43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
Size 6.8MB
Sample261003-rgexsazfme
SHA256 43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930
MD5 0aaf230107e8d8abca611af190685c58
SHA1 879282461cd60b601e948fafc9dca83f941e3a16
SHA512 ecc25652f4996a07c009dea168ebcf888f73e719992d164613e95d274d2cfaa1a40fd021d64711f09e70c8bf0bec702c48220a4c442d5f5640256d396fb6af6e
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9V5:TDpbgBr/4QAMQMrEGRHsww7Q8L
TLSH
T1076623E6785E6ABBC10D1C798E16CD2235AC5BB1C7645C93EFC53EB60950C931A23E32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5516	BackgroundTask.exe

Executes dropped EXE 17 IoCs

pid	Process
5516	BackgroundTask.exe
1768	BackgroundTask.exe
4276	InputService.exe
1304	InputService.exe
1904	NetworkHelper.exe
3924	NetworkHelper.exe
5976	UpdateService.exe
4516	UpdateService.exe
3252	BackgroundTask.exe
2224	BackgroundTask.exe
3280	WindowsShell.exe
3372	WindowsShell.exe
5816	WindowsShell.exe
5568	WindowsShell.exe
3084	NetworkHelper.exe
5336	NetworkHelper.exe
5880	InputService.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\BackgroundTask.exe\""	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UpdateService.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\BackgroundTask.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\NetworkHelper.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UpdateService.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UpdateService.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\NetworkHelper.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 16 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
70	raw.githubusercontent.com
82	raw.githubusercontent.com
44	raw.githubusercontent.com
66	raw.githubusercontent.com
25	raw.githubusercontent.com
36	raw.githubusercontent.com
90	raw.githubusercontent.com
100	raw.githubusercontent.com
103	raw.githubusercontent.com
112	raw.githubusercontent.com
13	raw.githubusercontent.com
14	raw.githubusercontent.com
39	raw.githubusercontent.com
87	raw.githubusercontent.com
47	raw.githubusercontent.com
58	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c4e9-27.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4ea-103.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4f0-136.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c4ea-171.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c4f1-205.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c4ea-240.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c4f1-273.dat	suspicious_telegram_bot
behavioral2/files/0x001100000001c4ea-307.dat	suspicious_telegram_bot
behavioral2/files/0x001100000001c4f1-341.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4156	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
4156	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
4156	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
4156	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
4156	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
4156	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
4156	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
4156	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
1768	BackgroundTask.exe
1768	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
5516	BackgroundTask.exe
4276	InputService.exe
4276	InputService.exe
1304	InputService.exe
1304	InputService.exe
1304	InputService.exe
1304	InputService.exe
4276	InputService.exe
4276	InputService.exe
4276	InputService.exe
4276	InputService.exe
4276	InputService.exe
4276	InputService.exe
1904	NetworkHelper.exe
1904	NetworkHelper.exe
3924	NetworkHelper.exe
3924	NetworkHelper.exe
3924	NetworkHelper.exe
3924	NetworkHelper.exe
1904	NetworkHelper.exe
1904	NetworkHelper.exe
1904	NetworkHelper.exe
1904	NetworkHelper.exe
1904	NetworkHelper.exe
1904	NetworkHelper.exe
5976	UpdateService.exe
5976	UpdateService.exe
4516	UpdateService.exe
4516	UpdateService.exe
5976	UpdateService.exe
5976	UpdateService.exe
4516	UpdateService.exe
4516	UpdateService.exe
4516	UpdateService.exe
4516	UpdateService.exe
4516	UpdateService.exe
4516	UpdateService.exe
3252	BackgroundTask.exe
3252	BackgroundTask.exe
3252	BackgroundTask.exe
3252	BackgroundTask.exe
2224	BackgroundTask.exe
2224	BackgroundTask.exe
2224	BackgroundTask.exe
2224	BackgroundTask.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 1768	4156	43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe	91
PID 5516 wrote to memory of 1304	5516	BackgroundTask.exe	94
PID 4276 wrote to memory of 3924	4276	InputService.exe	97
PID 1904 wrote to memory of 5976	1904	NetworkHelper.exe	99
PID 4516 wrote to memory of 3252	4516	UpdateService.exe	102
PID 2224 wrote to memory of 3280	2224	BackgroundTask.exe	105
PID 3372 wrote to memory of 5568	3372	WindowsShell.exe	109
PID 5816 wrote to memory of 3084	5816	WindowsShell.exe	111
PID 5336 wrote to memory of 5880	5336	NetworkHelper.exe	114

C:\Users\Admin\AppData\Local\Temp\43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe
"C:\Users\Admin\AppData\Local\Temp\43974f83b1654c62943a1eae6d67c0336a63453e22343d8864b13326837bf930.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1768

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1304

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3924

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5976

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3252

C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3280

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5568

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3084

C:\Users\Admin\AppData\Local\Temp\Diagnostics\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
MD5 eb444c59d03b1567ebbb5e58480a6eef
SHA1 e638b0d4f8bc77cb263d4e561ca3cfd1e286432b
SHA512 43cc6537c3b42c6a520ad798c7d57f02e3a6770d08ee501ac16a6db81365e6c09ba75a15d2b614b2b19ab3d667c9753a671c6e77a54797011705393da73686f8
TLSH
T1D9E0721A362DC0DABF6A49394A6250BF78A1008F00CD855A342C87F84C8262F9F0BA08
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 749860344f94a12e314cdb27fc86b31285596137f12714a6443e366934020d67
MD5 4579cccb20eb53d3f8634118c8b6d128
SHA1 15cb3605bea7c55aa1d417108cccc1313b690090
SHA512 202a34939f16e742a9ed1159f684cb0fd0e2572c158de7fc5600aff8059b8cc8476764f61ad56f55292876199ae82a6863861e141ff788b83c6b10e2c708258c
TLSH
T1DC41A3DE5E2C7464FE818E451938CB322E7CF9C5E480556E70F788B270D6F942D4A88C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
MD5 32d66548cf2a8f1b6b0ab9d6c335806c
SHA1 69e42d1c9f5e7760749da4331591e196bba4b81d
SHA512 f8d7ae900b29dbddb66293c320367f3b4dc41ecd372baed0f690bd657d8d92c77f8dd5cb3a10b7d93e1b1d7ed2a90c12d3461dde8845e2c7eeef1ff2c3237842
TLSH
T1A3D02B1D15F56D137E27991487E8E56174651A2713D0485C14498677A8015E9194F704
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 ca41bce5303cd1d9398ff4bdf8edc4620ea9240232fbfa4819efd1ad82703d47
MD5 7b69420249555d29c02e1083e8f40fff
SHA1 0ccaef913573ce07da8d44f73b5f8fa865676b2b
SHA512 8b925fa508028dce484ecce7979c43837c82d0ae930b9a25467396487a1e8c3c6d1e3f680882f7a68e8ebf81b0a49123d667f4ab523f2c52af41e79bcdc6e90a
SSDEEP 3072:8tZR/ECXHwcAvW91AQlHQti4XbqMYeCb6SduAL:8tf/DkvE1ASo5rqMYPD3
TLSH
T12A044B542DBBB5A35E4ACE620C99BA9603F561DE2112771BBE306E505D03ABFCF17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 8c7602efe22cb85666dfca8b597ad0f33617fdd861c8bf7e951c305dfe59b3dc
MD5 de10d5794ceacb41f46aacbc68d07747
SHA1 167aa5e4fd0a87215579791b0bcfa181d7848ada
SHA512 6d7a173bbe00ac650b201daa93ebc17e0d4f345d5d321643ec500a76356f2e300ca626f3a414321e9c09eaf98258e5ef52c5f87cbb2b8a6d52d7636bce097323
TLSH
T1131121865FF4A1909AE356A0CAF8E1367CB424C66DEA34822CC688E2245776D7F0443E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 96a38b6eba68f440c891318a05812c586c9b39a22d6ee7fb9045a70bde3c11de
MD5 5388d3e50217159f7a26efd57a0a98b7
SHA1 43a097cd0628c4be1f36402aa856e960865f45db
SHA512 74db4be8b6b6324685e7ec161b5e8b7847cf89c454cd15c8772ba676dd87fc871175ba32e330a173c7562923dbfa1eae4187b9e788b31df4cc8c209e4285d975
TLSH
T10441FADB2B5E78A8FE41CFD92CB5C63B1E3861A752800D52B5F7C8D114CE795590A8CC
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 2e1da43c723ed99785b4a1569de40650b0725271524ff72a7b55c5a7e713151b
MD5 1d4e5103551a10ec05619566756f1b48
SHA1 13ed9ecee9b0931f2acfb1bf0304c11a0156ed1a
SHA512 885df30e9939227684fa778f40cb0c2963804591e257f9cc6d08953b9f1481d526edf7f42ebb878888e9319193d67f4973f41db1615036c34977b2484080f697
TLSH
T159C08C1C1EA24A0AF2E8837C82C139139B218101E6418F092AF12A48DA96B167C38C6A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 0826363702a4e15a3ab8250faf9a3fad9fd2a7d6192a6201a9c5613a05250a87
MD5 7a7ec7e55207afe132694d65492469ff
SHA1 a47a8726034c071e05e8abb0448da0dd058d22b2
SHA512 f6bc58401a8203072cb36ed6de51c0c29b7cdbf354c292f5f6c158daa3e7ce1ed2dec6656ba35cbfdd90352d6b81b0b301387c27c81f5cb8e716171050a43578
TLSH
T14FF05C3C12F8804DE072DA758EE5A2D56C14F123380485AD4EA14608D941F015CD253E
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 fc96a51fa236a2d82577acbc4449b6fde576e87100b0b87ffc470239cbeec030
MD5 873ab5b601502fc0c6fc66b660f2470b
SHA1 7cf865e40c07d866d902e0e1b43876a4d78f3945
SHA512 32b9dc8b07716d70247ead198fb2198985c504c4aad659ce75262c3cb79945e9f945dc70d1dbab2d4988e2155b8ddf46e0ad4e9a452e691c4a5bdb7f54a5cc93
TLSH
T192F068583DFF823EF0339E745BC770B28D2DE2272002AAB5257203042B10EA0AC1170D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 ef0ffac97eda96b8b3c4d56a15ea3ef7caa4d5b6c968cc758997f41c37890e56
MD5 3bab5b08b9766b59874031f98651ad41
SHA1 b0c51501c60c4992169a1eae1c1d0f48a736c0b1
SHA512 7f7a065288b3482a37c3798a45482364d5267e168b1339590ab060fcb567ea743a8ed4f6232bb688c61757b95f798b381a387b203140d7b6b09726ddf6036af9
TLSH
T161F0AB102CBD402DF4B3EEB8C2D121B6F935F11578048BF60B9A02419F52E010E9356F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 22a5895112a8b3860afb45d33e7168332ebaa67804de26db9a0fb96b88d16bb7
MD5 d322f08a42f6179536da3bbdbcecf2cd
SHA1 4e382ee6b983e035698c386cbce2737bf724d135
SHA512 82a854197916390c6ed5545c9569671a51097a1190f043aabaaa667ad0c198d6887f6ec942dc54bfa6b2b51f9388f6cedae55c5447393b74ff2d8f093764201d
TLSH
T144D0A92D6B611262F091F3398AA00983CBA12502E0A287285EF50209A82AA04386BD0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 6f5a6d6bfc3a402ca085406da633f1c25b004438789dfeb3344d0f871cffc39c
MD5 52e31e20f23d14fe2f24c716841f9497
SHA1 6ee8c0ccad0e6c72cbff9d451de70afd34d8db6c
SHA512 870af36b1376cd48e1a02c87915be83408ec7020c84e16ed7cecdf0cb9a92a5d8c0f55b1f97de2d73944d0575f50412e84a56983559aa04c629402b2735c4e33
TLSH
T164F05C342ED2015EF673623D49F853A5D914B6053405C45915E20A09EA67EC01D5283C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 d7efe2b53276e65dd464817a215f957d0453e8a77db4a635c6ebb64977d8df62
MD5 45b8f648f74aed9f8ab50358f07d8222
SHA1 a7e318ec90fa1a107a2259c02e8c35c6a74ba699
SHA512 8ab84ae1d543ef0aabdc39aff741de2ebaf8b6285ff369f67e1c3ad9c51afc9fca9dd3149dc21af7695eb8c1422686c7fcd06608cd02925b696619b28025229a
TLSH
T110F0F13E38E7421FF122C6BC42C006E66523F133320432A9F7B2034A5D46E54E860936
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 07692025f65585bbe11ec4094a396209da3d2e65a6993765999fac27e81e8cc7
MD5 2882a8a5d48afe5cb73a5c12fdfb29ca
SHA1 f004f862485f5133d62b025530cfba2174f54089
SHA512 e465e961a98017f2c9d9e136260d569e42d6995e280dd2598379ce83681190be413793cd23a2885218d66489aef776958d79460b2afb7a73cccb1fcd86b14ef9
TLSH
T104C08C1C0A614606F2A883B852D229838A208110F3819F0626B16A48CD25F122C35C69
MD5 SHA1 SHA512 TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
Size 7.1MB
SHA256 6a780ea0a91bfb9962968b07792049c75b420f8b4d037d813127c9c51af722c1
MD5 0a53837264a8d05edacae5411d4d45ad
SHA1 9fae011ba8cef664a14e593c5222c69a6ebd9778
SHA512 ae543946981d068ca9bae57a5b9da9e927d45ad738c3f927ec78b1232db70c4b67918800622a42812f0b065f3d43002c0606a580b7eabbb71e9cc08c932f89fd
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9V/6:TDpbgBr/4QAMQMrEGRHsww7Q896
TLSH
T15A7633E6785E6ABBC20E1CB98E17CD2135AC57B1C7649C97EFC53EB60850C931623932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
Size 7.3MB
SHA256 b99d5266e5531b2a8b156684e5657a87b3a63273bb212c0d31151f027dcf45e3
MD5 3ec76507db4bd37541d9c4e1048e4c3d
SHA1 72a998dab7e120fabab4d67fd3946725b8ba057a
SHA512 d9e1d360d23fd60d49408a78e1c53c2d2cf15efc293760cd849e7b3f85d666faa45a70842e67d027b4631ab4660b11c67b2e609eed52a4da9659bca9f93b3ff3
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9V/DM:TDpbgBr/4QAMQMrEGRHsww7Q89DM
TLSH
T11B7633E6785E6ABBC20D1C798E17CD2135AC57B1C7649C97EFC53EB60850C931A23932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\NetworkHelper.exe
Size 7.7MB
SHA256 68a7d5cb3f10c804622ca9abf5f987b1b9daf688b70586e0b6c23bf185f49140
MD5 35517baf774e472c14cf1dfb00165ef6
SHA1 d589246343879ae3de58848d02e235a0ff050889
SHA512 9924e4fd02cdb3bc03a6df6b2bb8e11660735e896ee0129d4ad66e93c7668b00165dcbacd7339f6054fb5e5a5b3653b0d59337949f273dfbe4b085f4d6f15848
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9V/DMS5:TDpbgBr/4QAMQMrEGRHsww7Q89DMS5
TLSH
T1448633E6385E6ABBC20E1D798E17CD2535AC57B1C7644C93EFC53EB60850C932A23972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
Size 6.9MB
SHA256 2bcf2aa62abb2322fffa442f75fc95a2814e5c3df4c5bf4577bf22bc31d9d008
MD5 35f5ed98a087daee1c2819f1dc0e23c5
SHA1 299dd573f4be4b470a69398c8a6355d16f4e600a
SHA512 dd5afb4a1beaca5107ca089ebbe1d85e29bce85d754d2bc866300f708fa60c1ecf5aa881dc9e01ceac596b755a945743349579f7bb83e25a92a9cc032758985a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9Vq:TDpbgBr/4QAMQMrEGRHsww7Q8I
TLSH
T1E37623E6785E6ABBC10E1C798E16CD2136AC57B1C7645C93FFC53EB60950C932A23932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
Size 7.5MB
SHA256 8a9d5d6e56a875c32faf809c882c53b300d2923205a8cf0bcd2e7a70c2bfd849
MD5 4f65159ffc4991f275580d75567d13ee
SHA1 734e491b07e4a7b55db7d6d78da1ccca9c526a46
SHA512 01ce16d352a49f5824fb92f46c35b0c306231f225f1c254630481d3cfcb78250f0910747c3e1f7c71d32452f124b337c211dd72e5576c7237a6e3c0f622965ab
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9V/DMSS:TDpbgBr/4QAMQMrEGRHsww7Q89DMSS
TLSH
T1258633E6785E6ABBC20E1C798E16CD2235AC57B1C7644C97EFC53EB60C50C931A23972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
Size 7.0MB
SHA256 853a4a4b1a8338359421fa83148e4bfb9b5b562517fb98e6727b095af965c6aa
MD5 9741e65a85363458038f596e4ef1e4ee
SHA1 e13872c67ea521cf509362746bfffdfb20ad93c5
SHA512 25f11d79f23d9a554838aaabae9f90441364ba92e8d8a1f0c7f329557b95b1adf4b547ab8c4f2355305416f199e00aeb2e6ce6280f0e06a6bef931a5fdc2a6a3
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9V5:TDpbgBr/4QAMQMrEGRHsww7Q8H
TLSH
T1997633E6785E6ABBC10E1CB98E16CD2135AC57B1C7645CA7FFC53EB60850C931A23932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
Size 7.8MB
SHA256 b8651cf788349d2d62bf3c29856df2df345e865bf65532d3fd748ccedfdfbaae
MD5 e803246404e04bdc7b6aa8b9c8ac59e8
SHA1 b80dadf897cb74b13d29407ad64c0af01d3f16ca
SHA512 910a0ac9e14dfc61eebfd0ca7f9c45705a356acbf7555a206fe4400cf2ce29e38538668ec9e0b053754cf525cffb51b3f7203b550127800c2269a58bc15456a8
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9V/DMSR:TDpbgBr/4QAMQMrEGRHsww7Q89DMSR
TLSH
T1B98633E6385E6ABBC20D1D798E16CD2536AC57F1C7644CA3EFC53EB60850C931A23972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
Size 7.2MB
SHA256 a4ded264d72f99f7e4de0f8fda49c4dd3447c119bab341d2ca3d9b96c6cd126b
MD5 d93b6a83c4a405e6e3ee3ca6a29e87b2
SHA1 fbaa9db6c485783022b34f232866983730d78cbb
SHA512 39cedaf381b1c877a926fed6899c614f747a8fb74d01f2802f4e9621529f350a58395ad7ca6e3c3e7b35d4f2a2c4f7b6b246278c8c864197ae4d07b3a5d991c4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9V/Dx:TDpbgBr/4QAMQMrEGRHsww7Q89Dx
TLSH
T1157623E6785E6AABC20E1CB9CE16CD2136AC57B1C7645C97EFC53EB60850C931623D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
Size 7.4MB
SHA256 3e78dc47d17f77d5129bb2dd7c6de88d1d4d0896ac3da393fe1e2c85dca35434
MD5 ad966f8aba46c2fac8a8e7bf958f6baf
SHA1 3cee67ce1b8425739912d367c5e23a835219f046
SHA512 e3291f10eb2be203e82e01910bf73dac8981c8c0abc1081ec6596f3c1b26f382b93156eac2ecc3d9b099a6c936ff92b7d0891f42d27307f3d324cc467b007032
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9V/DMSG:TDpbgBr/4QAMQMrEGRHsww7Q89DMSG
TLSH
T1D87633D6785E6ABBC20E1C798E17CD2135AC57B1C7649C97EFC63EB60850C931A23932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download