aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
Size 17.0MB
Sample260930-q12efssfrc
SHA256 aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5
MD5 1ffaeb01cb7d88533584d0cc49155d57
SHA1 f5a2bbcc06bd7d04e927825c0cb0609a1421a56b
SHA512 3e8165b54529b4d2cbcef014773a51634c3cea7048f4ed106524d89f9e6ffc167f76c170eeb0f3453532ab63b319620f508e0cceb049f3e98eb2446cfa3375e5
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwApD3Gpth:4JwMrcMGFyo82ENqE
TLSH
T1E00733FD785E26BFC11D0C39CD1A5D6235ACABA18B688C97FFD97DA20840C611723D26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2592	RuntimeBroker32.exe

Executes dropped EXE 17 IoCs

pid	Process
4512	RuntimeBroker32.exe
2592	RuntimeBroker32.exe
3328	CoreSystem.exe
2296	CoreSystem.exe
3356	UserSession.exe
2056	UserSession.exe
1960	DesktopWindowManager.exe
2424	DesktopWindowManager.exe
1592	NetworkHelper.exe
1924	NetworkHelper.exe
5908	SystemTrayHelper.exe
4836	SystemTrayHelper.exe
4516	WindowsHost.exe
5224	WindowsHost.exe
2888	UpdateService.exe
4352	UpdateService.exe
5084	SystemTrayHelper.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\RuntimeBroker32.exe\""	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\CoreSystem.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\UserSession.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\DesktopWindowManager.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemTrayHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsHost.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\UpdateService.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemTrayHelper.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\NetworkHelper.exe\""	DesktopWindowManager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
37	raw.githubusercontent.com
62	raw.githubusercontent.com
82	raw.githubusercontent.com
93	raw.githubusercontent.com
52	raw.githubusercontent.com
66	raw.githubusercontent.com
114	raw.githubusercontent.com
127	raw.githubusercontent.com
118	raw.githubusercontent.com
1	raw.githubusercontent.com
9	raw.githubusercontent.com
20	raw.githubusercontent.com
26	raw.githubusercontent.com
40	raw.githubusercontent.com
104	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c539-30.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c53a-105.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c53b-140.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c53a-174.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c53b-207.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c53e-242.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c53b-276.dat	suspicious_telegram_bot
behavioral2/files/0x001100000001c53e-309.dat	suspicious_telegram_bot
behavioral2/files/0x001100000001c53b-344.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4016	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
4016	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
4016	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
4016	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
4016	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
4016	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
4016	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
4016	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
2592	RuntimeBroker32.exe
2592	RuntimeBroker32.exe
2592	RuntimeBroker32.exe
2592	RuntimeBroker32.exe
4512	RuntimeBroker32.exe
4512	RuntimeBroker32.exe
4512	RuntimeBroker32.exe
4512	RuntimeBroker32.exe
4512	RuntimeBroker32.exe
4512	RuntimeBroker32.exe
4512	RuntimeBroker32.exe
4512	RuntimeBroker32.exe
2296	CoreSystem.exe
2296	CoreSystem.exe
3328	CoreSystem.exe
3328	CoreSystem.exe
3328	CoreSystem.exe
3328	CoreSystem.exe
2296	CoreSystem.exe
2296	CoreSystem.exe
2296	CoreSystem.exe
2296	CoreSystem.exe
2296	CoreSystem.exe
2296	CoreSystem.exe
3356	UserSession.exe
3356	UserSession.exe
3356	UserSession.exe
3356	UserSession.exe
2056	UserSession.exe
2056	UserSession.exe
2056	UserSession.exe
2056	UserSession.exe
2056	UserSession.exe
2056	UserSession.exe
2056	UserSession.exe
2056	UserSession.exe
2424	DesktopWindowManager.exe
2424	DesktopWindowManager.exe
1960	DesktopWindowManager.exe
1960	DesktopWindowManager.exe
1960	DesktopWindowManager.exe
1960	DesktopWindowManager.exe
2424	DesktopWindowManager.exe
2424	DesktopWindowManager.exe
2424	DesktopWindowManager.exe
2424	DesktopWindowManager.exe
2424	DesktopWindowManager.exe
2424	DesktopWindowManager.exe
1592	NetworkHelper.exe
1592	NetworkHelper.exe
1924	NetworkHelper.exe
1924	NetworkHelper.exe
1924	NetworkHelper.exe
1924	NetworkHelper.exe
1592	NetworkHelper.exe
1592	NetworkHelper.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 2592	4016	aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe	91
PID 4512 wrote to memory of 3328	4512	RuntimeBroker32.exe	92
PID 2296 wrote to memory of 3356	2296	CoreSystem.exe	96
PID 2056 wrote to memory of 1960	2056	UserSession.exe	99
PID 2424 wrote to memory of 1924	2424	DesktopWindowManager.exe	104
PID 1592 wrote to memory of 5908	1592	NetworkHelper.exe	105
PID 4836 wrote to memory of 5224	4836	SystemTrayHelper.exe	110
PID 4516 wrote to memory of 4352	4516	WindowsHost.exe	113
PID 2888 wrote to memory of 5084	2888	UpdateService.exe	114

C:\Users\Admin\AppData\Local\Temp\aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe
"C:\Users\Admin\AppData\Local\Temp\aaa2925b64e929863567a00a287f8c716cd8289d6b76123b3f6c592edfc83fc5.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:120

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3356

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1960

C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1924

C:\Users\Admin\AppData\Local\Temp\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5908

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5224

C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4352

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
MD5 eb444c59d03b1567ebbb5e58480a6eef
SHA1 e638b0d4f8bc77cb263d4e561ca3cfd1e286432b
SHA512 43cc6537c3b42c6a520ad798c7d57f02e3a6770d08ee501ac16a6db81365e6c09ba75a15d2b614b2b19ab3d667c9753a671c6e77a54797011705393da73686f8
TLSH
T1D9E0721A362DC0DABF6A49394A6250BF78A1008F00CD855A342C87F84C8262F9F0BA08
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 714842d12308ec0508c43b1dd6552bf8dc987d1602cc840daa4b561e150e8e23
MD5 957a9a3e1f192456189b729d0a0c21da
SHA1 f554f0ffdc1ca76dfd72a7132d347dc9c75b46d2
SHA512 f8b3574ac040971d5a2d5d2c387141929030af00b823c800beb13fdbcbfc0332cc2f76887df9bc5b41c1b58c9ee161df6f26a5d657fbc7da010240bacab52b98
TLSH
T11E41F8DE271C3019BF868F803878C6322DB9F1D1858954A670FBC8F1B096BD02D2A48C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
MD5 32d66548cf2a8f1b6b0ab9d6c335806c
SHA1 69e42d1c9f5e7760749da4331591e196bba4b81d
SHA512 f8d7ae900b29dbddb66293c320367f3b4dc41ecd372baed0f690bd657d8d92c77f8dd5cb3a10b7d93e1b1d7ed2a90c12d3461dde8845e2c7eeef1ff2c3237842
TLSH
T1A3D02B1D15F56D137E27991487E8E56174651A2713D0485C14498677A8015E9194F704
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 183KB
SHA256 78632193e49fce32c641fee87ff625185c11786a199959c356fbe019ac5fa932
MD5 c207f33405a32a2f8d7f12b221e3ac7e
SHA1 d0ab0be7279ba357c821f938ef19444e31034c97
SHA512 1977e55bacc4b995708039bf71ee340f18c10af64f83f8019cf74a8550ed29cbe338eb1c74681e7e5c063d6f2f7af718981ac94e23636089f9ddee0bdd8c29f6
SSDEEP 3072:iexbxtZL/ECmTwPA1W4wA3l1QticEFhEmelj6OdDF:l5xtp/CF1PwA7odYhEmuHX
TLSH
T14D043B646DBBB5A35E4ACE620C99BA9612F561DD2012771FBE306E105D03ABFCF17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 e0e7336a1c7c64caa65ecd69b0c3a40929a71e78b54170a9296636677e6bd991
MD5 466320b68165b6147e7e6af998c3a6da
SHA1 f97bf2efdd7d50b871cdc5b0abba2adc09d3fc63
SHA512 5d4f0eddf2ca6c044fee918fa15085be24634dc8f2818130094f8eccc4ed9ab9637531f5c9f41f2a6224bcfbaa31b8b364458357e1bc27652eb732432e373fd4
TLSH
T1F611E5865FF4B0D09AE25660CAF4D5367CB564C619EA30C12CC1CA96249775D2F0643E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 132c75bfd291b9f783c174e8598359524c23f8e68b8fc9ad44071b2d508cf669
MD5 517f60de1d0eeb69c59d9d4cfb9b19fa
SHA1 dc99a3568164f6bc16f22cf2d39c110d0b8cedb6
SHA512 74da1d4c84cf95e51fce2bcc8233b74f468d263a7bc638c2025508d1efe2e76b1167b02237f2b3840486ab6a7ce2871813d45be6c85a7bc4351b4ba236b4e60f
TLSH
T1DB4118EB1B9B3A54BFC1DF4E59A9CE311E7D90E892800C027573C8C714ED7992A0A84C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 cc29d9c43396fa124a593ac0a736ffebc6d27aae7f6b1a931f97d705f5525409
MD5 51922674e4a3b00c9d098b5a8fbe21a1
SHA1 a421194e97724f988a36a3fa481e43e56d9978d8
SHA512 0c0fc2d666d47422125f04c02f9f7079489297a4a1ed0b1f5372cca2bfcfd603728a97e2aec8d837026361df87679cf9eca934816c075c80474b796ede76deae
TLSH
T1E3C08C2C1AA20A06F2A843BC02D23913DB218101E6418F191BF13A08C996B1A6838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 cfe1ad9fe4e34a434a3c836dc33972e93c206ff6918ee3216bebf74a0bd4f5b8
MD5 8ac9e2d7a0cd8062f4d02ef2a22c0731
SHA1 9e33c0f041e82200dcd2d69777e1da4ef281a951
SHA512 76fbb941c6eed655454c7a74bf5353f45d5470bc83279771c654111b8e265e0d7fa0fbc4483bc7e7ef0675f6b8b274260ad221fdd3edcd8e98df05dde9a784f9
TLSH
T15DF05C3C12FC804DE071DA754EE5A2E96D24F123380489AD0EA046089905F005C9253D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 9aa58944d0546d976b7e3f102c5d6b9eb00cadbe288765e003c171485ea899fc
MD5 63ae5fa6e3001b2c870599ebf659062b
SHA1 7b6045671e3bf37c26b828d11e3332e3e6034385
SHA512 b4a90505d0ebe325e7fc8ef1e04726f5b76e1502d8fd1ee98da552da65a40e5ccfe62fe28398858ce4ca4a6124c7ac41616b9d30716515e770e1107a6721480f
TLSH
T1D9F068783AFED26BF03BDAB483C770705C3AA31624066AB826F027446F25F207C9121D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 054745decf720befd8d9a65138316db27c5dbe349653f12a9f058526d6d4bd36
MD5 227db020de54c075dc205cf999014018
SHA1 9a749f20e667c130963a2478ab80fdcd80a54b76
SHA512 e16324672d7c6360529ca2f67650929a8dd370de52ba2edbbca2da25dc207bcb048d6b430ad7ee5a5b983a2378dfab50ed778b4724763327a2111b3b8ec9a977
TLSH
T169F0AB1028BC002DF4B3E9F4C2D221B6FA35F116780583F60B9B13415B52A010D9212F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 74543cceb8225f8fb06c8053e982a910717227327d3b9857e430d0f0328f81a0
MD5 dfeb28e81bd169b5b30fde4b2139e4fe
SHA1 80b445b01cae5596bef66924f5cd2da8a2f71559
SHA512 5a6f75a8037f7ad3d585c2a6df5df04e0f6dad0db482b37a48890dc4463ae288314597e82cb0b6a30a398b08f0a4a8cf2c0ed25b2b058029015d50697d073f4e
TLSH
T196D0A93E1792225AF0B5E13A8E224A604EA0210B81806F9F2BF0120D0428A0A389180E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 48a6469040caaf5407a1037b9c9c31fa088eab33ca211da65bee14d176e35526
MD5 6673931e65ce9f4549274ead9559de76
SHA1 ee3e1b43f21678bdcfedda3eb6fd382b2640fb0b
SHA512 9962b94fa7d51062b76e4bad582391bc8a25da4e37ab71c8b25fc1a410a1a3b9ce8797d2b3084d94130db788c82574b9562b9adaa09f8150f92cfcc1a5a62d9e
TLSH
T1AEF05C2412EA010CF37572744FF592DA6C1AF3773000C95516A1170AFE06F405E26538
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 1d5b83b14295f0d00b214de48ea208b703015e6cab1e54636f3370ca682220f7
MD5 ba556ca39480a789b267eb574cadf607
SHA1 8e8e7214d149214b9325d7b8c7925f235c2376b4
SHA512 eb5fee19ce7e500fb89187b53cc78f2fb8d52cc8815beb8687909d6b472007ce5809b41ec4c1e48039adf0b0578e6d6ad32dad1b4b6cddf2f7cdc448449bbde2
TLSH
T168F0AB7C29EB025EF201E5FC42C2A1D96A33F23B3948235ABAB012056E06E406E31929
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 8049c5c0b2c0a6ab425e6306519b6c9e30bf35652662c9cf0808efb29b0998e1
MD5 1be06efe58837cc9415db54d348f0ade
SHA1 8ce07390ba870b9f88758b3f0faf6e6ecd466f52
SHA512 1e6aba6ca5a931b8e1d36cdcb0c2518f67650b1acbc418965436eb017ec949c340c47bb6fedb22779d3e3b69dae7885e64d7aa3f595b39580b5e9a347578aa4d
TLSH
T17AC08C2C16A60606F2A883BA02D229838E218210F7819F0527B13A0CCD24F122C34C29
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
Size 17.1MB
SHA256 76d1bdd0c6138228051c88a936aa06ff4fcfb33e2f37b8a6505a6a10747d384a
MD5 713d3e4729f5719353038924beba2d39
SHA1 46184d16dfd817f12789c755c73a68c859a02676
SHA512 23bfe3218916638580365d253df78cc246ab46c5ada9c41d4cb5fd860bd42eaa741aea5015515941c9eb8b19eea64354637d151f55aa372daf346a91eeea2274
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwApD3Gptu:4JwMrcMGFyo82ENql
TLSH
T1E20733FD785E26BFC11D0D39CE1A5D6235ACABA08B188C97FFD97DA24840C611723D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe
Size 17.2MB
SHA256 83d83c7a98bd461281e3a030515808d1a08741d69855fc2c1f135a0c8c0fafeb
MD5 972e30b027e2f59cf31ca62b79bdf590
SHA1 0cbfb63d906c76bfc75dbe5d87038097be0a85ae
SHA512 240877b673ff3358f16ec319ac5a8a3500235ad1cadc8f115bced8fa22cdd4695a250fb9c17859b68b245d979290a99fa26b89662ac5faff17e5f8c34c6f0aee
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwApD3Gpt6:4JwMrcMGFyo82ENqd
TLSH
T1E80733FD785E26BFC11D0D39CE1A5D6234ACABA18B588C97FFD97DA20840C611723D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
Size 17.4MB
SHA256 820cfa306955875b8741c745eccb2ebad58c086245d9204121afd18fbe3517c0
MD5 3ee246342857f4e97a28849290ceeaf4
SHA1 2aee48b5a48caa80b1524798f139f8bff311f73e
SHA512 f021fb205f1c5aa8852ba4af5d4ff3df371b266ab05b185f976ceb76bd7f4acfe9ba563cc66794cc35325a7494ce8cde27e4ab94551ee04f11a36c855f1528c7
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwApD3GptZ41:4JwMrcMGFyo82ENqG41
TLSH
T1320733FD785E26BFC11D0D39CD1A1D6234ADABA18B588C97FFC97DA24840C611B23D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\NetworkHelper.exe
Size 17.6MB
SHA256 1c1f3171db07893000ea5b2e9cf9d898bf74d0e3684d9eeddd0dceb00975e129
MD5 1d58d58ef4ffbef1e05e186ee6f0c4bc
SHA1 4d50fd7475b2e24838a6d1074d7a787b6df9febf
SHA512 b79ca5b366873384e2484aa9046799de80c8aa4bdb72e82cc55fc416ca8366aceb6ae00b8be188f2abad7495b0a1654c544a1b7a679f6015f76ed140308b1db5
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwApD3GptZ4KF:4JwMrcMGFyo82ENqG4s
TLSH
T10B0733FD785E27BFC11D0D39CD1A1D6234ADABA18B588C97FFC9BDA24840C611722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
Size 17.8MB
SHA256 9e6cac169011c87c93fb8e97a04e6aac27a4675947b47516f27287234fb39651
MD5 2b150ae4f4d2354aa397572b3a7900c7
SHA1 bb771fb06e2326e6bc3906eefc2da187b81acf8b
SHA512 1dd3f3d5492173e8688f9f082e21d963840b68bffaf18be425b4a23903949dc1512bc4f969d56e608e7163bc976f4a66b655b2430686254e9bb333e3e213cbb5
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwApD3GptZ4KV:4JwMrcMGFyo82ENqG4g
TLSH
T11C1733FD785E26BFC11D0D39CD1A5D6235ADABA08B188C9BFFC97DA24840C611723D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe
Size 17.9MB
SHA256 9dbdd502c9d3b7fd7a8eb61bbe0f512cc18453dd99ed7220c996bcf6511edb44
MD5 10be5c420e54c37baa8b7fb61a34a02d
SHA1 9b4e8c783493441bece00bc1be18349c7c534480
SHA512 0a0d6bf62ceaccaa39f6db4412769ea11cdb1b9c0a32beb7dcb97a9dedf571251383627510977197a2bd1660d9ba42d4a04048d99f30cc6a5429bb230c21fa9f
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwApD3GptZ4Kw:4JwMrcMGFyo82ENqG4l
TLSH
T1F01733FD785E26BFC11D0D39CD1A5D6634ADABA08B188C9BFFC9BDA24840C511723D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
Size 17.3MB
SHA256 331217981b8209e28852b4cc3c8bf9dc0879f247ec276c98326014067ef87008
MD5 9c3582a03ec3b6983221567b3f02d7f2
SHA1 bbae38e208054aee1ccf76676e9ffac1dba1c2fe
SHA512 8611899a93585af9a59e35ca635791370652503624d7ef7a686778a92816d3dc5d9b9c5e0d8762b5f415bf084d4263f5e1d4b1253cc284eb96f5c1ba54dd3247
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwApD3GptZY:4JwMrcMGFyo82ENqGY
TLSH
T1B30733FD785E26BFC11D0D39CE1A5D6234ACABA18B588C97FFC97DA24840C611723D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
Size 17.7MB
SHA256 5b71df77e9cfa56427f654a326bb546926528e88a3a8886da27b38293aa4d929
MD5 803e3470318112ec6a826d7b49a91ffa
SHA1 64ef2e21fed1d38599c6eb73bc8b0512f53a0558
SHA512 77ac537673fc999a63a00741fac2848dd02abb2d219c0c5d77d234c4ad53b98eeffed3a3dfb50e37dfa5c2bdfe9422df0dcdaf0cc093319ccb7aec4fa3fc099f
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwApD3GptZ4Ko:4JwMrcMGFyo82ENqG43
TLSH
T1901733FD785E27BFC11D0D79CD1A1D6234ADABA08B188C9BFFD97DA24840C611722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
Size 18.0MB
SHA256 4bf4a856508fa06de4f55c50464db689af31faea9817740cba6ece6600aba9bd
MD5 5b708027e99acda69da215bff8c6078d
SHA1 5b14db9cc09ecf0c71ec469bf2ee10ac6a7e59e9
SHA512 f373e295468649b4cd3731376c832a33887e0424f964694a0498697b5641c9e305774a2efac3275c63f95f0ca6d6156132a2e84265052a4b9ecdc9275d737f46
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwApD3GptZ4KD:4JwMrcMGFyo82ENqG4i
TLSH
T1291733FD785E26BFC11D0D39CD1A4D6634ADABA08B588C9BFFC9BDA24840C511723D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download