3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
Size 8.5MB
Sample261001-rmgcsszflh
SHA256 3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2
MD5 1a1402a88de92c50443650cbf56888e0
SHA1 e246c8fa695b577b1b961c724f8b576f19f125c5
SHA512 dc054296a4f6ea628aec1af5ee8db0031e33031c585c896e03abfd65266ce38610dc7f0afc3efaf235381eca506939fdb9ea7cb1af876c978b3db8088b556374
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3Ypt:TDpbgBr/4QAMQMrEGRONY/4VXxC3YL
TLSH
T1739633EA786E5ABBD20E1C3A8E068D2275AC5BB1C7545CD7FFC57EB60440C431622E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1384	WindowsShell.exe

Executes dropped EXE 17 IoCs

pid	Process
2224	WindowsShell.exe
1384	WindowsShell.exe
1896	InputService.exe
4492	InputService.exe
4584	BackgroundTask.exe
5728	BackgroundTask.exe
2484	BackgroundTask.exe
5516	BackgroundTask.exe
1436	UserSession.exe
1520	UserSession.exe
200	WindowsHost.exe
2560	WindowsHost.exe
5284	SystemHost.exe
4164	SystemHost.exe
1612	NetworkHelper.exe
1704	NetworkHelper.exe
5344	SystemHost.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\InputService.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\BackgroundTask.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsHost.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SystemHost.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\UserSession.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SystemHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsShell.exe\""	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe

Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
114	raw.githubusercontent.com
9	raw.githubusercontent.com
36	raw.githubusercontent.com
63	raw.githubusercontent.com
72	raw.githubusercontent.com
85	raw.githubusercontent.com
97	raw.githubusercontent.com
110	raw.githubusercontent.com
1	raw.githubusercontent.com
25	raw.githubusercontent.com
39	raw.githubusercontent.com
51	raw.githubusercontent.com
82	raw.githubusercontent.com
107	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c63d-30.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c63e-105.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c641-139.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c642-173.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c641-208.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c644-241.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c646-270.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c644-303.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c646-337.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1944	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
1944	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
1944	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
1944	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
1944	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
1944	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
1944	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
1944	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
1384	WindowsShell.exe
1384	WindowsShell.exe
1384	WindowsShell.exe
1384	WindowsShell.exe
2224	WindowsShell.exe
2224	WindowsShell.exe
2224	WindowsShell.exe
2224	WindowsShell.exe
2224	WindowsShell.exe
2224	WindowsShell.exe
2224	WindowsShell.exe
2224	WindowsShell.exe
4492	InputService.exe
4492	InputService.exe
1896	InputService.exe
1896	InputService.exe
1896	InputService.exe
1896	InputService.exe
4492	InputService.exe
4492	InputService.exe
4492	InputService.exe
4492	InputService.exe
4492	InputService.exe
4492	InputService.exe
5728	BackgroundTask.exe
5728	BackgroundTask.exe
5728	BackgroundTask.exe
5728	BackgroundTask.exe
4584	BackgroundTask.exe
4584	BackgroundTask.exe
4584	BackgroundTask.exe
4584	BackgroundTask.exe
4584	BackgroundTask.exe
4584	BackgroundTask.exe
4584	BackgroundTask.exe
4584	BackgroundTask.exe
2484	BackgroundTask.exe
2484	BackgroundTask.exe
2484	BackgroundTask.exe
2484	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
1436	UserSession.exe
1436	UserSession.exe
1520	UserSession.exe
1520	UserSession.exe
1520	UserSession.exe
1520	UserSession.exe
1436	UserSession.exe
1436	UserSession.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1384	1944	3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe	91
PID 2224 wrote to memory of 1896	2224	WindowsShell.exe	92
PID 4492 wrote to memory of 5728	4492	InputService.exe	98
PID 4584 wrote to memory of 2484	4584	BackgroundTask.exe	99
PID 5516 wrote to memory of 1520	5516	BackgroundTask.exe	104
PID 1436 wrote to memory of 200	1436	UserSession.exe	105
PID 2560 wrote to memory of 4164	2560	WindowsHost.exe	110
PID 5284 wrote to memory of 1704	5284	SystemHost.exe	113
PID 1612 wrote to memory of 5344	1612	NetworkHelper.exe	114

C:\Users\Admin\AppData\Local\Temp\3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe
"C:\Users\Admin\AppData\Local\Temp\3a420a7ebffaaa26cdf690df1ed67e65b88400559812e5f32eee2d9e957e2de2.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1384

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5728

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2484

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Users\Admin\AppData\Local\Temp\UserSession.exe
  "C:\Users\Admin\AppData\Local\Temp\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1520

C:\Users\Admin\AppData\Local\Temp\UserSession.exe
"C:\Users\Admin\AppData\Local\Temp\\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:200

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4164

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1704

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
MD5 eb444c59d03b1567ebbb5e58480a6eef
SHA1 e638b0d4f8bc77cb263d4e561ca3cfd1e286432b
SHA512 43cc6537c3b42c6a520ad798c7d57f02e3a6770d08ee501ac16a6db81365e6c09ba75a15d2b614b2b19ab3d667c9753a671c6e77a54797011705393da73686f8
TLSH
T1D9E0721A362DC0DABF6A49394A6250BF78A1008F00CD855A342C87F84C8262F9F0BA08
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 d44246f1e72024ac887ffe497e83fc073b50b0ca0221a7face0e33420dd3edf5
MD5 649cb75e645f1ea79ce66439cd04caef
SHA1 f3473e023316ea29f7831e5398700b4e6799810a
SHA512 9d6f94eca315df5d05c49b2d481bb2c79455495706b9e845770ca23696a13a0c7bfe3ad19b059d988a969c29c243a02b502e2984587c3f4d0a600f2d202d5733
TLSH
T14241FAD9AF1C3064FF838E84657CCB332D38B1C18985548934FB48F264C9BD55D1A48C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
MD5 32d66548cf2a8f1b6b0ab9d6c335806c
SHA1 69e42d1c9f5e7760749da4331591e196bba4b81d
SHA512 f8d7ae900b29dbddb66293c320367f3b4dc41ecd372baed0f690bd657d8d92c77f8dd5cb3a10b7d93e1b1d7ed2a90c12d3461dde8845e2c7eeef1ff2c3237842
TLSH
T1A3D02B1D15F56D137E27991487E8E56174651A2713D0485C14498677A8015E9194F704
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 180KB
SHA256 32f5af5e460ef5109236f44520aad24427a7e4469ce5b2e64acb8d4f6603c5b9
MD5 351df87f595a602cf9ccc3f0c5c4a7dc
SHA1 87a7c2f1bd28f5b6750abcb67be84ce38f91805a
SHA512 b0fb21f40875d07b0824a5662ae8efd6d90f808f82ddf8276a89f942557dbd96b2b9a649aeac642aba770f31553ddab34c9c2f171aec0fb1a352a1f172931ae8
SSDEEP 3072:QbxtZb/ECmTwDAvW4wA+lQQti7X+hqheCD6OdDm:4xth/CRvPwAXoMOhqhPno
TLSH
T13A044C646DBBB5A35E4ACE620C99BA9612F561DD2012771FBE306E105D03ABFCF17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 8c7602efe22cb85666dfca8b597ad0f33617fdd861c8bf7e951c305dfe59b3dc
MD5 de10d5794ceacb41f46aacbc68d07747
SHA1 167aa5e4fd0a87215579791b0bcfa181d7848ada
SHA512 6d7a173bbe00ac650b201daa93ebc17e0d4f345d5d321643ec500a76356f2e300ca626f3a414321e9c09eaf98258e5ef52c5f87cbb2b8a6d52d7636bce097323
TLSH
T1131121865FF4A1909AE356A0CAF8E1367CB424C66DEA34822CC688E2245776D7F0443E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 ba70091f399defb559d20c1604c0cff58e28912476dc12701aff5800d69bfc4e
MD5 93e5bd2318728932ec24e37fcc9e938c
SHA1 1b8a2fa29a4352651ca9171f622de11fb54490c1
SHA512 363cf2e44911ad34c3efd2041bfcec98c5cc10a7c8b3014a6c8b12f36943bee7f18d5560f86a7ee897b717f4757f2730e031841fb5a5934a1553b93fad256d01
TLSH
T16141E9D71B4634A47F469FD1A9BDC7362D7C68B4D1800882B9BBC48700EEB851D0B84D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 967c62a8c8d4e6c9143558e79924887999a91884f91e45f9c546cad59a442763
MD5 2271e41d114df6c307f2751cf43d2d84
SHA1 1ff071266349523713ccdb62762a7f8f262ee0c8
SHA512 6478c510b247d97600f11364fd4c533577ca0b40f354e7a381a25d5eb6eb60fbb80aca4eceaa95ab61d23b2581abedda22d60e827de4a5e7c907e481080a1d06
TLSH
T124C08C1C1AA25A1AF2A8437C06C13D43AB208101E2458F051BF23A48C99AB162D38C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 3fd9089b2f3faf50741e7c0a11b54caa95d079ad139df822d2b20232b3fbc248
MD5 d85fbcc16f098ccee6a59a8d01a91970
SHA1 1b55d533ea3a4da0b76355c542d8efceee6e2dfc
SHA512 b4e20a3a0a32ce6d9a87782e80ea896ce8396346345b1350644c45d993741ef971d85dd7bdcea4d47a51241b210c28c81a1c1459f3fd83481b7df7f952f92338
TLSH
T17DF0EC3C12F8805DE075EB758ED5B2D56D15F523380485A95EE1464CDA05F055CA253D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 7af400003792d80bc9f72a4488c1d978132e5917c647d6fc79d9bba0c55eb4e4
MD5 4d97b454226ded14e2dae562cf7f0149
SHA1 40e3fea2f21fd10071448741f689aa17d0f8d915
SHA512 8ee26ae79b9f400437705a520cd8465f6c231b33255c5ddf32c89a5a6085544df32f089897c8d55dfbaf2d430c5a5a8b646f6bf7519717b05e6a28f467dc351a
TLSH
T12FF061343EFA817BF537DD355FC5707E0516F20720022A7E167053545F12D50AC51165
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 c42e8960d8a17c40f70405dcde9735a0592ffa44eb318b6ca94637133872a8c9
MD5 55487cd27fb6894dec181371ce1fd1a4
SHA1 23fb0b2767aa6d8635c09befc5b279c2b64fff8f
SHA512 8d5e07da90bc085f48c7b1f4c026c308a6dc4a3b636efd5d9870a7593f8742a7fa1eb1ebac1b654eda9bf0d565e728347be5f6d90147490001d8d9daa40e36e8
TLSH
T187F0AB0028BC402DF8B3EDB4C2E122B6F939F215780483F60B9A02415B52A010DA316F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 c14765f397d380d56337e182530dd048ce9b11bbf82f5cf1bf52578d04836ad8
MD5 f163ee5f2fbb2210917c494d34591bfb
SHA1 ba958ebd8b19c7896f0aea8639018db19f155917
SHA512 6cf6aa32b889ed0cf6420a45637bcd613b783503117179061e636396e641bc0badc5bcab6676ee21f104dc7272451c7df2613cd9a8533124780b2c188a642288
TLSH
T179D022243B117232F02092794DA206818F21224683C0CF091F63178C083CF821CB2E0D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 ba315ad22ff5e739644ace660cffd973d3875bfd1db217e19a25107b8920a8ae
MD5 e8ae845da08455061bc3bbcb132ae0eb
SHA1 3980c2ea020780974c5d50cc5d25b566eacca68f
SHA512 bcce02f7d9e11a57d58a313a2ef35448f1c83b482089dec2cad4a0e3b58ec53f0260f0eb35c9fa93f7354a7e5e9cd0564bf76094520417283f1b3d04e093556d
TLSH
T148F05C342AD3415EF672663D4AE853A5D914B7053405C45926920A4AEA77FD01D5283C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 f864544fa2154ebeb8cd1efac997512a79776ea7656250c8ab9d5223d5ed4ec1
MD5 d0d4c15733d48ef1732acb9a4e809d19
SHA1 ca648ad1b0c3de2efcf432127170d9da951a9bbd
SHA512 a12a474120ab0698e427dbf6af3ab1f9471979a48e06405ea1143b6d4c79a2807ed51aca0006d3190079afcd5fce70c46356ef62339bc123e2581ed42e3d68a9
TLSH
T1D4F0AB3829AB015EF132CABE07C025E44973F33634842B957AE342046D09D00BC61929
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 d28cf5eab850eb1fbc6d90f7a175816bd87d05bd5b657df0a69727d42d2424ce
MD5 0f82dfb982c4dcddc32ae5ca86e57055
SHA1 fbf6de0531e2436fccebd683f5b462b2ab146e3f
SHA512 99b2d2466c1224b7b0e339808859156ff45235a676a44f99734c64b762ad1090876b1094a2b0726192af0c6bbfe9016d8c58da44ed05e2d20d7db15d7658afa1
TLSH
T1EBC08C1C46654606F2A883B902C269838A218110F3819F0127B16A9CCDA8F122C34C2A
MD5 SHA1 SHA512 TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe
Size 9.3MB
SHA256 7bf589137214d83b7925105599c349a2267459f5d32ce67695fbd3d4bd160f70
MD5 4b8607542c420b94a71fc8b75c29fc3c
SHA1 075e0dc8ca9b9962c95f1ccc804699cb6f00d7b3
SHA512 6ee318beb018e0326e6e72b59ede82599b91044139636fb4eef377a62a206b442304d33a111c6a2122add7ee84d7fb2d6fee40ca2d50e97b757fbbdf4160174a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpYqz:TDpbgBr/4QAMQMrEGRONY/4VXxC3Ymw
TLSH
T129A633E9786F5AABD21E1C3ACE068D2275AC57B1CB545CC7FFC57DB60840C431A22E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe
Size 9.5MB
SHA256 84dd4ca409ae139ffda9f357adff257dfdb1e352cdcc39e6444576bfb052b57e
MD5 65a6f0fef0087b5bd83b1f82af728780
SHA1 6fb8e3c433be200dc8b393c879700d7f60422ece
SHA512 e3c92f9204d460a287eb4e6345263eb809188c92d490c3f5d7d0c82c5c5a38af5aaa0ca236d59d043756f1c15b2f121a1761be6127541195ebae8435d9638e84
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpYqWD:TDpbgBr/4QAMQMrEGRONY/4VXxC3YmpD
TLSH
T1D2A633EA786F5AAFD21E1C3ACE068D2275AC57B187545CC3FFC57DB60840C531A22E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Temp\UserSession.exe
Size 9.0MB
SHA256 5daea7594fa1db8c02e327c59482389dd6d88f3e06d2be79df26fce7dc3292cd
MD5 02c0fdcaa359a39dc5e1adc48773709e
SHA1 9a25cf488d428bb63ff8ca527ecf7d0bb959651a
SHA512 6e28b3b0509571a30ddf047c8814f7486450cf7212745e85b04759e83e8f2d8d3a6fcf78d48e1886a7d22f1af2154d04ae79224e52cceb29dcc19b0a9fcdb69b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpYp:TDpbgBr/4QAMQMrEGRONY/4VXxC3Ymp
TLSH
T15AA633EA786E5ABBD21E1C3ACE068D2275AC57B1CB545CC7FFC57DB60840C431622E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
Size 8.8MB
SHA256 f6716449fa9ca3ebbf127706fb70d9abdcef61b422321fe0c600aed514291994
MD5 452bb6f91008529cf2a190e8718c8638
SHA1 2b648aef9ab1d4b96edd30fbfa38fb70bc64b9cf
SHA512 e752eef63a29fe93534f95e2f34fba503f360b8f5bc94f9bcdbbb83a7da1784bc2b1d5221a17a597cad6ba24b9e656d1212d1baf7d8558b4812f38fafc9f2fcc
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3Ypt:TDpbgBr/4QAMQMrEGRONY/4VXxC3Y3
TLSH
T17B9633EA786E5ABBD20E1C3A8E068D2275AC57B1CB545CD7FFC57DB60840C431632E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe
Size 8.6MB
SHA256 6dc5a150293eea4feba0a4e77e63b678bc62ce15b6f8a996351fda26cb957939
MD5 e0501ddf292f8e1ecee4b1e7179751c1
SHA1 836938bdc598ac83bfb869d6ddbc259f40ad3b4a
SHA512 1a7f41cc077665bb9839ec273b83091133b9aa0baf73230413b8e21ce0c01337435ca92c7edc0ca72fc0e9694b1aa26deccdee4d7e6a317ca67f1d48c39a6471
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3Ypd:TDpbgBr/4QAMQMrEGRONY/4VXxC3Yb
TLSH
T1B69633EA786E5ABBD20E1C3A8E06CD2275AC5BB1C7645CD7FFC57DB60440C431622E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\InputService.exe
Size 8.7MB
SHA256 972751aac9758c301b75dbbcea049a0d1a418816268096dbba5badee8607af5e
MD5 cde7e95998f058e7dd4e5135f0650da0
SHA1 81401cff6599c7a05d8903b9b396e840f401797a
SHA512 c150dcc40c551bde4acb751e1d2d2d0f1230d39010990ebacf2f4d74918567de5d8720eb4b1d843153a7b26cecf4270a9c2d9f9f6c23479900917462021a685f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpA:TDpbgBr/4QAMQMrEGRONY/4VXxC3Yi
TLSH
T1869633EA786E5ABBD20E1C3A8E068D2275AC57B1CB545CC7FFC57DB60840C431632E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
Size 9.2MB
SHA256 f0588a16a4dbc3ea46f0270878f4cd8d295bb1e1a85901f23e608c3f1a0874f6
MD5 b669bb8dc4fdddba3c452f5776746395
SHA1 661d5c6bd86c752d016a35ac1ec7939383b9117b
SHA512 a69263c07d3df6611689dd6f7c8ad973ceda4965192f0c43cf034e0153c485c627501636a0988bdfa4359517ed033ef33bb4db145aa6ed3b0e0bc688da15c8be
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpYqG:TDpbgBr/4QAMQMrEGRONY/4VXxC3YmP
TLSH
T18DA633E9786E5AABD21E1C3ACE068D2275AC57B1CB545CC7FFC57DF60840C431A22E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
Size 8.9MB
SHA256 cc92a1a44eaa27f240be3a89496479a5abdafdc14e214af857dbc26cf412b2c3
MD5 1ca03606c2182c4a4710525dd34eae77
SHA1 5c0005d2a180fd7aecdfa701a34be7217071a42e
SHA512 95975a6347b955c152e1894801967472b0c1614bf6fe6c8864a50db89ee481fa0c4f25f46174983712d0c5f4979af8ea0e82c1f01f299a7e61192f0b729050d7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpYx:TDpbgBr/4QAMQMrEGRONY/4VXxC3Ymx
TLSH
T1809633EA786E5ABBD21E1C3ACE068D2275AC57B1C7545CD7FFC53DB60840C831622E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
Size 9.4MB
SHA256 fc75d722c5820836a6387dce6b6f9e47bafca706e1bd638000ff1cdd678ef0b0
MD5 2470544ec92903132b680a83c3f9aa08
SHA1 473efe6396028b4306efb9d592d80351ff6baa20
SHA512 779c966ccdd61eb62fb70dd90a7d07205cae04ae9b1de5545836411715f527997da2d2e31318787357f3ea979a3dec9516b5d7df2ce6480f94529087ad5f1cec
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVXTFC3YpYqE:TDpbgBr/4QAMQMrEGRONY/4VXxC3YmB
TLSH
T1A8A633E9786F5AABD21E1C7ACE068D2275AC57B1CB545CC3FFC57DB60840C431A22E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download