3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2

Analysis

max time kernel
148s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
Size 8.5MB
Sample261001-rmgcsszflh
SHA256 3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2
MD5 1a1402a88de92c50443650cbf56888e0
SHA1 e246c8fa695b577b1b961c724f8b576f19f125c5
SHA512 dc054296a4f6ea628aec1af5ee8db0031e33031c585c896e03abfd65266ce38610dc7f0afc3efaf235381eca506939fdb9ea7cb1af876c978b3db8088b556374
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3Ypt:TDpbgBr/4QAMQMrEGRONY/4VXxC3YL
TLSH
T1739633EA786E5ABBD20E1C3A8E068D2275AC5BB1C7545CD7FFC57EB60440C431622E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	BackgroundTask.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	WindowsInternal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	InputService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	WindowsShell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	WindowsInternal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	WindowsHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	UserSession.exe

Executes dropped EXE 15 IoCs

pid	Process
4888	WindowsShell.exe
1308	WindowsHost.exe
4544	WindowsHost.exe
1416	UserSession.exe
4048	UserSession.exe
3484	BackgroundTask.exe
3348	BackgroundTask.exe
3632	WindowsInternal.exe
2420	WindowsInternal.exe
2424	WindowsInternal.exe
2124	WindowsInternal.exe
1232	InputService.exe
624	InputService.exe
2796	InputService.exe
1724	InputService.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\WindowsShell.exe\""	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsHost.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\BackgroundTask.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsInternal.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\InputService.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe

Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
61	raw.githubusercontent.com
64	raw.githubusercontent.com
98	raw.githubusercontent.com
129	raw.githubusercontent.com
140	raw.githubusercontent.com
145	raw.githubusercontent.com
156	raw.githubusercontent.com
32	raw.githubusercontent.com
33	raw.githubusercontent.com
102	raw.githubusercontent.com
109	raw.githubusercontent.com
126	raw.githubusercontent.com
159	raw.githubusercontent.com
51	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x0007000000024242-27.dat	suspicious_telegram_bot
behavioral1/files/0x000700000002424e-46.dat	suspicious_telegram_bot
behavioral1/files/0x000700000002426f-114.dat	suspicious_telegram_bot
behavioral1/files/0x0006000000022c4e-143.dat	suspicious_telegram_bot
behavioral1/files/0x0005000000022c52-174.dat	suspicious_telegram_bot
behavioral1/files/0x000500000001e6a6-214.dat	suspicious_telegram_bot
behavioral1/files/0x0006000000022c52-250.dat	suspicious_telegram_bot
behavioral1/files/0x000600000001e6a6-285.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 32 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UserSession.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	BackgroundTask.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	InputService.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4828	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
4828	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
4828	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
4828	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
4828	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
4828	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
4828	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
4828	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
4888	WindowsShell.exe
4888	WindowsShell.exe
4888	WindowsShell.exe
4888	WindowsShell.exe
4888	WindowsShell.exe
4888	WindowsShell.exe
4888	WindowsShell.exe
4888	WindowsShell.exe
4888	WindowsShell.exe
4888	WindowsShell.exe
1308	WindowsHost.exe
1308	WindowsHost.exe
1308	WindowsHost.exe
1308	WindowsHost.exe
4544	WindowsHost.exe
4544	WindowsHost.exe
4544	WindowsHost.exe
4544	WindowsHost.exe
4544	WindowsHost.exe
4544	WindowsHost.exe
4544	WindowsHost.exe
4544	WindowsHost.exe
1416	UserSession.exe
1416	UserSession.exe
1416	UserSession.exe
1416	UserSession.exe
4048	UserSession.exe
4048	UserSession.exe
4048	UserSession.exe
4048	UserSession.exe
4048	UserSession.exe
4048	UserSession.exe
4048	UserSession.exe
4048	UserSession.exe
3348	BackgroundTask.exe
3348	BackgroundTask.exe
3348	BackgroundTask.exe
3348	BackgroundTask.exe
3484	BackgroundTask.exe
3484	BackgroundTask.exe
3484	BackgroundTask.exe
3484	BackgroundTask.exe
3484	BackgroundTask.exe
3484	BackgroundTask.exe
3484	BackgroundTask.exe
3484	BackgroundTask.exe
2420	WindowsInternal.exe
2420	WindowsInternal.exe
2420	WindowsInternal.exe
2420	WindowsInternal.exe
3632	WindowsInternal.exe
3632	WindowsInternal.exe
3632	WindowsInternal.exe
3632	WindowsInternal.exe
3632	WindowsInternal.exe
3632	WindowsInternal.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1308	4888	WindowsShell.exe	98
PID 4544 wrote to memory of 1416	4544	WindowsHost.exe	107
PID 4048 wrote to memory of 3348	4048	UserSession.exe	115
PID 3484 wrote to memory of 2420	3484	BackgroundTask.exe	118
PID 3632 wrote to memory of 2424	3632	WindowsInternal.exe	121
PID 2124 wrote to memory of 1232	2124	WindowsInternal.exe	124
PID 624 wrote to memory of 2796	624	InputService.exe	127

C:\Users\Admin\AppData\Local\Temp\3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
"C:\Users\Admin\AppData\Local\Temp\3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4828

C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\WindowsShell.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1308

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1416

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3348

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2420

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2424

C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\WindowsInternal.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\InputService.exe
  "C:\Users\Admin\AppData\Local\Temp\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1232

C:\Users\Admin\AppData\Local\Temp\InputService.exe
"C:\Users\Admin\AppData\Local\Temp\\InputService.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2796

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
MD5 eb444c59d03b1567ebbb5e58480a6eef
SHA1 e638b0d4f8bc77cb263d4e561ca3cfd1e286432b
SHA512 43cc6537c3b42c6a520ad798c7d57f02e3a6770d08ee501ac16a6db81365e6c09ba75a15d2b614b2b19ab3d667c9753a671c6e77a54797011705393da73686f8
TLSH
T1D9E0721A362DC0DABF6A49394A6250BF78A1008F00CD855A342C87F84C8262F9F0BA08
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 d44246f1e72024ac887ffe497e83fc073b50b0ca0221a7face0e33420dd3edf5
MD5 649cb75e645f1ea79ce66439cd04caef
SHA1 f3473e023316ea29f7831e5398700b4e6799810a
SHA512 9d6f94eca315df5d05c49b2d481bb2c79455495706b9e845770ca23696a13a0c7bfe3ad19b059d988a969c29c243a02b502e2984587c3f4d0a600f2d202d5733
TLSH
T14241FAD9AF1C3064FF838E84657CCB332D38B1C18985548934FB48F264C9BD55D1A48C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
MD5 32d66548cf2a8f1b6b0ab9d6c335806c
SHA1 69e42d1c9f5e7760749da4331591e196bba4b81d
SHA512 f8d7ae900b29dbddb66293c320367f3b4dc41ecd372baed0f690bd657d8d92c77f8dd5cb3a10b7d93e1b1d7ed2a90c12d3461dde8845e2c7eeef1ff2c3237842
TLSH
T1A3D02B1D15F56D137E27991487E8E56174651A2713D0485C14498677A8015E9194F704
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 180KB
SHA256 32f5af5e460ef5109236f44520aad24427a7e4469ce5b2e64acb8d4f6603c5b9
MD5 351df87f595a602cf9ccc3f0c5c4a7dc
SHA1 87a7c2f1bd28f5b6750abcb67be84ce38f91805a
SHA512 b0fb21f40875d07b0824a5662ae8efd6d90f808f82ddf8276a89f942557dbd96b2b9a649aeac642aba770f31553ddab34c9c2f171aec0fb1a352a1f172931ae8
SSDEEP 3072:QbxtZb/ECmTwDAvW4wA+lQQti7X+hqheCD6OdDm:4xth/CRvPwAXoMOhqhPno
TLSH
T13A044C646DBBB5A35E4ACE620C99BA9612F561DD2012771FBE306E105D03ABFCF17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 8c7602efe22cb85666dfca8b597ad0f33617fdd861c8bf7e951c305dfe59b3dc
MD5 de10d5794ceacb41f46aacbc68d07747
SHA1 167aa5e4fd0a87215579791b0bcfa181d7848ada
SHA512 6d7a173bbe00ac650b201daa93ebc17e0d4f345d5d321643ec500a76356f2e300ca626f3a414321e9c09eaf98258e5ef52c5f87cbb2b8a6d52d7636bce097323
TLSH
T1131121865FF4A1909AE356A0CAF8E1367CB424C66DEA34822CC688E2245776D7F0443E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 ba70091f399defb559d20c1604c0cff58e28912476dc12701aff5800d69bfc4e
MD5 93e5bd2318728932ec24e37fcc9e938c
SHA1 1b8a2fa29a4352651ca9171f622de11fb54490c1
SHA512 363cf2e44911ad34c3efd2041bfcec98c5cc10a7c8b3014a6c8b12f36943bee7f18d5560f86a7ee897b717f4757f2730e031841fb5a5934a1553b93fad256d01
TLSH
T16141E9D71B4634A47F469FD1A9BDC7362D7C68B4D1800882B9BBC48700EEB851D0B84D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 89db1937cd170af77471d76e4804a1de93b72a496b5b57b51492b4c125f07b98
MD5 9c25885cdb9de95a8afa10b530f73085
SHA1 96af0f517eed9e67a3fed47c68ef372ea854823e
SHA512 98c8ee6cca851f5ec6f6485a15388ffae6881bce56c6ea46d313f24ab0a8e8fc204e88a370548a14c02c7864d345e3526d8210f66d8c1dac7d123ecc8779e0a0
TLSH
T1B3C08C1C1AA25A06F3E843BC22C139439B619101E245CF052AF52A48CD96B162C38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 f57d93ebf945d4535a55a026e7d4a4774c0b51b504952a0e4d7aa683de1cc988
MD5 31becf305947d3156ff4c8f368291c25
SHA1 3787f4a3ce3764dd5efa1168ae1960bffb672bed
SHA512 81fa4ff4ca76d9cddf3cfb6d839d8f758caaa414220723971791da47d9c7e2f030898c5b8833c049fc2512fbc352b8a388c1eaa142e0323877e1426ae39d35ee
TLSH
T133F05C3C12F8805DE071EB794ED5A2D56C14F123380485F94EA047489A05F015C9253D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 a71d057d0c9232b9d1e07839928aa0d6b4d3a1213f544fd8f3f258cb18aa0152
MD5 4e05c3f5428e227ffb51e0aa8250180f
SHA1 b901ceb31be7a50dd2b4569bf3ba40924ff37b25
SHA512 591e0bb1458904011ae26e6b8f25b956c185f88d95ac64eab057b4cf7bf65afbf669d572e80933aea933b6b7f6f1d17394df0ab163ffb1dbe744cadb831bc7d5
TLSH
T103F061343EFA813BF537DD355FC5707E0516F30720022A7E167053546B12D10AC92165
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 8268f5f2e3757c695a3ab2b0c3cb87ddea3dcf95a163a66bec422b7b64133283
MD5 d360e92f910f53dc8c0a497c696d72c9
SHA1 d95f0a3201c23cb78d73fe6139ff1653c8a44804
SHA512 102826948ec120a0dcea5fecb72b1b6070b61e574d241b10e90a955baa4a0f6ef8826954ab92c8fa773ab3b1bd98cdb4e15a8c444cab041c9571db4f242187d8
TLSH
T1F7F0AB0028BD403EF4B3EDF5C6E122B6F939F215780583F60B9A0281AB52A010D9312F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 becf90d213a52568a8a7223e42e787f24cb829d28cd284d1197ae156f90aa1ed
MD5 12671c306243ac3a3d7519d5a2adb0f3
SHA1 7e635319af8239cbebbce4d88e4628e8015a0ab9
SHA512 ce74a6354d594540e262d4d641607b5d36dd92ed914c69c9d7eae14c449f93be473ee6a5f184e662906526cd4ef8bdd33056f51dfb5fc55b2d0ce9e80994f767
TLSH
T183D012243F163276F02192794DA646819F65710997D1CF991F77178D493CE922CB2E0D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 b8f4cf4553f31226c0831480502c7dcef83695329d6c12991eaf74cf43f29258
MD5 45c70a62e35add26d835bfc6936d7ae2
SHA1 d3547ebf0d843071f03fb9fa07834660c15c6f23
SHA512 2f76143d65e1e58c86424bf99894aca02c9987cec706a9b3d626b7259f93061d995fc70af428de4b56ebe78b80f0de2faad31c93f0a53c00fff474553f4a176b
TLSH
T110F05C352AD3015EF672663D49E853A5D904B7153405C49925920A4AEA67EC01D5283C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 adff298c8aaac3d8f7ce1c0d623db8d28fd48ebd4a9e5c4c55eaeffed1bfb665
MD5 8912550a2fe17989d19c978c46b749fa
SHA1 78ec3ebb49e01a9ae6977ae3b28a53f4695962a6
SHA512 2755edba9f763aa9a90e4742f8f2e6d4a6edb760a230824338914e3e507c8e89cf2f9d81f36c3c24c047590c30278480599cfdf2465077b7a76fc2940c494e34
TLSH
T1D6F02B3929AB015EF132DABE07C065D54977F33635842A957AE342096D09D00BD61969
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 3a2b95fc3159d0c9af545dc279bedeb95e14952463de5e7faea4e78478bb986c
MD5 97f5592ed83b04077d11ab38107109ba
SHA1 3f55c3db0e922ace4960c149590558e3f9bb2d19
SHA512 07cc7de78628c120dcc3347f4bb9bb53f44b36c5b0362a87c9ae9e506e48da6dcbfe2a90e73927d888bd379e267bf3e3a3b98aeee7f8d5e99dc57dbc184952b4
TLSH
T1F6C08C1C06620606F2A883B902C269838A609120F382AF0126B53A48CE24F122C34C29
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe
Size 9.1MB
SHA256 d8105d72e6afa94e9e0bccf28f9f106b16b668f118110b992f17eae18dd1f5d3
MD5 8272dd55384871799f07a0ebe3c5dae4
SHA1 0358d54efbaba990944457ad79579074e0a8dbc2
SHA512 df043e4f00339df564ced3b4500a5796f47616bcae136ee71c428fd4fc13599b86faa298b0fa043c5f7537b606c0bbb3e32f33ded7d6c7aa9dd2054ce8663bbb
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpLEUc:TDpbgBr/4QAMQMrEGRONY/4VXxC3YVE/
TLSH
T119A633EA746F5ABBD20E2C7A8D068D2236AC5BB1C7545CD7FFC57DA60440C432622E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
Size 9.2MB
SHA256 ac13b6caef36d1c2f97b98b50ed0b955e38b43c4cd26fdb3be68a0d54c204ccc
MD5 45a549205f34b16d55b803b1b238d52a
SHA1 e95ab639a5477adeec3ac4a7a184e4215ea48103
SHA512 5d3d7cf3f37db6bf7936b31636b51d531846cc00b87167e4a9f6d56f6724189d97526b7f3b3f9850ab19495f15a90472206a4d3d19bf48b6100597761b6c1bf7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpLEUr:TDpbgBr/4QAMQMrEGRONY/4VXxC3YVEg
TLSH
T1DEA633EA786F5ABBD20E2C7A8D068D2136AC5BB1C7545CD7FFC57DA60440C432622E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsShell.exe
Size 8.6MB
SHA256 f4078b1578ceffcdb670d3891654c8b4ae97abe815c18fdf1214c1051981fd8e
MD5 8062edb750db1d49e53cb2d3c702e581
SHA1 ea49d2336a01af0d06a0b0beb33a01090996c398
SHA512 2f96b90dc05756f670743c8ab2f67817ed1081f35675a27cf746f232ed56ef9e6e28b321ec2d64665b0bfe107924b988ce97c9627e7978c03dd61c2bb548745a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpLS:TDpbgBr/4QAMQMrEGRONY/4VXxC3YVS
TLSH
T1829633EA786E5ABBD20E1C3A8D06CD2275AC5BB1C7645CD7FFC57EB60440C431622E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Temp\InputService.exe
Size 9.3MB
SHA256 1ce8f6a6269bb95370539efad8a7c016aa115c6d3f8ea764c084b59a18a6d0fc
MD5 69e5c01fbb470945037ee5ae3d01baee
SHA1 47d404e53fb968f25279798ac62ec219b5ac7780
SHA512 a0c1fc871a91542d29732d487d99c3430014d9ccf39d50ee04e0db3909ade1c51da828688fc0ad1755e014bb220e2b6431ff0b512d897bbc846641e3c61301ed
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpLEUj:TDpbgBr/4QAMQMrEGRONY/4VXxC3YVEW
TLSH
T1E0A633EA746E5ABBD20E2C7A8E068D2136AC5BB1C7545CD7FFC57DE60440C432622E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
Size 8.9MB
SHA256 8e5f0ce4655c06d6953dbeee14da9268334b0fc83959969685b6ae540dc5b0af
MD5 a0b848194a31d9953f426bc4ea5c2d4c
SHA1 19a200816d141c3f381fbefe45f72342f68f7802
SHA512 69255fb5ea8982218403b07569ccc721667beae249e0d2e6a78d42902102ff3ac1e33a5fb94e6725408be774b4dc82073edca3142aaa937bd78b18bf9aa3593b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpLEf:TDpbgBr/4QAMQMrEGRONY/4VXxC3YVEf
TLSH
T1A99633EA786F5ABBD20E2C7A8D068D2235AC5BB1C7545CD7FFC57DB60440C432622E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
Size 8.7MB
SHA256 bbcccf3f74d129f41b12acd9259f46ebfa30d4faa44274fceefee0143eb67a51
MD5 0c1435dcfcd6c3b2d0da5bed80e9dab2
SHA1 ad0b1bfe2bb83070f03103dfd0d682af2582d76a
SHA512 df287917744d6e50575c5b811a87887dd3546a757c508a5b112b9d9fccfcebf72241eeb438535db4a346a7375e88f4dfbd10ebef32267f739d7484461c5afd39
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpLE4:TDpbgBr/4QAMQMrEGRONY/4VXxC3YVE4
TLSH
T1A79633EA786F5ABBD20E1C7A8D068D2235AC5BB1C7545CD7FFC57EB60440C432622E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
Size 9.4MB
SHA256 01eac6ec0b7e5315602f8156029bf0c64d36e6ca7c8a7baf44495d913ff291e2
MD5 b105b15bde6280f2b766231000a4360b
SHA1 1736a6e8d8d17af4ec65eea8d21c07e7b75ddb89
SHA512 ac9bfab77ff09b2af93284fcf04447566fb7b91d77b7d84e392d3c7ecf1dc6d804de7e29b7ebef2d727c00fb115fc8958672fb457219f072aebd49852c978253
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpLEUNG:TDpbgBr/4QAMQMrEGRONY/4VXxC3YVEL
TLSH
T1B9A633EA746E5ABBD20E2C7A8E068D2136AC5BB1C7545CD7FFC57DE60440C432622E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
Size 8.8MB
SHA256 52c58069b3bc49f362862d47cf4c2a03062c195ea9964a8906a5b0c573c1e79d
MD5 7518834117bbd51971344d628c8f5a54
SHA1 0b9137ae836ac726e55455883b5308972e204a1e
SHA512 a4b9ab643009c3f89010aa691502f305003f6b76ffcadd3c6a30374c608f991195ecc876552e754f9a687c062c4094c953a3fd2eddc66983fbed8cd9fb6b596e
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpLEE:TDpbgBr/4QAMQMrEGRONY/4VXxC3YVEE
TLSH
T1809633EA786E5ABBD20E2C7A8D068D2235AC5BB1C7545CD7FFC57DB60440C432632E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download