Overview

overview

7

Static

static

5

2c2e3cb5df...8b.exe

windows10-2004-x64

7

2c2e3cb5df...8b.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    136s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 15:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2c2e3cb5df359b978a0bb3b0d64b440ecd05a282defcb9b0cfd83572babc938b.exe
  • Size 6.4MB
  • Sample261001-sr5rmavbjg
  • SHA256 2c2e3cb5df359b978a0bb3b0d64b440ecd05a282defcb9b0cfd83572babc938b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 20 IoCs
  • Adds Run key to start application 2 TTPs 17 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Detect suspicious telegram bot 14 IoCs

    Detect suspicious telegram bot.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 40 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c2e3cb5df359b978a0bb3b0d64b440ecd05a282defcb9b0cfd83572babc938b.exe
    "C:\Users\Admin\AppData\Local\Temp\2c2e3cb5df359b978a0bb3b0d64b440ecd05a282defcb9b0cfd83572babc938b.exe"
    1⤵
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
      "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe" --monitor
      2⤵
      • Executes dropped EXE
      PID:248
  • C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
    "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
      "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3412
  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
    "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5140
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1060
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5716
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3644
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:5896
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:920
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5588
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:5868
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Users\Admin\AppData\Local\Temp\SystemHost.exe
      "C:\Users\Admin\AppData\Local\Temp\SystemHost.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:3456
  • C:\Users\Admin\AppData\Local\Temp\SystemHost.exe
    "C:\Users\Admin\AppData\Local\Temp\\SystemHost.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe
      "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:2180
  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe
    "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2972
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe" --monitor
      2⤵
        PID:4116
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe"
      1⤵
        PID:5276
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe" --monitor
          2⤵
            PID:3420
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe"
          1⤵
            PID:2652

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                103621DE9CD5414CC2538780B4B75751
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                • Size 808B
                • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
                • Size 313B
                • SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
                • Size 2KB
                • SHA256 d44246f1e72024ac887ffe497e83fc073b50b0ca0221a7face0e33420dd3edf5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                421EC2E1E0F47FC59DB99BB19E16DA88
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
                • Size 280B
                • SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                49A7F8B8A2FD8A9E65352CD7C88B1D10
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
                • Size 180KB
                • SHA256 029a5011889e4a47243c66d2aa8849c7daad04661b56ba9b1e44453c5f1e2c5d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
                • Size 976B
                • SHA256 8c7602efe22cb85666dfca8b597ad0f33617fdd861c8bf7e951c305dfe59b3dc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
                • Size 2KB
                • SHA256 ba70091f399defb559d20c1604c0cff58e28912476dc12701aff5800d69bfc4e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                F15827BEC5BABE89C21DCDAE77464BF1
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
                • Size 701B
                • SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                103621DE9CD5414CC2538780B4B75751
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                • Size 192B
                • SHA256 69ca95cf7d29213e939a69366c77a3529dd2b2383033d4f47301dd0a8b3f3aad
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
                • Size 488B
                • SHA256 c52dc24191c8806aa54da1e6251021cde214c6d59767eba12f0a7ac124aab9bc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
                • Size 450B
                • SHA256 4933b60812ffbe0b4a79380c9e0068d378fad7ca54fcb8480bc247ef88073ce5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                421EC2E1E0F47FC59DB99BB19E16DA88
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
                • Size 484B
                • SHA256 7d753fb229439c5681705aa61be305b5f794e6787dac6a1a522afe70ee1d2b8b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                49A7F8B8A2FD8A9E65352CD7C88B1D10
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
                • Size 248B
                • SHA256 dff8588d44380f748bd315df32f3c3fb834cf6ba5b5d12b68fd9c9f5f152eda3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
                • Size 488B
                • SHA256 704fe0cb4b93715b8171c800c2c36c1227dfb2ec498c1d2150cd7fbc1cd3d0c9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
                • Size 474B
                • SHA256 7ac2f4f8dbce6875f8052f13ea20d18781d0e54ce6ce900802c8b05e19d64f87
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                F15827BEC5BABE89C21DCDAE77464BF1
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
                • Size 192B
                • SHA256 14d6b524d729b56b1117df60ec4bba1ee40e3e1212fa827f8e5387348f2c37f3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                WindowsShell.exe
                • Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
                • Size 6.5MB
                • SHA256 c0cbf20e5f876670152d6e2f3ef481a08ad6270a5f72c4ee3d9838c8f1bb6a7f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                InputService.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
                • Size 7.0MB
                • SHA256 93108cf27a2b4cd8971493469efca20f1b9536f2ce8f802c292ecace77f24ec8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RuntimeBroker32.exe
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
                • Size 6.6MB
                • SHA256 d49f60393016737aef175b792be5ba5042ee3e81a018d9ae3c4c39e3b36f9a58
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SecurityCore.exe
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe
                • Size 7.5MB
                • SHA256 ff7d48ef8c726a91bf4eec45c00813d8e3eb033186edb68064fe81f05ce13620
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SystemHost.exe
                • Path C:\Users\Admin\AppData\Local\Temp\SystemHost.exe
                • Size 7.4MB
                • SHA256 f313da2d9cb85b0d602d706e9b51e7a8ed72c36fc2a717d20afe7ad561cd26c7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CoreSystem.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
                • Size 7.2MB
                • SHA256 46cf8f92a26008193431c6cf03fbd180d1d620a50da33e3a6132baaedfba24cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                UserSession.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
                • Size 6.8MB
                • SHA256 bbd28c72c246513ad4ebe12243ad0eac58db7108dbf6ed99d5d5986e2139fc53
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                BackgroundTask.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe
                • Size 3.9MB
                • SHA256 c91737848c4bb0820fcbf0423e365abbecc057f7efeaf47788bbc1ab587fbe0b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                BackgroundTask.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe
                • Size 4.1MB
                • SHA256 ce23bd04119e5f0c64d56c9064540b2b2b2825bc3e3a21f4d28e5473383fea07
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                BackgroundTask.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe
                • Size 2.8MB
                • SHA256 d6c1ef845dd2aff3fec9504797c41a9e803911298ff5da4dd150f02d90f967ec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CoreSystem.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
                • Size 332KB
                • SHA256 efc8088c2f3425b618cfd27ac515c9eb2ec9974fd396e415693c73cdc98b83dc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                InputService.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
                • Size 7.3MB
                • SHA256 5d1ce7abafdd123b5d7998f0ff65c63bcee161735cc11be11b430db0af752da7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                NetworkHelper.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
                • Size 6.9MB
                • SHA256 19a848980b12a93111579de5f0499453a3f92a734ae408164492e7b54e91b855
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WindowsShell.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
                • Size 6.7MB
                • SHA256 275adec3319c8830b2b5a0e5c93f5ccdf0b86c1ac5d1f43a8cc993b45ab7b721
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download