302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
Size 12.1MB
Sample260925-scelwsydme
SHA256 302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf
MD5 21cdd2e386c8f28927f23eebacc73f78
SHA1 2cc880696c96827529e2c3941f091abd8bdf1bee
SHA512 b196cccb9dc63a0249631e15ce8dba1cb501150db91afac11185dfe7d49b089c6aaafbd9f635b870b576d397ba5c01ea3e7b3353ab738ed790bc86474365fb75
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlZv4O4KXrxUtc:4JwMrcMGTdBae
TLSH
T15DD633EA745E6A7BC20D0CB98E0A8E7275AC5BB1C7144DE6FFD57DB24840C921623D32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2476	WindowsShell.exe

Executes dropped EXE 17 IoCs

pid	Process
2476	WindowsShell.exe
5948	WindowsShell.exe
2980	ServiceHost.exe
2124	ServiceHost.exe
1704	WindowsShell.exe
1352	WindowsShell.exe
3516	NetworkHelper.exe
1656	NetworkHelper.exe
2088	BackgroundTask.exe
1252	BackgroundTask.exe
5904	UpdateService.exe
3444	UpdateService.exe
5824	WindowsInternal.exe
904	WindowsInternal.exe
3276	ServiceHost.exe
2012	ServiceHost.exe
2892	ServiceHost.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsShell.exe\""	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\NetworkHelper.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsInternal.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\ServiceHost.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\UpdateService.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ServiceHost.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\ServiceHost.exe\""	ServiceHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
40	raw.githubusercontent.com
59	raw.githubusercontent.com
105	raw.githubusercontent.com
114	raw.githubusercontent.com
27	raw.githubusercontent.com
52	raw.githubusercontent.com
74	raw.githubusercontent.com
80	raw.githubusercontent.com
92	raw.githubusercontent.com
100	raw.githubusercontent.com
4	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c59a-28.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c59d-103.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c59f-139.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5a0-172.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c59f-207.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c5a1-241.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5a2-275.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c5a1-309.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c5a2-343.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2884	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
2884	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
2884	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
2884	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
2884	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
2884	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
2884	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
2884	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
2476	WindowsShell.exe
2476	WindowsShell.exe
2476	WindowsShell.exe
2476	WindowsShell.exe
2476	WindowsShell.exe
2476	WindowsShell.exe
2476	WindowsShell.exe
2476	WindowsShell.exe
2476	WindowsShell.exe
2476	WindowsShell.exe
2980	ServiceHost.exe
2980	ServiceHost.exe
2980	ServiceHost.exe
2980	ServiceHost.exe
2124	ServiceHost.exe
2124	ServiceHost.exe
2124	ServiceHost.exe
2124	ServiceHost.exe
2124	ServiceHost.exe
2124	ServiceHost.exe
2124	ServiceHost.exe
2124	ServiceHost.exe
1704	WindowsShell.exe
1704	WindowsShell.exe
1704	WindowsShell.exe
1704	WindowsShell.exe
1352	WindowsShell.exe
1352	WindowsShell.exe
1352	WindowsShell.exe
1352	WindowsShell.exe
1352	WindowsShell.exe
1352	WindowsShell.exe
1352	WindowsShell.exe
1352	WindowsShell.exe
3516	NetworkHelper.exe
3516	NetworkHelper.exe
3516	NetworkHelper.exe
3516	NetworkHelper.exe
1656	NetworkHelper.exe
1656	NetworkHelper.exe
1656	NetworkHelper.exe
1656	NetworkHelper.exe
1656	NetworkHelper.exe
1656	NetworkHelper.exe
1656	NetworkHelper.exe
1656	NetworkHelper.exe
2088	BackgroundTask.exe
2088	BackgroundTask.exe
2088	BackgroundTask.exe
2088	BackgroundTask.exe
1252	BackgroundTask.exe
1252	BackgroundTask.exe
1252	BackgroundTask.exe
1252	BackgroundTask.exe
1252	BackgroundTask.exe
1252	BackgroundTask.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 5948	2884	302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe	92
PID 2476 wrote to memory of 2980	2476	WindowsShell.exe	93
PID 2124 wrote to memory of 1704	2124	ServiceHost.exe	97
PID 1352 wrote to memory of 3516	1352	WindowsShell.exe	101
PID 1656 wrote to memory of 2088	1656	NetworkHelper.exe	103
PID 1252 wrote to memory of 5904	1252	BackgroundTask.exe	106
PID 3444 wrote to memory of 5824	3444	UpdateService.exe	109
PID 904 wrote to memory of 3276	904	WindowsInternal.exe	112
PID 2012 wrote to memory of 2892	2012	ServiceHost.exe	115

C:\Users\Admin\AppData\Local\Temp\302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe
"C:\Users\Admin\AppData\Local\Temp\302e914248f9b3b0ec11a29d09918f6e995422ba1048994407af075f2a331fbf.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5948

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2980

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1704

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3516

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2088

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5904

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5824

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3276

C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Temp\\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 f7cb80d8e1e6b0ccfe0b9c679ba312d77f64f9502cff386933ba749d2dce13f5
MD5 b2451bef54b51146480cefc4cd76e63e
SHA1 c23e495150a7796292ecd495e2bf8c0d951792d5
SHA512 76ae8667711a688d7c3c52d3dd15ce6b99e5093645a6db2107e156f24e3d842fe471b645a4a38e83037750f54003a9bb3728454229e15aee57e893fef0b7b4e3
TLSH
T191E07D06077C40827767593499E144363460145F94685E1A291C4AC50E9225FD907101
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 e38bc244b11ec350a2a27887434969fef8687f880e6264327a2545470affbe19
MD5 ce5eda5a11319344be574f19c9a63268
SHA1 b978579bd05621abb1c4e0328ee87ec0a1d247ab
SHA512 699fd03e026ddd2f119e51a980fb354176c01f6bda3668c400b1250f799042c89dc29e12cff06a5687eaf9136f0783b651e427e12f149ccccbbd91c25dd1a062
TLSH
T16841B7D92A1C7424FF818F451CB9CA363C78F1D1D5C490B571FA48F12596FD02D5589D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 a68218899b1a409d5089df3894ec2bdd43f1b0947fb7898fcec41f15bcef9a8c
MD5 6f38a043dcc4b2214c6da350f88d8110
SHA1 02d6fd79fadf76013d173bc18f6cc4f3e0633fd5
SHA512 095abb2e0a9791447a6406f849b3df270c631361a965976d50058f9a7e665ea8746114086b3e77eac1acccff622875ff4e20fcb6bc2c69837d3bc7848ff1d579
TLSH
T1F6D02B1603BA5CF53E259C6096D0A074346354A733C75496501AC796651DE393A02144
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 c99295806f36a1600b570e46623272edc3cc9e32c921b4f5203bcb6381a486b8
MD5 2a37a06988f016998c9666d08bbc661e
SHA1 831e3b8d6d08f1755acb9d22af9003b27f2ccc78
SHA512 6b7a62e3f8b5ba16eebe7ccef2193e1567dc6d89570dd4044bf9c4485a9a5df867ec08c445433430b8dcbb30f26016f699f4140b6a9d3a80978616be1ff9232d
SSDEEP 3072:9exbv7DO/fCoGUyRWWQeGbvHotivSzhBdbh6Odr:k5v7q/eDWpeGLgaShBdtp
TLSH
T163042C646DBBB5A35E4ACE624C99BA9612F561DD2012772F7E307E105C03ABFCE17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 7dd1ff632ddd6df8ebdf2bea038f358372f4d43ed9624a86ca916a0cf1c90287
MD5 17910262c69f48b19ea6220188a16712
SHA1 2836896bb7a343f84082ce5c209fa62e836cc453
SHA512 7d287245f7703f88985fb33d287b96a99ed98c5062f79ebe07d33e83dc46ea407a9d23cedd0bfd58d36bd957391aa2510c85f295c631a384c893ee058976f522
TLSH
T1FB1121865FB460D096F35260C7F8C9327C7464CE3CEA38D55C838896346A72D2B0543F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 c5fb6b5c7cdf08b4570c8cd8cd28626915a695700d2cafbfeaaf3a73306a642e
MD5 30064da6596c0b6a74ffbcb81607f78f
SHA1 3c635ac013887b61cbf96a8fb2de82547897e86f
SHA512 99f2348ebcd04dec8c049db6e0ad2e504ab64bf06392e945033b0cdd5a9f91744d2119319dd90c9983b9ab523eb48eb375abad2762d049b8e676264d5415bc7b
TLSH
T1C541E9FB0B063994BE0ADF8969F6C93A1C39C0B891801881BE7BC8D2055EBD12D5799C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 9eb81013d9482ea8a25404f8e8b482a0c2f4fac5d28fdb1a669e51e1062d8674
MD5 76c735a64fc60c7fdfbbcdbe15782c05
SHA1 5b55a9a53c4adf3b0a13688e569bf5c42ef87061
SHA512 135d7f64ec48605357acc48eea39d097fd49f4c98fcaeeddc054266137d56e15762e0721a2d4f4b911fe4c581c18a02443a965481e530783db5c85f2e9121a01
TLSH
T10FC08C1C1AA20A06F6A8437D42C13B039B308101E6818F191FF16A08D996B163878C3E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 b647b9564a261c30218a5c73d00efb22a4d27b048a5ad0ea2dce1207e3783ea3
MD5 edacc8f7bc95635a3d8a7526999e586f
SHA1 5b9728aca22ff2293f5e7d024e63f3c43285459f
SHA512 75431fc9aec658ddded302f607281f7d4c9e326cfa162f76612d70a9579c6bb8a414cf13796e714c6176bcc13e1873e3b81721c5272e906c95487e496fe76e62
TLSH
T1EEF05C3C2AFC907DE5B3DBBC9BEBB6569D1CF116140401EC1ED24A0A9A09E007CD103C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 95621e4cc49d41b07a92bff3bb474da545454b8cce1df776db5bc901ec27999c
MD5 088b6b99b0b27b62a2769ab8e35915fb
SHA1 a8fd2fb563a2ceb31a9865946f6fca5992e5d9f5
SHA512 5ad96e1896448cc67cf89857f791d6547fb4439cace01ee89f0647eb6ea11d56f16c271cfb7e759fc8f2adbf1a6c183f709509cf6eea37e60d46e37749296d4c
TLSH
T160F061283FFA5076F073A57487C971B5443DF2DA7401157D1EB62B042E07F206C9110E
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 9df0b431229eb3d8f221d813e4856de020fea8462dc7d9fa29712889c2797557
MD5 dbc720d7ba8850b7b5395ab73ae2c3ce
SHA1 8585a745fa3f7a1fbc684f47f7f27666fce13bb6
SHA512 9e91d1b5f2de08734de9078238f7bcdcccffa9df4a29073254c6379842e84480dbb3c6fd0ae824b3f4009652099705508a0fcf688b6112249d5bcf6aba0ae62e
TLSH
T144F0A33409BC4109F072E978C2D96D76BD75F11638068BB6069642075B12F404D9311E
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 531a6cad9e9322127a64ffb56d4f21e8c6dc6a8bce1b8a54e024d11d7f9a32fc
MD5 d47e95c248a50cf2ab711b461429fadf
SHA1 b9171220a137d41514229ed7c009ad8aa4cc5581
SHA512 95cba926d187944cc1d9ca4384b45bee7fa68a2550bb5ea1e7be3c6b6c813c7b0b690cf8468018f6d37e4cb2c65f2edfd55c3cf8f63a19c8c2a7fd54610fa6a7
TLSH
T1D9D0A7141F114225F01503388A510A427EE00542B240471E1F3AD90D442BB126D1281E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 edc3a615073ee04c953644c3bc96734f42cb3fb4441d0545d53cef5b7a2cac4c
MD5 2dc0063e51add83be2c9eedde78a148c
SHA1 92a0e321a3ffdb8c5ac95d868fe7ed3e9fe2a24f
SHA512 8b2b01ab0453eefb8682e5f842f4b9c69be83bb8e9baee341fcef78637ebdb1f84c02237d2888d8ff8fc34a296b67ca02f2ad1f61e6ede6aa68a7c0312afee3a
TLSH
T164F0A32806E2056EE2727774CAF193DAAD65F2973900DC781AD5070AF617F43AC1243E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 066efca1230229e22a189e8cbfa3decaeeaf311f78abe64b20208e0d62da2514
MD5 b04eaedf504feeb2a59da78fa009db78
SHA1 d22522eddccfe159bb2ad2d3c95146d8673330cb
SHA512 19198e450b060c80be0b66c799f1d94d231159586e77c7a58b39153ac89cc6c2897b4c178922709b065e8f9ce688eef1c5881a501984e9b1146a77c096055a88
TLSH
T175F0AB3824E7021DF162DABC83C152D55633F17331042B69BF7113063D43E82AD70D19
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 d839736acf3c4a8e19259814bec3f616f511c16f3d7b83e8aca5ab987125f5a3
MD5 5d2f194924dc30c25b3fa515a62af5a6
SHA1 63e5f7cf820f548b1b5df5ee18565674cad84c7f
SHA512 eda3cc33ef2c1e10507123359d108b5b6653a438544d93fc0ae50589109f5a1d3f37249353a39df23619018c0291d83489b2940b15685fb7f0b54da2f4d742ab
TLSH
T1BEC08C1C07650606F2A883BC12C23A839A208510F3819F152AB16A1CCD64F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
Size 12.3MB
SHA256 361c065750723684c7004c379992558369ee8c2b5a534b9418993311f5f79a19
MD5 e33d6ad116dcbc9f5afa540d1d277abc
SHA1 9d70876340d6da469dab2f67663bd66c1b1ace55
SHA512 c3cb24d2d9c190ec5e1292b5d09e429d7016d3470a6f98473a23c61411fbec49745c09ee543b7625a12e6a02585559b5e3b85b19986058bbacbf119ce8508c82
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlZv4O4KXrxUtT:4JwMrcMGTdBah
TLSH
T138D633EA745E6ABBC20E0CB98E0A8E7235BC57B1C7144DA6FFD57DB24840C521663D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
Size 13.1MB
SHA256 e3ec1590de52cd56f12c5c8f38773be8f3f0562e6d38aa07309ae9dc1ba746f4
MD5 adc92f6d54165357aeb206db220d85b5
SHA1 06b54cb940c3132a2ac233287ded85ef2d2151a0
SHA512 c6eb1c5f582d717d59f2fa00b68b8c004afc9d2afec8b1c723ca9b68822e78709e67e2a8d462fdc62f844932b71f9d7e789ba10a3c016b151d3b8662fc236f2e
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlZv4O4KXrxUtek:4JwMrcMGTdBap
TLSH
T1D8D633BA745E6BBBC20E0CB9CE098D7235AC57B1C7244DA6FFD57DF24840C522663922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\NetworkHelper.exe
Size 12.5MB
SHA256 d15604f86da58e9925afa51336795d2a999aa57ef41e5ab268e2b2d5a57952f2
MD5 bc29118bc933e5b379ad2581d80fa8bc
SHA1 1583b637153947074e605dbb71f5bd7b8926afb0
SHA512 685e1d29d883872a518750627ab4a76f2f0b263da559ebdcabd7983f14015e85eb64a0e2fc8efe23ba7ea9f0dce75e344147e21e2fc45cc9e5cb5b3b715a0940
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlZv4O4KXrxUteD:4JwMrcMGTdBaK
TLSH
T17ED633BA745E6ABBC20E0CB98E098E7275BC57B1C7144DE6FFD57DB24840C522623932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
Size 13.0MB
SHA256 18c9ecaa414fa79ed61f488048d7447fa248044927ce53d3ef6fb743c114e37c
MD5 3fd477ae89e8b7ce72474e0440d1dacf
SHA1 b6f686ca2acd45258244e81efb0c235947825a0e
SHA512 a2eb004cb44d6cb3e3e09d078584a0a47b0879754dd53e239283a7e3ee360fd5b775377566cd68b2a7fb7abf948335b075f5a4bd89ff222ea855588bb0740335
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlZv4O4KXrxUte9:4JwMrcMGTdBam
TLSH
T1CCD633BA745E6ABBC20E0CB9CE098E7235BC57B1C7144DE6FFD57DB24840C522663922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
Size 12.9MB
SHA256 c73ccb666314fb93e441bd081062f10b22e6a204d2392ec57df0ba852e3d19ea
MD5 d6b67f37963a2e226513272ba4004596
SHA1 1c24276eeaa6f99b4a112ac37888e2e9299f07be
SHA512 7a0a5eabb09ae523ebf5018b84f8427278ba174bc746bedf147373edc340246c9625cc2e8f38cdd8eb9134372c4f0cae95e4b07a2f8ee650a0779b4721461abe
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlZv4O4KXrxUteJ:4JwMrcMGTdBa2
TLSH
T156D633AA745E6BBBC20E0CB9CE098E7235BC57B1C7144DE6FFD57DB24840C522663922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UpdateService.exe
Size 12.8MB
SHA256 fcf41f6b0cd7f04f3dbe2cb5369540bed9f246ef4eaf919fbd7a4d1954a53d24
MD5 72d7ed847d1c01b18aee032f6725931c
SHA1 7c6e1a90a2287ca7ef9bb0869a9c195c9077a2e9
SHA512 c712ea17c21ddeb16d70e708e1e0c0ff3f3bc42a528f9958da121b4ace33d9e17afb7e9202aa21114963140e89e14977e65011803b3faf75ba16932b4b852153
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlZv4O4KXrxUte6:4JwMrcMGTdBa1
TLSH
T185D633AA745E6BBBC20E0CB9CE098E7235BC57B1C7244DE6FFD57DB24840C521663922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
Size 12.2MB
SHA256 344344080d4d72c269203c1655f938d85fdf5d7fbf544fb94de830e5db4e070a
MD5 bf7af1524065c4752f022d2cf3d0e4e1
SHA1 9035673d95630bdd26626bc3dd94d07dccd9129a
SHA512 bb2f1b6b14697b3e8782d6c4ec9ccc28071163d07624665496ce65f327b4cf44895edc43a815feff95baa995edc4257bf370414c77c085bbb398ad2425af24dc
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlZv4O4KXrxUtT:4JwMrcMGTdBal
TLSH
T1C2D633FA745E6ABBC20E0C798E0A8E7275AC57B1C7144DA6FFD57DB24840C921623D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
Size 12.7MB
SHA256 1fdeb4f0de95990617d03192b8c0a915d59c3a288bf5bce1e2685ed8f795ad1e
MD5 f97e23c06c002ecc686ce3e09e0f51e8
SHA1 44993533290fe050cdedb1fd74483335ae24c3bb
SHA512 218086f4e41fe5ef57125d539441b580342f11f6aa403e41ee7982ec452229cb45270a7a3b0e5d7ce702dc17be905d1e15a211529a40c5b0a236f0d6593c7e8c
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlZv4O4KXrxUten:4JwMrcMGTdBaI
TLSH
T187D633AA745E6ABBC20E0CB98E098E7275BC57B1C7244DE6FFD57DB24840C521623D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
Size 12.4MB
SHA256 0e61e3d788fdf6befea6dffeb80c36c9d144ca93b1d0174067674d592e6516bb
MD5 85ff8f75df9b2ab930d9473a31eddf06
SHA1 7b526f3fa14e23e7deed54643c35f53f8152bd09
SHA512 46834b8d53a6047b340fcbf0deb35dcb82b5d1390d179e855866b69391067a885c54874b8e0a3716d8bf112fb7fb34c76d911205369dc47fe56e2c8e510ed56e
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlZv4O4KXrxUteW:4JwMrcMGTdBa9
TLSH
T1AFD633BA745E6ABBC20E0C798E098E7235BC5BB1C7144DA6FFD57DB24840C521663932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download