8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
Size 11.8MB
Sample260930-tch5raca44
SHA256 8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd
MD5 1fed19485f6b4dc961e84855dcf73e1a
SHA1 f1f941c1e30965e170d45417955321f084c5a055
SHA512 d1ef5782d06775f578ae93e2aa1f8335716873ed8e5b2274b80f2da913f8bd55e36f38bd8160f647fa0950f65d603df8e9cdaf9e0097f3b415597046509d52d6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muq71EBK:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkh
TLSH
T17FC633D6685F5A7BC10E5C798D0A8E7235BC57B1C7688CD7FFC67EB20840C522A22D26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	UserSession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	BackgroundTask.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	ServiceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	SystemHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WindowsHost.exe

Executes dropped EXE 12 IoCs

pid	Process
3812	SystemHost.exe
2088	SystemHost.exe
1764	WindowsHost.exe
876	WindowsHost.exe
4728	UserSession.exe
2492	UserSession.exe
1856	BackgroundTask.exe
1796	BackgroundTask.exe
4240	ServiceHost.exe
456	ServiceHost.exe
4092	UpdateService.exe
816	UpdateService.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\BackgroundTask.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\ServiceHost.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\UpdateService.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SystemHost.exe\""	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
62	raw.githubusercontent.com
100	raw.githubusercontent.com
50	raw.githubusercontent.com
96	raw.githubusercontent.com
108	raw.githubusercontent.com
125	raw.githubusercontent.com
128	raw.githubusercontent.com
140	raw.githubusercontent.com
143	raw.githubusercontent.com
31	raw.githubusercontent.com
32	raw.githubusercontent.com

Detect suspicious telegram bot 6 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x00070000000243c4-27.dat	suspicious_telegram_bot
behavioral1/files/0x00070000000243d1-47.dat	suspicious_telegram_bot
behavioral1/files/0x00070000000243f6-114.dat	suspicious_telegram_bot
behavioral1/files/0x000a000000024178-144.dat	suspicious_telegram_bot
behavioral1/files/0x000b000000024181-185.dat	suspicious_telegram_bot
behavioral1/files/0x000300000002144d-215.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SystemHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UserSession.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	BackgroundTask.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
848	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
848	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
848	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
848	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
848	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
848	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
848	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
848	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
3812	SystemHost.exe
3812	SystemHost.exe
3812	SystemHost.exe
3812	SystemHost.exe
3812	SystemHost.exe
3812	SystemHost.exe
3812	SystemHost.exe
3812	SystemHost.exe
3812	SystemHost.exe
3812	SystemHost.exe
1764	WindowsHost.exe
1764	WindowsHost.exe
1764	WindowsHost.exe
1764	WindowsHost.exe
876	WindowsHost.exe
876	WindowsHost.exe
876	WindowsHost.exe
876	WindowsHost.exe
876	WindowsHost.exe
876	WindowsHost.exe
876	WindowsHost.exe
876	WindowsHost.exe
4728	UserSession.exe
4728	UserSession.exe
4728	UserSession.exe
4728	UserSession.exe
2492	UserSession.exe
2492	UserSession.exe
2492	UserSession.exe
2492	UserSession.exe
2492	UserSession.exe
2492	UserSession.exe
2492	UserSession.exe
2492	UserSession.exe
1796	BackgroundTask.exe
1796	BackgroundTask.exe
1856	BackgroundTask.exe
1856	BackgroundTask.exe
1796	BackgroundTask.exe
1796	BackgroundTask.exe
1856	BackgroundTask.exe
1856	BackgroundTask.exe
1856	BackgroundTask.exe
1856	BackgroundTask.exe
1856	BackgroundTask.exe
1856	BackgroundTask.exe
4240	ServiceHost.exe
4240	ServiceHost.exe
4240	ServiceHost.exe
4240	ServiceHost.exe
456	ServiceHost.exe
456	ServiceHost.exe
456	ServiceHost.exe
456	ServiceHost.exe
456	ServiceHost.exe
456	ServiceHost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2088	848	8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe	99
PID 3812 wrote to memory of 1764	3812	SystemHost.exe	102
PID 876 wrote to memory of 4728	876	WindowsHost.exe	109
PID 2492 wrote to memory of 1796	2492	UserSession.exe	117
PID 1856 wrote to memory of 4240	1856	BackgroundTask.exe	118
PID 456 wrote to memory of 816	456	ServiceHost.exe	125

C:\Users\Admin\AppData\Local\Temp\8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe
"C:\Users\Admin\AppData\Local\Temp\8cfb631dc7573e3834ccd84737690c86045d773fe435e250b412c6bb5eb2b5cd.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  PID:2088

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1764

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:876
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4728

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1796

C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\BackgroundTask.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4240

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:816

C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\UpdateService.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
MD5 eb444c59d03b1567ebbb5e58480a6eef
SHA1 e638b0d4f8bc77cb263d4e561ca3cfd1e286432b
SHA512 43cc6537c3b42c6a520ad798c7d57f02e3a6770d08ee501ac16a6db81365e6c09ba75a15d2b614b2b19ab3d667c9753a671c6e77a54797011705393da73686f8
TLSH
T1D9E0721A362DC0DABF6A49394A6250BF78A1008F00CD855A342C87F84C8262F9F0BA08
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 4089a029559e71c200fb4354e56ef91a2a37829816917233cc62f1ef8228d5d3
MD5 c9757d23ab80981c24ce1e75fc78b339
SHA1 9c3ecc83002bc5ad491360ba6f847350d8f27b7e
SHA512 4727cbc2c94c0a6d7356931f950d0f5ebee7d153aa7e9cc91aec928e090c0ecf2ab386a8c3643790189b4b4210f75c808fe86b42172c37bbe4e80c43074ca47c
TLSH
T15041B8D52A6C3460FF46DFC1A578DB312E79B2D4A640909678FFC4712095FD01C15CAC
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
MD5 32d66548cf2a8f1b6b0ab9d6c335806c
SHA1 69e42d1c9f5e7760749da4331591e196bba4b81d
SHA512 f8d7ae900b29dbddb66293c320367f3b4dc41ecd372baed0f690bd657d8d92c77f8dd5cb3a10b7d93e1b1d7ed2a90c12d3461dde8845e2c7eeef1ff2c3237842
TLSH
T1A3D02B1D15F56D137E27991487E8E56174651A2713D0485C14498677A8015E9194F704
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 183KB
SHA256 ce00742bc72fc36601c601a68234b3b03a210569f7923008315d3867d7017a4c
MD5 4164e5fd02f95c8f1e3ecced6142ed80
SHA1 a0e41298ad1a775e23f7d49a2835430886bacec4
SHA512 d496f79e294a0456407d2bd1620d2d6c6bd9a553164da5b75a2cf4b9b0ea1b276eaebeb0a776dac1284f16cbc4c8a2ff89819dafd69103120e775663d5df51c0
SSDEEP 3072:WexbxtZo/ECmTwPA1W4wA3l1QticEFhqmelj6OdDU:R5xtG/CF1PwA7odYhqmuH6
TLSH
T114043B646DBBB5A35E4ACE620C99BA9612F561DD2012771FBE306E105D03ABFCF17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 e0e7336a1c7c64caa65ecd69b0c3a40929a71e78b54170a9296636677e6bd991
MD5 466320b68165b6147e7e6af998c3a6da
SHA1 f97bf2efdd7d50b871cdc5b0abba2adc09d3fc63
SHA512 5d4f0eddf2ca6c044fee918fa15085be24634dc8f2818130094f8eccc4ed9ab9637531f5c9f41f2a6224bcfbaa31b8b364458357e1bc27652eb732432e373fd4
TLSH
T1F611E5865FF4B0D09AE25660CAF4D5367CB564C619EA30C12CC1CA96249775D2F0643E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 132c75bfd291b9f783c174e8598359524c23f8e68b8fc9ad44071b2d508cf669
MD5 517f60de1d0eeb69c59d9d4cfb9b19fa
SHA1 dc99a3568164f6bc16f22cf2d39c110d0b8cedb6
SHA512 74da1d4c84cf95e51fce2bcc8233b74f468d263a7bc638c2025508d1efe2e76b1167b02237f2b3840486ab6a7ce2871813d45be6c85a7bc4351b4ba236b4e60f
TLSH
T1DB4118EB1B9B3A54BFC1DF4E59A9CE311E7D90E892800C027573C8C714ED7992A0A84C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 b51abaaf58e07e373d9bda5ca2893dbd0ef703aefcaa4e49e9995e6b560ccd45
MD5 6ca790ca8cb550d40cedad17a4a8e5ca
SHA1 916a5658def92180654456cec4730dae03b96f11
SHA512 182fc74f60b58947cacba405f4df8fedfe963d91ebaf47f77567a122c328c594a4da51fe1b06601a06361a4bbb15014efd7de359a440968f19a34c16963085e0
TLSH
T1AAC0801C19550505F294437D01C1790357204101E2418F0517F16904C976B152834C2E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 573c7e2d8c9cbffa47a8af3af685174633176cc5d437e0738f37aa49403f6c2a
MD5 ffc176c06dcbbdf31e6be7b460280c8c
SHA1 d65d8bd50b4aae1b72e5c97694aea021abc5a6a2
SHA512 679aa6511d266899014a63925e54b0ce642e0336ffcf9a1bbf9cbef58588030fcf5a62e029ba7d6c894d1e7916818a2bd53adc26314321aeb05a0d3e3e4cd32c
TLSH
T121F0553C12F8804DE1B2EA798EE5A2D96C14F223380889AE1EB14A089A02F015CA253D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 f948b4e8566a199721a1f7270691ab89566e02b8f033917c383fa024c2aa4856
MD5 b3469d7f1d702ea86343558ececd2f6d
SHA1 b70321c5c0502a6acf15bddc14af6706b3e86f15
SHA512 022b2f402cd79540389f6a4b31543c04f08f615bc6f432718fdc08b9c465aa96bbf2e684d0367bdef83f3ce61a8538c314408b916756063e2463c02c0681bd04
TLSH
T185F02BA03DFE80BAF137AD7983C722620965A20674025B7426A413081E06E602C55225
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 65deb547e5df58e8cf7e64a8ee1c46edff74e860e6ce155d2697924399bf8894
MD5 ba8c44a00384828ee8174b072994d197
SHA1 3d83b1e2fd38911606e8b98839e2fd12d604c0a0
SHA512 eab4028d06ceeaabf1f0d13cc292a4f3a8111328e499f8552e4873044f6c149d80f1e0bb6d0d5fa9cdbfe82e8dfaf5e6f44faed50f062ec10c07a3be00d3c659
TLSH
T122F0AB1029BC406DF4B3E9F4C2E222B6F93AF2167C0583F60BAA02455B52A010E9212F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 e444f123adfa4945948a7c943a86b93ad6dd4d18b7dc2a917c176555ef8caf91
MD5 3c464bd80cf519f032b664d158108914
SHA1 918ce668e416f01146f64939704e53e8e9c43db8
SHA512 f822a3d57bfe8d08ebe46851dcd502fdee8406a54b31b427aeca8789739eda93fdde925f72be5952dd87bc046c117c281b1e87b02e113fdf0946462eb543ccad
TLSH
T171D022280BD20223F184927E65F20803AEA4B902EB818F0F0B71210F885DF220C22E0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 03314972a0642f3b73459bddf68f62cc9d4075b42c7381ff616cab6d982a981c
MD5 9526b4fbb1d6187e8a0e906cc032ef1e
SHA1 959b9813bba5108491968c579a4410bd14a93a7e
SHA512 d9b9555e6057c965e5bbb6ab297a546f9fb21ff006324e2bed6c634e40c10b05df8bccf6fa0e3fc6f291926d837d4e533aa2692734ebdc8d169edde61fcf3f45
TLSH
T10EF05C2416EA010CF77576754FF592D66C0DF3773400C89117A1070AED07F401E26634
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 8a832a0a3a03c2cf258c878c913b61b763686e135c7e74ec6f0812ac80d48d3b
MD5 fcaa2db19476e7101c3b0e60f08922d3
SHA1 a185e0ef74e986ec837f881d72f4623b691e4b38
SHA512 1145c0106993362bb0dfacd2123b9276dd8f6279247a1f2b630e41b7fe792b2edb8e20a61e2608ce74f6192f7e9c8014aa80a2b7d1cc6b2b1942b6447b8e070c
TLSH
T184F0AB7C25EB025EF301E5BC42C261D96A23F23A38482256BAB012096E06E406E32929
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 229da9f2361a15c77b5f1411cadad4c7ffe7dbc4be912296c6f801a38c01a873
MD5 b626df12493e2eb2979a9fcd62d35519
SHA1 7338a826a2a2e35466a29217341cd4a5aa830631
SHA512 6cadf36c4ffe7487cb2003e0876560ffc6abd2bc7378eaeea8e8ace35dcb29b6ff3317047da26173baf0da28d518c656d99cfcba882542e9a3e3a02b0d79e1d1
TLSH
T1A2C08C2C0A610606F2A883B902C339838A208110F3829F0127B12A08CE78F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
Size 12.2MB
SHA256 5df6f4c2eb989cba1cf64421fca6ee5488a2185553d38596b2b5c0f082abb1e4
MD5 3353130c693eec3ab99bcac439435c33
SHA1 6a0170c7855f679cde18205f95645847738c0f5d
SHA512 bd7f9ccc4895c409657bae77dff7cb58931d88e21242f85eb9ced2ba7920313e186f5b58213be2bdcb2e256f71a07894b5b79472c16caec20ae5d3946661a8e8
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDuQs:4JwMrcMGL9gGs
TLSH
T15CD6339A6C5F5A6BC10E5C798D0A8D3235BC57B2C7688CD7FFC57EB20840D922722D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
Size 12.5MB
SHA256 341b61728209838e1e4f500d9f4921977643cc7d6100656f9d826b5957db309a
MD5 8d827e97d0254b3d4f460d101758d7c2
SHA1 78ae6c0e968e9a3c6b4449aefaa419f8be3c4d46
SHA512 caeee8fc13185d3eef581d34f339f0f3713d8f9c69d5da0621cc45bcfd8975d5749fb66cdc909db4caed9f98888e916f6658e734e7fb0c213dac116a556134da
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDuQUoV:4JwMrcMGL9gGUoV
TLSH
T136D633D6685F5A6BC20E5C798D0B8E3235BC57B2C7688CD7FFC67EB60440D921622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
Size 12.4MB
SHA256 5552ba49177560c0263d66460faf9ae6808d509b1cabe57f745828320144fa39
MD5 6e44fe7a18c273f3b55d2c29d9c5bdb4
SHA1 6f4a2dbf732d5934cd70ebc9fb135a64a29b6b54
SHA512 d22a12e5c1ae9e4e5f03a1f7abff0b617abc9cc127b76dc78c6d110ccc8225faa87c0f2cde6659b31cc03034ae63f6c9ce719c7aaae369a5b130c8b0045a9d37
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDuQUD:4JwMrcMGL9gGUD
TLSH
T1FCD6339A785F5A6BC10E5C798D0B8E3235BC57B2C7688CD7FFC57EB20450D922622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemHost.exe
Size 11.9MB
SHA256 90214324e93fdd0907441103b7dfb3478019f4a35ee37d645bb452e8d5b60f98
MD5 22d1410edb47b8c6658cf294d26bc0cf
SHA1 9dc321442f6a87191aa458a81b1541229e6e0caa
SHA512 cc4674a0021bbbed71925665e5880f56ab95cb49772b45458283372f237f754c63db8381d46b90f3a310ad0cb10e246b33d3d297feb1ff3e914dde55ce20c798
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muq71EB7:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkC
TLSH
T10BC633D6685F5A6BC20E5C798D0B8D7235BC57B1C7688CD7FFC67EB20800C522A22D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
Size 12.0MB
SHA256 796ccbc8706bb196282e9e739c0630ca100a1023f80cedf0d82078b789002582
MD5 88d49a9be44b81153ca299a93e4fa191
SHA1 e53acaf815358039340107448f19c2d468b0c1a3
SHA512 075c4e1d5b81fe87de861a63728431216bd122a7979f111d7a238f7e9d3cf1124e0d2d3443fefbb6e51e4d4cfa6c97c77f5b2bd1eea5ad206c1d1f65fdda27f1
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDuQ8:4JwMrcMGL9gG8
TLSH
T173C633DA6C5F5A6BC10E5C798D0A8E7235BC57B1C7688CD7FFC67EB20840C521A22D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
Size 12.1MB
SHA256 f39c2cc7b03fb395aead1c8b5f3db7c3b79f7ac598653603316c3ff53b887904
MD5 acbbe16f0f0d9fa1dde27a263bd56d33
SHA1 bf5cabfd1574d31179cf7bb711340656be48f9bf
SHA512 0d37a41390e53a724f9e0ea70a297cd9c59a713ffa50ecc2d3ef9ffc47cf9645ecd72983931036bedb8eb86d77b0691f3f8e78f9d7660a30eeb5aae898093235
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDuQq:4JwMrcMGL9gGq
TLSH
T14FD633DA6C5F5A6BC10E5C798D0A8D7235BC17B1C7688CD7FFC67EB20840D522A22D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download