3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
Size 10.2MB
Sample261002-tav2jaxt5n
SHA256 3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff
MD5 00dc444cd8e01d2fc5714c6ec04e4551
SHA1 96cf7fad8b3b9d26aef218ce9edc39dd5169c93e
SHA512 f12f2cdb28ed3f70d8503faa11170b1bf069eaa32b0e74e60f88ee1610652011482504655fe6df6ef646424665f24e48cb4d7460dce0c20ef3638dc17b209756
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSo5CiSjk:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSwL
TLSH
T123B633EA785E6BABC10E5C3D8D0A8D6275FC5BB187648C97FFC63DB60840C521722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4668	SystemHost.exe

Executes dropped EXE 17 IoCs

pid	Process
6044	SystemHost.exe
4668	SystemHost.exe
5172	WindowsHost.exe
5940	WindowsHost.exe
6132	BackgroundTask.exe
3752	BackgroundTask.exe
3308	ServiceHost.exe
4760	ServiceHost.exe
3732	SystemHost.exe
2040	SystemHost.exe
4472	ServiceHost.exe
3872	ServiceHost.exe
5276	UserSession.exe
1996	UserSession.exe
3424	UserSession.exe
3808	UserSession.exe
4512	SystemHost.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemHost.exe\""	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\BackgroundTask.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\ServiceHost.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\WindowsHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\SystemHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\UserSession.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemHost.exe\""	UserSession.exe

Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
107	raw.githubusercontent.com
110	raw.githubusercontent.com
114	raw.githubusercontent.com
1	raw.githubusercontent.com
13	raw.githubusercontent.com
26	raw.githubusercontent.com
50	raw.githubusercontent.com
61	raw.githubusercontent.com
76	raw.githubusercontent.com
89	raw.githubusercontent.com
94	raw.githubusercontent.com
39	raw.githubusercontent.com
86	raw.githubusercontent.com
97	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c479-27.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c47c-105.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c47f-133.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c480-168.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c47f-202.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c481-235.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c482-272.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c481-306.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c482-341.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2444	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
2444	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
2444	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
2444	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
2444	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
2444	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
2444	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
2444	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
4668	SystemHost.exe
4668	SystemHost.exe
6044	SystemHost.exe
6044	SystemHost.exe
4668	SystemHost.exe
4668	SystemHost.exe
4668	SystemHost.exe
4668	SystemHost.exe
4668	SystemHost.exe
4668	SystemHost.exe
4668	SystemHost.exe
4668	SystemHost.exe
5172	WindowsHost.exe
5172	WindowsHost.exe
5172	WindowsHost.exe
5172	WindowsHost.exe
5940	WindowsHost.exe
5940	WindowsHost.exe
5940	WindowsHost.exe
5940	WindowsHost.exe
5940	WindowsHost.exe
5940	WindowsHost.exe
5940	WindowsHost.exe
5940	WindowsHost.exe
6132	BackgroundTask.exe
6132	BackgroundTask.exe
3752	BackgroundTask.exe
3752	BackgroundTask.exe
3752	BackgroundTask.exe
3752	BackgroundTask.exe
6132	BackgroundTask.exe
6132	BackgroundTask.exe
6132	BackgroundTask.exe
6132	BackgroundTask.exe
6132	BackgroundTask.exe
6132	BackgroundTask.exe
3308	ServiceHost.exe
3308	ServiceHost.exe
3308	ServiceHost.exe
3308	ServiceHost.exe
4760	ServiceHost.exe
4760	ServiceHost.exe
4760	ServiceHost.exe
4760	ServiceHost.exe
4760	ServiceHost.exe
4760	ServiceHost.exe
4760	ServiceHost.exe
4760	ServiceHost.exe
3732	SystemHost.exe
3732	SystemHost.exe
2040	SystemHost.exe
2040	SystemHost.exe
2040	SystemHost.exe
2040	SystemHost.exe
3732	SystemHost.exe
3732	SystemHost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 6044	2444	3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe	89
PID 4668 wrote to memory of 5172	4668	SystemHost.exe	92
PID 5940 wrote to memory of 3752	5940	WindowsHost.exe	98
PID 6132 wrote to memory of 3308	6132	BackgroundTask.exe	99
PID 4760 wrote to memory of 2040	4760	ServiceHost.exe	103
PID 3732 wrote to memory of 3872	3732	SystemHost.exe	107
PID 4472 wrote to memory of 5276	4472	ServiceHost.exe	108
PID 1996 wrote to memory of 3424	1996	UserSession.exe	111
PID 3808 wrote to memory of 4512	3808	UserSession.exe	114

C:\Users\Admin\AppData\Local\Temp\3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe
"C:\Users\Admin\AppData\Local\Temp\3579e99df5b0a4e7cafe79ce4102d10bb7674d35ff22a75cdb87e920c567e2ff.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6044

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5172

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3752

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3308

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2040

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemHost.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5276

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3424

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
MD5 eb444c59d03b1567ebbb5e58480a6eef
SHA1 e638b0d4f8bc77cb263d4e561ca3cfd1e286432b
SHA512 43cc6537c3b42c6a520ad798c7d57f02e3a6770d08ee501ac16a6db81365e6c09ba75a15d2b614b2b19ab3d667c9753a671c6e77a54797011705393da73686f8
TLSH
T1D9E0721A362DC0DABF6A49394A6250BF78A1008F00CD855A342C87F84C8262F9F0BA08
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 32e716a6021dd73b12f516c736662acd1f44fc9641f1680e1c5a42d0aee156ab
MD5 4fe729d0f5a1396c2f321be2dd04371b
SHA1 f4f060840a0586235a371a466aed518361597a85
SHA512 8899373629e5c4d2e124ad521fdc6841df1b40b22e47f6f44ecdde1c1f7915ee8437509ee67ea0cc74dd4ef165a4d3b83ba3f09d4d996e8a3147637ff44eaeeb
TLSH
T17541F6D52B2D3466EF81CF859839CB322D78F689E591999631FFC4722082B803C4A84C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
MD5 32d66548cf2a8f1b6b0ab9d6c335806c
SHA1 69e42d1c9f5e7760749da4331591e196bba4b81d
SHA512 f8d7ae900b29dbddb66293c320367f3b4dc41ecd372baed0f690bd657d8d92c77f8dd5cb3a10b7d93e1b1d7ed2a90c12d3461dde8845e2c7eeef1ff2c3237842
TLSH
T1A3D02B1D15F56D137E27991487E8E56174651A2713D0485C14498677A8015E9194F704
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 9eab2ae32253a62665a75b0489c1a1f87503ea9acc2d96f17b4254231c5a757a
MD5 61a72814aa1ded99209c3d59776b0d76
SHA1 998feaf57605fedc7226986206fa78d98f0a3a48
SHA512 5ac3ebcedef3af928e1afdc8d9f5018650fa77dad394d3bd8bdbf28d6cb8aca55e9f1771619be614279337899011d0c673296797071fd1cbaa7e4b2229463d04
SSDEEP 3072:JxtZH/ECXHwcAvW9QA+liQti4X+qMbeCb6Sd0w:JxtJ/DgvEQAho5OqMbPD7
TLSH
T19A043C542DBBB5A35E4ACE620C99BA9612F561DE2012771FBE306E505D03ABFCF17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 8c7602efe22cb85666dfca8b597ad0f33617fdd861c8bf7e951c305dfe59b3dc
MD5 de10d5794ceacb41f46aacbc68d07747
SHA1 167aa5e4fd0a87215579791b0bcfa181d7848ada
SHA512 6d7a173bbe00ac650b201daa93ebc17e0d4f345d5d321643ec500a76356f2e300ca626f3a414321e9c09eaf98258e5ef52c5f87cbb2b8a6d52d7636bce097323
TLSH
T1131121865FF4A1909AE356A0CAF8E1367CB424C66DEA34822CC688E2245776D7F0443E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 23993fbed835ef85eabf2489095cd378b04109692325bce7cb6f19a3868b96eb
MD5 fdb8684175cf8930184bfdbb5b7da831
SHA1 f9cf557f442f1a01a9a6a541c96c182ca0f03850
SHA512 ba32015e7f98a9e2a669d2dc7b019b2b404a45bf16d973d4fa7c63954f32c088235f0dcc945ef57b9a261a7e78c5227619a765794bdee726be265dee27e58c76
TLSH
T13E41FAEB5F0E7518BE47CF0669B5CB392D78A4E4A2401945B577C4D700DBBC92D4548C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 c7ad790e86f162ecc1fe66ead03ced4972b4db1b7bde02bd883baef0cdc41a1f
MD5 1383bc6e7e39a7ebc1e8af8f5f20265c
SHA1 8b789413bb810c47a9bdbc6627f95943cfc26ceb
SHA512 cea6bea5976c5f8dc9b850d34fefe1a322c74c35def20e6199476bd545fb2109a1d7fb5cc515138394971e958db4c0716dc891dc0ab85903271f047dc2e95289
TLSH
T12FC08C1C1EA60A06F2A8837C02D17D439B208941F2818F151AF52A08C996B26A878C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 0d43bc05e418ef35708b73278a2007be9298eec3aa31adc8945e08d037de77e0
MD5 7c15954f4b5a0f803d00e16176d9760e
SHA1 1fc44ba3f5e5291695afa865f27202c56bbf5c12
SHA512 18c987afbe28fbd18d664ff2f58314bb8ab8dcc67b306f4e06ab78a6482eb657199de103eec2bb92f21f0aa6c5b503290684c851c6a5f1c0a963486b38561734
TLSH
T104F05C3C12F8804DE072EB794EE6A2D96C14F523380885A94EA0460C9A01F005CE153D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 9338a6273ef816c83296a231e7baf1c98b6494e661ec002e67d2623e41c608f2
MD5 f11f68fcfe175fe59b213f47cc338250
SHA1 03bf8cf63f63353f63cca62c494f0abc62e32cae
SHA512 58c9c88ede743bc98b2b715723af3941bd34e70da810969eaf5dc3bdee3ef9884f95dea8d2809ffdad795ad5691da2a0bfdde7c43590cd62faa587cde8747fd3
TLSH
T1B9F0222435FF422FF1BBDA3483CA3135B92EA206700126B52AB213046B1AF21698211E
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 0c7e419cc0f4e16ceeca3ffa1c90d2c558586be1da0d736abd29670dd3019142
MD5 91bfae81be013e61bf64d0d442fa4087
SHA1 71abc8274296ae654eaa38025a317694363fcff6
SHA512 3cc3ff75be3c92500aafaa31bab72f5bbbb2c52cb4c69cc442532a0457d44bee6cd405c8f5464876480f4f1286383578becf0bf91214df0c59cdc7095d844cc0
TLSH
T1DFF0AB0028BC016EF8B3E9B4C2E122B6F975F219780587F60B9A02455B52A014DA252F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 9a26ff4182f17e80f653daee2a947153cb1d88450665fd0d62db48782367a164
MD5 769b1aaee95010f8dd4e41cf8d809d4f
SHA1 87b052624f91ed4b11c9e1def02715fac9524b0d
SHA512 87ab72ff2b1c2d6d99f52688464216aa0502d77404f015f32983a4645624f929aa88261723e29b8f99cc96a30939b4aa619b22cd39d04bd0770edff3e8b2f53f
TLSH
T1B6D0223C2B020374F271833A44B346495BA05E02F380870B1BF107CE8C2CFA21891C0E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 a2bee1aae4efed8bd31019e9371e57486e541249f15fc342a920ef2c1d2cda7a
MD5 794cfad708be1a4c9e5ad7a8af8aa5be
SHA1 e685046f930c66586244a81360f0077fb266b777
SHA512 8b1dfe1c41e93ebd1733cc9ed3eaadd60d841475b3cbbda65af59ad25a116d6eadc76c85f39b2463098176520ab13632be0d82fb7106cafa1868b2e9b0dcf445
TLSH
T1F2F05C342AD2015EF672233D49E853D5D905BA053405C45916D20A0DEA67ED01D5283D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 65577fbc759ec3a76a029a99fcc6ef63de3ae1edea48b5dfafd4ed4f033a85ae
MD5 fd547bcbcfe8a5958a616ac4bfa3cca8
SHA1 0ed01cdc05fd590d7ab61edbf0b806f62e602eab
SHA512 da84e4705e4e0c9001da09af2b81ebabc292ceab2bdea6a63886568ac511c86aeb9d65d705762bd6f130950614be7b869fcc18d113cf6873204fff01e2a5ff10
TLSH
T1A2F0AB2D24EB021EF173DBB843C122D69963E232300523667BF1130E2A06E006E2092E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 4f5b6674877051bd7615e7bcc38f6eba23837fe6a43022615a6043d443bc3f0d
MD5 67588465c807aac44418f9b1f8d43e8e
SHA1 644df71859c841251f7ce91546f3f2e11d278e57
SHA512 cf1495b36b526f922db9104705ca1f48fdee4b3dd95676d7ccea91b91adeea13ed8a1cd177ea9be2b30089c5aef0e7ee6c1b735f778761f84c7e580ba15d2690
TLSH
T167C08C1C56650A06F2A883B802C629838A618610F3819F0126B62A08CD24F222878C29
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
Size 10.4MB
SHA256 04cdff49199efd4eb9acf21841ddad6a0f4b004950b4a4f0c6e0f62cc2e725ff
MD5 2ddc0918f218292509bcce63f38a8703
SHA1 2dae6718240141291cbd82952226dfe4ff00762d
SHA512 e35d28edf47ae1779e0ab6670c87514bae363c7e59fab36ff85a9932ba581ebf94347905f9c28c02886a9274e915ce606c856133ee58170f2d9b357d305e1dcf
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSo5CiSj40zGp:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSwt
TLSH
T165B633EA785E5BABC10E1C398D0A8D6275BC5BB2CB644C97FFC63DF60850C521722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
Size 10.6MB
SHA256 a493bf39e95f79918840bd9bf133d5b5736a63102cb221607a635058f81594ee
MD5 e51a897c725bf9bf8c666a1b9ec0f2ad
SHA1 7d96261ff519bbe778039014e2f77156754b6399
SHA512 440750294b379706c5aa01734cddd3acfc70d45bc39fe733904d0afa714cfb660c444f55301f07a52500f80128bacfb2831ad13894a67e7f57380ca224c0279a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSo5CiSj40zGB:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSwF
TLSH
T11AB633EA785E5BABC10E5C398D0A8D6275BC5BB2C7648C97FFC63DF60840C521722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemHost.exe
Size 10.8MB
SHA256 585f93f84b76b4ae17fadd4ab4652845e02b2720fe9943cdf5c32ad4c5a9185a
MD5 457822678e6d7b247848c457020326e3
SHA1 57df9d81627000802de74e518d10a47d90d17d24
SHA512 96ee6048c47a229bf708258320925e7296db31c8930ce0b7031674cb59463e61d684a42d21b2f52182f11bd3c1302555f770d6b3b6ad3e8e7988ad55378f7aa6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSo5CiSj40zGA:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSwk
TLSH
T103B633EA785E5BABC10E1C3D8D0A8D6275BC5BB28B644CD7FFC63DB64840C521722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
Size 11.0MB
SHA256 9e4cd42bdef7e9df3ba68a2530c0cb2984a54df997193ebe91b16555eecc3178
MD5 a4b842da002e4fdc595e086b836b923b
SHA1 aae1417aea435435b649476279d26fc978d5130c
SHA512 4f91229cee07e9218de3294239c2a3d50b7016efa29d99ca15ecef7f3bee4e75065caad8e8724b78003452041e65807802e890cfbfba5a94881c2d223eb60693
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSo5CiSj40zG3DWP:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSwy
TLSH
T17FC633EA785E56ABC10E1C3D8D0A8D6276BC5BB2C7644CD7FFC63DB64840C521B22D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
Size 10.7MB
SHA256 50a1ff5aa9825372a30704a81cccf5e0a64b1230ea5ff51711af57f177b61e88
MD5 9b09ecbfd0a00654f59233330f382006
SHA1 673a2906824c601b88d73a82d5cc9d58ca4aab74
SHA512 9ca66bec684e5b55531744082667ecfa29cc73f607c1fcfed57b566262d4cc1b764155f85b3999d8d76d4196cce6a07cd7ac5f492c463048c31eaebafdf70481
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSo5CiSj40zGu:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSwa
TLSH
T1E9B633EA785E5BABC10E5C3D8D0A8D6275BC5BB287648C97FFC63DF60840C521722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe
Size 10.3MB
SHA256 9bbbcfd06a35e699eb197a446446e237294226e1faf936c9bb9ab426f0e47971
MD5 1f065dfcf6149990054e60ce6d4b637c
SHA1 2e89f50a112f9f3dff6876c28e210feb5d447559
SHA512 a3faad78be9aded8193a45e226c6f2b31d59763c768f0f1a6844cadea329d518b2f12a31dbf03854876f37eabd4a20fad286bf2fde8f666aa40e1cb530c50ae8
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSo5CiSj4W:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSwA
TLSH
T14FB633EA785E6BABC10E5C398D068D6275BC5BF2C7644C97FFC63DB60840C521722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe
Size 11.3MB
SHA256 5ea4f8795ccdaa20cf3e2e0abb53bb90c050d6cbc899c4f736cf0a7fbe741bac
MD5 1546f06fba73dfedfc114f0878baafb6
SHA1 f8497ed479cc10108364da25165240d16a1a6c20
SHA512 a4d42eb83078103009cb967bdbf56bda7b0ac9694d06ee1580faf6c49a8c49003ac820504051f2b304e13a686292317c8515ce663c9f44a23247dde5f67921ac
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSo5CiSj40zG3DWo:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSw7
TLSH
T1BAC633EA785E566BC10E1C3D8D0A8D6276BC5BB2C7648CD7FFC63DB64840C521B22D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
Size 10.9MB
SHA256 985f53dcfa0e9de2410d23eaa9edc862e33b09d855532ef163ecd9076f366a3b
MD5 100ba519e526c716b0f8163f7b75aaff
SHA1 f0b08a6586f359cf400ae61f8bfa21971b06bd7a
SHA512 986cc31fffa313867c889cc8dfb2760ce61737d14faeb2a6e0684dd3baa1fb90d3ac20d44a45ce2dc97212b5e8b5375cbee74d8f6b0ca71755e8961a3095f556
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSo5CiSj40zG32:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSw6
TLSH
T1DFB633EA785E57ABC10E5C398D0A8D6276BC5BB2C7644C97FFC63DF60840C521B22D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
Size 11.1MB
SHA256 c5447c523d1dd40c84f0de3df44ac7b351c6cb2db4ffa113465d97c3637e7da0
MD5 a225306f3f5bc2c38b0b851243f5335f
SHA1 3708f51ef407412320832984ce10e029f643ad87
SHA512 225e4a33ce3613a665af28e10df4fe61fee7bec0cb5fea45df941a0e5e624b49f1896e10b2a2fb043c476da77b7d9a7a414d41bfb6f25f959cd1be8aa105c9ce
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSo5CiSj40zG3DWO:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSwz
TLSH
T13EC633EA785E56ABC10E1C3D8D0A8D6276BC5BB287644CD7FFC63DF64840C521B22D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download