ServiceHost.exe	125

C:\Users\Admin\AppData\Local\Temp\e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe
"C:\Users\Admin\AppData\Local\Temp\e2542a7092dfc18a9d461ceefe053e64195d9dfc41ce1893f0a479e9dfd79cfd.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3192

C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3648

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2400

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1300

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1348

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2584

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:396

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3220

C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\DesktopWindowManager.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4716

C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Temp\\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1960

C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 6ac45142693bd1c458512e3b8def1881e3fe3a81b85425044c0f460d67eac362
MD5 c10ea189c98d33ce0e871d19b27d2ee8
SHA1 b8e07c52568b0b8ac43d24df87ce133dedc95e96
SHA512 fa95426053eb82e9c3468f3bdf385197b306b22556ae80e4d255de3a1b6c7ded2b605a67dbac0f9295cd922e395aa2e0e0401d4057b15eaa1d26aec4d3524e3e
TLSH
T1B4E07D0E572CC3C3BD164C1026E5857A3AF270AF44D2150E643517C9CD42137C847049
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 407466a7bf7a775973c4c9f5277feec33d64debdc13b130e25446b9b5af3893d
MD5 415bc882f76a7b3e971dc0f091c9e07c
SHA1 37e4314fdbdd38a097d7371dbcd9f06f0becbbcf
SHA512 2ed928ae36c0e8cf7573c495786e80c6025f58a0972de548bc11eca029059e6c8bf7f7bf498e5cfbddaf40626fccbbd859d43a65e18b3a059b1ca0c59fa4a28e
TLSH
T16041A9DA2E187422AF814F805874CB353D7CF1D49988505974FA84E36495BA46D1A85D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 0e88a5f0db492c6d183a9c530238a34b60ddf8e643d59bb067a8bed73f3b04d7
MD5 ca45821f82f18cbccb347fd3d2edbdd0
SHA1 3c0bbcc22bc271a84cee8414221d42d021d221e3
SHA512 85a9f6c20f07e9bb0ba9aeaad0ed6dde142cc456dd82f56db61ea2b8b1f6ac821d6921fd59aef0530ac8cb3ac1ce2ba85a4108c3780fc861e81c4090bd7a1425
TLSH
T13ED0951715F6C9553B53DD044DD0D170B423AEB773D36C1AA48FD0D65800D2D3F0A215
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 177KB
SHA256 7d0f6df5f36e062a516cedcbfd4ef40616adcd767ec1d8b14ef85961122408d2
MD5 1a266210e74b768c7c5f1e87c3c04556
SHA1 947e95122d39b61d8fe7f803fd9c4114a1a41978
SHA512 bb11fb4b14ca0ced323712922f53d748347141fa1c80f76edd0417413b6deaa11bedd3e34722f29e10460e86a6db615830c8d5bfce0f088c3194ae9f805b0a97
SSDEEP 3072:MHlcm9KPx74X/pCh8ycyMGBeDvu6tizLF:u+AEx7I/fcrBeiqa5
TLSH
T105043C645C7BB6A35D4BCE524CAEF69612F591D92812732ABE347E005C13ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 d47f36305c57a449d1209353c65cf916990d10c10bbb8dce40387ad034ead9fe
MD5 da2321ede03f4a5aa95d46060ca64ab0
SHA1 426f6b6524e6e41e03b9d2897076c8d0a2fdfa43
SHA512 d30bc6ed1e2abf680fcd8a7902f8e931ba1b7c64f3d794e9ea55fdbad2282ee766386816ce8dd0cd5782526e61b61d5eb17817d8affbb31ba58a43724ef579dd
TLSH
T18B1125C35FB5E19045F65765C6E4D5313D78708638E938C15C939842245772C670943F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 05f55cd741ebf04fa6143cc1279f95b44c856f1efbd611312ea2cd1793a0b673
MD5 c2f9f75d444f05b448f600f9f498972f
SHA1 73efed1f442da35a14c31316406bbd1dbc14b9fe
SHA512 533226cb07ebc8d0f7ca310bd09c478deb65bc93d0dd6a1806c03d2a1bb475c31baffab1ca3a7980feb230b7d67a6905441efed6fb02e8d99439a878da91ddfc
TLSH
T15141E7EB6B1A3968BF469F866E79CD355C38D4B981800885B9A3C4DA10CE7C16E0698C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 8ac29c2c5e46a1ae288fef145a61467da33739881dacbdd3c63add46989ec696
MD5 148f7019c2b93fe5668c0c7a76342c4d
SHA1 2d827b086a693c2a96090ffdfd08d9ae95b81145
SHA512 32df5f5735043933a06b8e4fbc52d5548dfa50acd55f2212c1f3b95f230b283f34b230825c1e94c3fceb5b0e2466746735f1f06906da31604fa32b9160570385
TLSH
T1FEC0801C19514E15F1A4437C01C13A0397518141E2418F1516F12604C956B152834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 18870a4866ad05abc1a8ee4ec521e601ca8c8dd85cb06d9a9dc58f68086163ba
MD5 ac85474d4e6fec9560162476736d0186
SHA1 c5fb7ecd3b93820f3721dc432d595321d1bf4a17
SHA512 4890a5cceebd6554b95594773a2c9eacac138c882a78ce2a81b0036f01ac5f6d609ee9a09229c11de32bbf0d855dc78dab7629e0d6c131d7c820a4866326f5b6
TLSH
T14BF05C2C1AFC911CE476DAB98EE5E6E65C16F227280805E90A914B099A02F441C5043C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 8dcb8b3e370ea338bdb46b31228269c97c794266077a9c7ffa2c0c61a3a7eabe
MD5 c65e0371616b66c6abb16f2c13c05207
SHA1 18576ec8614bef82f33a7fcec80ec8d38a423cd9
SHA512 635be28ce8ffd586bbea720bfc871af49e8ccd142c04e13f50b2ad306c4933bd5f6ec741538f9e4874a0957e8173dd61bad2b9fb60c0888638ace2654b72e63e
TLSH
T186F0686039FB943BF433AABB43C571B1096AE30674026BB61B7023042F24F206DC3512
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 b6567ef0f60e8761bf78d0d3940ab4e5f8a7ea316dc9792d1e51397c3ca2521b
MD5 76a7a8a6c12e6df5039fb3ca745e1b71
SHA1 f04faba38fc312c536dcd7cb2110fed68ba47d94
SHA512 429ff8099bcd8369b10569815d590618618b32119245040877907e4f21dca5669ab96dfeb17afa13970d7826dad577442b9ee3d4f6d406ba26df920b023f7f6e
TLSH
T152F05C0C15B8800FE0B1E874D2D425F5AC35F209680482E707D611455A07F103E129BA
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 df2bcf7fafa06c85818d26f661748855ac5f6de1f46f444edf3b6fa4dc9cf17c
MD5 31577fa9dcd41cb78823d0ad91bdb60f
SHA1 2853843204dc876947d7a6dbd9a8e348e21c21a5
SHA512 9e1311dabdf50a7a43d171abaff4d7e2ae03aa60ead9a21bf1daae6d11b08f7e32009dfe986a31b6527b180012535c8d37a04b6ed345e3511efe9335e12a7ed1
TLSH
T13CD0223C3399071DF0B0423846A245C27FA21882B9C1976D0BB3130C442EC820EE1C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 3555a4e90358c1e5e2987f521e9daae0e9108d094d26d1ec323d4fdad6c98c3a
MD5 cc7da9d2166fee08fd781f196c98857e
SHA1 369c94dd6caf6ec982d101bccdbf4bbe92a4a031
SHA512 9a348838f094fc4a60098d077db1fd22abee06c036ac3eb64841c511d9b24034602722a717148b5cde0a06eff52f9545debcbb1368fff784e42da79f8ab105e8
TLSH
T186F0AB281AEB415EE23267794AF553EBA826F3523408C5651AE91309EF43F406E12434
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 0c6abdda58656973a44598841305e0c41b7cfb9a66f55e8a348f6c9e8b7ae3ef
MD5 f04142f8df5311857e6cd29406f3a0ce
SHA1 8a354b628c30cce747b8217f8b2129be8f7ee9f5
SHA512 8f91835b6659ff0ae4206be27cbe3c97bd1c0f6492772e9ad1cd7954669a00a135633048d623db4c9367d243cd54a20d7f3750a928e693467535f250e2de3bbd
TLSH
T1B2F0AB3531F7110FF212CBB802E052D48A73F57731082ABC7BB002095D01F40BEA2925
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 02adc5d67c9910d667c04e1b472332a9702fe96873dc486fba6302109c0d87f5
MD5 66db92c7dc0fb6d1559dea4761652aa1
SHA1 9dfb61f75f2c8add7bd4800b9fac314628917b4d
SHA512 d1f64cd427861a2244eb6a20281cc5e5d361733879b674fc574b48ab74d3387cdf8bcc29d3ed43adb3516e19dac1212e4c728b5ada4b619e9e44dc72a0dbc8ff
TLSH
T11BC08C1C16A10606F2A893B822C329838A208511F3829F1126B12A09CE25F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe
Size 10.7MB
SHA256 bde74d08b5228f417e0f302486b78c11403d722e04445e2a26738f326cdc246a
MD5 b5aa3d9229263de3650de19f54809cb8
SHA1 42a7238ad6bf8fb207300e78eb7c251e41d09df7
SHA512 b6f33644cfaf1bb2b2ecef2c57b545736bd93b699ba0b118ec2494bf3ee3436633d9eaa6a7e08372bc9ab61cc8c15fe3747b0f81ed866f282821f04c5b83c701
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6+3:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLfl
TLSH
T102B633E67D5F2AB7C10D1CB98D168D2239AC57B1CB549CA3EFD53DB60C40C532B22A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
Size 11.3MB
SHA256 b1276e4ae725b5d50c90ae4b058db32574fda734fc973e841d02ad4725ef3a54
MD5 17fbd50695e7ccaaef62ebdfab15ebf6
SHA1 759edb7ccbe8b3f3dd73eee64ffca7fc773a07df
SHA512 aff2661b1646ab98fa0bd0b730bb882c3a2c1992f2dc4183eddb93197c1f12f2c758973d8d3179bca2653e78e04c3ed37cf7f5b25fa0622dc79998fd1707ddc5
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6+G:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLf4
TLSH
T1A4C633E67D5F2AB7C20D1CB98E56CD2239AC57B1CB549CA3EFD13DB60C00C522B22965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
Size 11.4MB
SHA256 f3d5d4208cafe899591b3a97d2d213c8753e8ba62e03b8e7875b84114af6fdc6
MD5 2328516fa6705c7b399e1985aa101702
SHA1 251d80ebf89160c41df161c946b6198593a2b610
SHA512 7367050f6d0e808fe73efae4a93c67b5d691412e2bb8a4601c69e8a5d65dd9c5df100bc71e8e2666137deef75dd872c3812d1f763c0f2b26dd8d0390f4abb216
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6+S:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLfY
TLSH
T117C633E67D5F2AB7C20D1DB98D568D2239AC57B1CB549CA3EFC13DB60C00C532B22966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
Size 11.5MB
SHA256 afc990f718e39d3b84854b5ddc0e6032982cc5ecf8eeae61d10162686cf63212
MD5 6f5d9585b25ed63a0c052f016ccf3f29
SHA1 da3462bf1291abf39ff663e95fc45b0cb358777a
SHA512 e1e48ed8e0088ccf2322223badf6e50b25c5ae607a38046c009842c495ee690123205f664e720734b291ed32451025e2e829b759cf9225615bf38e9d3f596e86
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6++:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLfY
TLSH
T15FC633E67C5F26B7C20D1DB98E568D2239AC57B1CB549CA3EFC53DB60C00C532B22966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
Size 10.4MB
SHA256 2484dec1197b96c6046260ccf5e71396f1ec83fb99dfad4eb22e2174f9032f3a
MD5 239efe8ac746a1358a9bcd8662001239
SHA1 c8d7e615e7250a07a4046591973a741f9070c5e5
SHA512 ff8bf80710167cd7f850ab65a5852f53afff4532c1ff24f971b5e2f177725e05d7cd87198868daf9a7cab48de76901ec8401cd6aff1cba38b3529f1d089aa53f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6p:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLfa
TLSH
T108B633E6795F2AB7C10D1C798D16CD223AAC57B1CB549CA3EFD53DB20C40C532B22A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
Size 10.5MB
SHA256 3e8cbf86534709fd3ea05f63d6be7c174892e48ed57c89099e25bdadda288901
MD5 853f4b85babb0a55e119e4ea1dfa3709
SHA1 742467dd15e1be085d11318eb7ba6e7995466a6c
SHA512 43afa4f38b602e916cb7bb180426d714d3db06b4188da0bc5435c6c35bec7e9ed351e9daee1dfa688ae7591754bc137bc27be27eb2ed31ae70765f8cb709fa38
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6+L:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLfV
TLSH
T181B633E67D5F2AB7C10D1CB98D16CD2239AC57B1CB549CA3EFD53DB60C00C522B22A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
Size 11.0MB
SHA256 3c9dc552c58b1b9716dfacf304c6944ba8a9c12bd74041110ddf0ddcb4026a18
MD5 6248da03fac41d3394ccdbabdfdad738
SHA1 36a8bd58d65e6c4dc91a043fa951b7f21245fa74
SHA512 774b769a799f2d8da144ea1b8157a53e53c6dd83fdd5ab7666f4809286f813c2fa40462d3551c72cbd52a6ffb5ed7736b97be5eb249b27dc55581a91db3f6cca
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6+L:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLfh
TLSH
T1D1C633E67D5F2AB7C20D1CB98D56CD2239AC57B1CB549CA3EFD53DB20C00C522B22966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
Size 11.2MB
SHA256 140156f5813368a3dd3652418fda8b94d055bc6fb13423b4033764c787bb6026
MD5 f1d7b4abf05e048a9487e6f5b8e7a4ca
SHA1 45b5cb9e533cf231c692d99c540d38c83e18849d
SHA512 a1f1afdb376d52782de64ea2fceb7e8b2cdce2dfaaf03209451ebf3f0f44e840bdacc0698aa93b7b2f0cd88175ab9e6d51c350f24f6dc63ba9c23b46c490e600
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6+9:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLfn
TLSH
T119C633E67D5F2AB7C20D1CB98E56CD2239AC57B1CB545CA3EFC53DB60C00C522B22966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
Size 11.1MB
SHA256 2b3387aff3776f042a1dbc68d05e1758023da47e2f9399ccfd6ee043434d52b9
MD5 8d5dcb3b46c1c827b09b06831b6fae44
SHA1 a01c2ef4ad00e6cfac0d9ca7b44f5709e9daae6a
SHA512 860b4ac5c2c68d086da949a0256677fe32872bc926d3d7024920e420211902dc3a294ff1adb050e0988dd0bd6c85c14059260fadcd861af0e3134761e9b031cb
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6+y:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLfI
TLSH
T1AFC633E67D5F2AB7C20D1CB98D46CD2239AC57B1CB545CA3EFC53EB60C40C522B22966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
Size 10.6MB
SHA256 25411f5b8a1e892c4efc73ab2c9d3dc668aec77e60635208ba8b150c534b2990
MD5 57f9dbb9fb3e27154e71e22fdf6a06b9
SHA1 6d3839163ddfe697b37790e56ef37dd7029b47d6
SHA512 7bbadddcbafd6085877972696ae7d9542ea375f652131bad8a5419162dd9b43b87ff6d75fa76fb2f8befa14b20cf0343bc2db6a436cf88356977719c79783dc7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6+q:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLfQ
TLSH
T1DBB633E67D5F2AB7C10D1CB98D56CD2239AC57B1CB549CA3EFD53DB20C00C522B22A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
Size 10.9MB
SHA256 6ba36bf1ee410e943450ddf9e4d8a93cbf716558f9979758f7c9dc0d427c2616
MD5 c535d0eb766fe920708a457237251436
SHA1 4d13be0cc5ac1d4ab08d160712b04d6efe8ae361
SHA512 4ddf07c3229ea55f0009473afca399a73a452698ace8d14be2df0d3205697f630d5b06eea9fdba2a2431ed7f9a9f886c4a7a467eeb9084a8b718157948748157
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcLFVVT6+z:TDpbgBr/4QAMQMrEGRHsww7Q8ReecLfB
TLSH
T1C5B633E67D5F2AB7C20D1CB98D568D2239AC57B1CB549CA3EFD53DB20C40C522B22972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download