e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
Size 17.9MB
Sample261012-sdadkasz8p
SHA256 e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c
MD5 113748de81f993a30bbec8decf6ae7e8
SHA1 91b1ad000a01a71042fb72a4a04467977e5dfd91
SHA512 76ad038939aeaa72223941039be6fd10820aae50d4c5fbbc025df33a1958e6af94bddc1c04e39a19f1ffb365c561ecf7db99fa58381b8e1b5f07748523f41e47
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWxbHoQHSpLccjRckGjzi:4JwMrcMGY8w
TLSH
T1A91733E96C0EA6ABC1090C39CE464D6134BC93F28F588997FFD63D7A5850CA16327D27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5964	WindowsHost.exe

Executes dropped EXE 20 IoCs

pid	Process
5964	WindowsHost.exe
2916	WindowsHost.exe
908	SystemTrayHelper.exe
5468	SystemTrayHelper.exe
3156	SecurityCore.exe
3392	SecurityCore.exe
4140	InputService.exe
4712	InputService.exe
2840	WindowsHost.exe
5444	WindowsHost.exe
5604	UserSession.exe
3768	UserSession.exe
5632	BackgroundTask.exe
5640	BackgroundTask.exe
1304	WindowsHost.exe
4748	WindowsHost.exe
5064	ServiceHost.exe
4276	ServiceHost.exe
3480	RuntimeBroker32.exe
5572	RuntimeBroker32.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\WindowsHost.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\UserSession.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\BackgroundTask.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsHost.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ServiceHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SecurityCore.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\RuntimeBroker32.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsHost.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsHost.exe\""	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\SystemTrayHelper.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\InputService.exe\""	SecurityCore.exe

Contacts third-party web service commonly abused for C2 1 TTPs 16 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
26	raw.githubusercontent.com
53	raw.githubusercontent.com
6	raw.githubusercontent.com
49	raw.githubusercontent.com
64	raw.githubusercontent.com
91	raw.githubusercontent.com
94	raw.githubusercontent.com
143	raw.githubusercontent.com
39	raw.githubusercontent.com
80	raw.githubusercontent.com
105	raw.githubusercontent.com
115	raw.githubusercontent.com
128	raw.githubusercontent.com
118	raw.githubusercontent.com
132	raw.githubusercontent.com

Detect suspicious telegram bot 10 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c622-29.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c623-77.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c625-112.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c626-146.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c628-181.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c629-215.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c628-248.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c629-252.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c628-260.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c629-306.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 40 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4892	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
4892	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
4892	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
4892	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
4892	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
4892	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
4892	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
4892	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
5964	WindowsHost.exe
5964	WindowsHost.exe
5964	WindowsHost.exe
5964	WindowsHost.exe
5964	WindowsHost.exe
5964	WindowsHost.exe
5964	WindowsHost.exe
5964	WindowsHost.exe
5964	WindowsHost.exe
5964	WindowsHost.exe
908	SystemTrayHelper.exe
908	SystemTrayHelper.exe
5468	SystemTrayHelper.exe
5468	SystemTrayHelper.exe
5468	SystemTrayHelper.exe
5468	SystemTrayHelper.exe
908	SystemTrayHelper.exe
908	SystemTrayHelper.exe
908	SystemTrayHelper.exe
908	SystemTrayHelper.exe
908	SystemTrayHelper.exe
908	SystemTrayHelper.exe
3156	SecurityCore.exe
3156	SecurityCore.exe
3156	SecurityCore.exe
3156	SecurityCore.exe
3392	SecurityCore.exe
3392	SecurityCore.exe
3392	SecurityCore.exe
3392	SecurityCore.exe
3392	SecurityCore.exe
3392	SecurityCore.exe
3392	SecurityCore.exe
3392	SecurityCore.exe
4140	InputService.exe
4140	InputService.exe
4712	InputService.exe
4712	InputService.exe
4140	InputService.exe
4140	InputService.exe
4712	InputService.exe
4712	InputService.exe
4712	InputService.exe
4712	InputService.exe
4712	InputService.exe
4712	InputService.exe
2840	WindowsHost.exe
2840	WindowsHost.exe
2840	WindowsHost.exe
2840	WindowsHost.exe
5444	WindowsHost.exe
5444	WindowsHost.exe
5444	WindowsHost.exe
5444	WindowsHost.exe
5444	WindowsHost.exe
5444	WindowsHost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2916	4892	e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe	90
PID 5964 wrote to memory of 5468	5964	WindowsHost.exe	93
PID 908 wrote to memory of 3156	908	SystemTrayHelper.exe	95
PID 3392 wrote to memory of 4140	3392	SecurityCore.exe	99
PID 4712 wrote to memory of 2840	4712	InputService.exe	101
PID 5444 wrote to memory of 5604	5444	WindowsHost.exe	104
PID 3768 wrote to memory of 5640	3768	UserSession.exe	109
PID 5632 wrote to memory of 4748	5632	BackgroundTask.exe	112
PID 1304 wrote to memory of 4276	1304	WindowsHost.exe	115
PID 5064 wrote to memory of 5572	5064	ServiceHost.exe	118

C:\Users\Admin\AppData\Local\Temp\e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe
"C:\Users\Admin\AppData\Local\Temp\e45bd568591d893f4f22c23ec44e701154d2825238cc893e380b3081eee1690c.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  PID:2916

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5468

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3156

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2840

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5604

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5640

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5632
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4748

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4276

C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Temp\\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5572

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 6b815011c150cc87bf82cd8921c4cab58c8ee0341c1a78a48b9b67fa7a3754e8
MD5 34da0d404b796df75e60601acc06ae12
SHA1 47e22b08f2d02095731e882625549f5e8eda5f91
SHA512 65504505ef8976d2037b3eb64a52bc24b9100b4a1254adf140b6f45d32a5f24c118763339e630dac5d234cfc1459c18d17bca84fb12ffb910fa9f2b52f1e096e
TLSH
T1B0E07D23F20C50907F324E7D4623A02B3813204814C69105292C8BC20D036E68A03504
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 a137c87e05159088c59471c7a403068f2273fa908d7c297ee8d311b3736c159a
MD5 3922a3c8a84ba5d5027b2e834aa1c26f
SHA1 322ff9d4a5bfd5477e3b4918a98456f19cfa7ccc
SHA512 375fe3c5f0520d7484e034f281a8dc2138cd2e807df5ad8223320ab9e6395da10e4f30005334d7963f1349a244c96a19a027729a633b164a77afbb6aa5677742
TLSH
T17F41B7D9AF0C3024FF868E844938DF327E7CF1E5A495605534F644B264A9BD51D1A88C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 49c88ce337728b0d9e1cfb31e7632547d904dec233c3dcd6e160b9da69ee7d53
MD5 be1ffdfb21fa8a54b61d1500c07f251b
SHA1 50fbb71c8bd85e7c47b12c6288c15eeab10e0dae
SHA512 6290e37783e3edeee5d37907fe91079214d280d7a6731beebe9997d95fcb47b0c614aed9bdbef74d605a6f11934069dbebc7dac356b688c23707b4133686ce35
TLSH
T185D02B06C8EA78433F2398244DC6AA5570A3681922D35D28764E851A2C614F70F0A15C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 185KB
SHA256 b462769aa54cef10a7bb9eae73889b190194734754750afb4958144f9b8e571b
MD5 7481e0eec551e59b2a70ca3f77d83d3f
SHA1 9341301cbcdcc750ffaf4010fc8027a96ebe5620
SHA512 d55c0e25bc8d19da18ccd6d872bbe6cc69d7f5e0294c2f5b66baa507618abc80b273ed86c526cda00ff604f15e1849732b625a83e9a4d13d92da05626baef6cf
SSDEEP 3072:V/1Cl9+XOvJtlpDGlC23zjwVqf0/DP6gne5qlyT1:V/wnvBpD/2PGqf07d+1
TLSH
T1A0042D146DBBB5639E4ACE620C9ABA5602F171DF2112731B7EB46E901D43ABFCE17C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 975B
SHA256 9588ef7646a6cf09decf879536489ce9a4f33ce6091955c40fe47b4331b5ca01
MD5 b36e41947b341b1403320e932f700c42
SHA1 a1bf70049b85910754ef945341ff356709dac152
SHA512 4679b94bd85ca8e0f63bb81745de49f18d6a19c216cb440f9ad43bf9e87212d594b0c2f8e7b40f770695be86a7fb92abddcfdf11bbe85fbd03d2f306e7f4fdb6
TLSH
T137112183AFE870509AE696B0CBE8D53D3CF4348228EA34D11C91C896245AB5A2B0803E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 21a3150a5b53cd8f4722505be245f21174df59b9933401fb086744809373f105
MD5 f6e2deba8cf53cda716a5b1e5f8f65c4
SHA1 94a083201701aa2bf2281c89f56b90486c5bbb6a
SHA512 a3807a8e23ac108e395814b9a00000223d46196465d400a0ed09b577b3e62e247556b0670f48134c7fe771aafb3bd589197fe89c5ae7e6ae112264db42aeabe8
TLSH
T1D841FAEB1B0A38787F469FDB6C79C4371E3462E4A0C44842B6F7C8D614EE7915D1954C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 90b28fa030d2b6c9f80af059cdec2ce917aee7b56f40f58370333f76105977d7
MD5 4f50c8cb6e0b9baf195a412bb7ffed1c
SHA1 326d8746dba2d1242a4669982b4dfcf8a0e772c2
SHA512 f6cb75e5f054e81dac62c52aa87dcc206b3eecd090d37b5351cdc1afab97d83be16c0bbdefcfba092e798e0fb1239d29dff7cfcedb32b9d2179d8ed95874a3be
TLSH
T1D2C08C1C5AA60A06F2E843BD02C239439B208101E2818F061AF12A08C996B262C78C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 f0fa59ebb565436275ecdcc70eef2da656c4117bd8c3d00b7d92cecd1d87a938
MD5 165e9f0ff4c8c5fc805f67e4049abb5d
SHA1 fc5fd58997e4f2a3bb2b5bdd2893ee1d18c6ea29
SHA512 26288f65263be77ab3534872fd0b25f29ce2bfd5bb589c4c846277803346a6c8702c6f87aaa3b59e9379b36572a85fc8b357b448eb094715d7ddeb9f658f252e
TLSH
T17BF05C2C1BFC847EE133DEB8D7D5A352990AF117240545D906D24B485906B426C5153D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 dd49edb6fd5803bfe523ed1bc5ff5e28ae5e889d943a0ec69c9b858b31ee8a4c
MD5 0388d256292369996da451c2c44a9346
SHA1 a7c6a47e1a7dd7c6f9aca6b26787db22120a0d0a
SHA512 fc9ee087bca5a67b26e65c2cbcdedeb04b6d49bd25d47a48e3269a0b0d954df9a1daecae211dc7d97ddac52d5b39a5a74f3a502c72825e9d72378b60ca18da8c
TLSH
T1EAF068283EFE603BF033D97803CA31B09926F20A300176B52AB157082B26F512C41619
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 60c95cc9deca2cf2022e9629c1c98dd21e1a93e565b6c85f0745a2b6151bb7ca
MD5 3042693a7dee2c65663418c80e3b9c74
SHA1 393792facecd639d0cc6f4226c00a7dfe0351592
SHA512 65f8d4a27fc80eff9f55a5ea8ae82899d2c39ad46c77cbc76959932f2afd85d114ebed2ab6e894261958034c74660287bd6841dc4ba0d36cefee6d459e144256
TLSH
T10AF0A31420F8410AF0B3EC79C2E022FBFD35F1043805D2BE069626075607E110D9162F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 376f043b77e014812b43fd7fa2692a7755cc59c626a7282860c27df5cf06782e
MD5 bef032fb0fe7f975d5bcbd7f84c14376
SHA1 f08e3940e52bfc0615a27f5df4ff27db20300225
SHA512 94ae2d3cc95bb4038bf95fd666c1b7c0ae16cb925f8c587ff669cec0ce164dab06d7364c77c738365d811c10126cb948d1ac336ab99b839613539b88c42e4022
TLSH
T1BDD0A9346BA40222F034073988B3928ACB2031A2D0924B8D0BB1219A0C28B021EA390C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 abe5e3fbdcc418a336ce1c6f8c3e9457fd95c554dfdc6e8ab88500a21f4c5fce
MD5 66b0b9275b27801430857cfa4dd0985e
SHA1 199f2faf68ba39b521d26c63e7a72683c96b6b3b
SHA512 36f6bf27149dab2dad79848a658c5ac77ec611f011c716a6543f875b74abc96ee1770c9c2eb7a6c9dbc783b2121e1291bfbfab9ccba0208dd1a3ca5830fa7e84
TLSH
T1DEF0552426A2113EE232227909F4D3EADA06F2267404C4A926AA130AFA8AF801C1143D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 c3d9e6c4dfcfc5c15b1bbd08ba93eb5fa2297e307af53d832bb9a7e7cfde194c
MD5 05d63820ad20295821d6d8d240d390a0
SHA1 61a539d6e7e910fbcb1773c6021c19131d1bb2cf
SHA512 5cfb41b981485a4fb96bee97d26d8e0887d68d034e75a11727048c2111bfad1dd259fbc1595a8f691d7234d0f0f852e2669443322b988bb21388d898ac8fc3c8
TLSH
T158F0AB3C11B7111FF233D7FC43C642C6953BD53A31442BB42BE14308AE86D42B920912
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 af5d8fc975dc07ce0bca9cce31bc2c0e8db50d129a61216e1f07e599c1bff965
MD5 3f7c99ed6f5ac3d9f7919994c9cbeaef
SHA1 de197cd56b424a16cc796e569758bbb5b7d87c15
SHA512 d3ccf885bb5675708baeb2ab93d38efe84d45fcc51380c9238f76703c2660a7f95e475324e82528c430f80d0ce0093ba2ca11525571d14b29838569a16f2a679
TLSH
T11DC08C1C46610A06F2A883B912C229879A208520F382AF0226B16A08CD34F322834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
Size 18.5MB
SHA256 f4aae98b7bddb8e191b186d71bd85704037db5313793b1a7a1fea5d636039da0
MD5 200161e0f11a122df6205a5937b190a1
SHA1 cb40ab38189037455713f9b0f2653e49a7b30963
SHA512 cb225998a9f7c618c6f9ae9fdb346570fdb5ddbe02072d9dcb7aec8f3565af28b4971ec9542abef8a382d42a3b85abba80179f07e7ca3f4ba1ac2fa471b2c574
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWxbHoQHSpLccjRckGjzRET:4JwMrcMGY8g
TLSH
T1D21733E96C0EA6ABC1090C39CE464D7134BC53B28F5889D7FFD63D7A5890CA12326D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
Size 19.0MB
SHA256 14681939e543cbd743fae2016214859e51b804ae70addbe64f4da7d009be715c
MD5 cda4f9fddf8dc795fcc21c32f4f882e0
SHA1 e357e85ec1bb9a46673a5779a9a307e628a4cf7e
SHA512 17e34fc10167f2a371f5d06683a343ab029b0395370ea8e2494db87a0fc609b77d9c13c1f0e793c8494c1fef4c47ce640e82c86888be8cb08294f5a8c4b1863e
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWxbHoQHSpLccjRckGjzREK9Os:4JwMrcMGY8N9Os
TLSH
T1CD1733E97C4EA5ABC1090C39CE4A4D7134BC53B28F588996FFD63D7A5890CA12327D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe
Size 18.4MB
SHA256 0c20eb65fd5ceb2a3d1dba635ed93dfb2a574c4a79faece054d3050a75557ab9
MD5 3de7abaed4f6969e62e44a5b4bdc9074
SHA1 7b3af806872a6165b738beb4c26c55d31e55d686
SHA512 9d7bbf13e58e5355b4e8567aff38cbe54cc6b828a299d099aaf425d03b28e8820859fd754d61ed0c95343426bbde0d5c599475f56a3563aee2c5133566e9f084
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWxbHoQHSpLccjRckGjzRr:4JwMrcMGY8P
TLSH
T1AD1733E96C0EA6ABC1090C39CE464D6134BC53B28F5889D7FFD63D7A5890CA12327D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
Size 19.1MB
SHA256 5b3b71bc2ecfa04e156abeaeea79b844afc6bde50984224cfed874e93804efa1
MD5 ab242986cc16410e2af37035f153d6d0
SHA1 f691e2681af551029c3ee46ff3757cd289417e89
SHA512 cbe80dfa82cc1c1cdd0081056e1c4c3d2123b2636214ab6b124463d0ca97f602fd2b36a19ebd74ece5d8e9e714a2ef66a0cb1d5a3561c555e159e2f35ebb749f
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWxbHoQHSpLccjRckGjzREK9OF:4JwMrcMGY8N9OF
TLSH
T1461733E97C4EA5ABC1090C39CE4A4D7134BC53B28F588997FFD63D7A5890CA12326D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
Size 18.8MB
SHA256 ea1de836a0eda3cfc7f91adf905b6f31049de9b445cdfb2aa87f2a6c432fa94c
MD5 5428e8826518cf219236077770525552
SHA1 43adeedce06500060e47e36c809217b38efef81e
SHA512 319a23cdddc2f0a523c1570a975bdc86ff4eced66e70c8965a08575bae76e0ee13a79711565eae64b1c56cd6b6aa76725319902d19861c2202b57a83390df078
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWxbHoQHSpLccjRckGjzREK97:4JwMrcMGY8N97
TLSH
T17F1733E97C4EA5ABC1090C39CE4A4D6134BC53B28F588997FFD23D7A5860CA12327D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe
Size 18.7MB
SHA256 46d9449a8821948751d1a7f1aaed004229b992e4ea013a69d13b4d576599df00
MD5 e942429880b9f03fc8c4d3680953be69
SHA1 09756ee236c7659456a2dc4e510ef8b398553873
SHA512 fce468877bcbc741e7632f74a4acecda81d56dee443741d2c15097f62f293e0b696ba641c1f2fb33d32fd4072a1f739fdfaf9971268b07a2f78780c510f190bc
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWxbHoQHSpLccjRckGjzREK9J:4JwMrcMGY8N9J
TLSH
T1E61733E96C0EA5ABC1090C39CE4A4D7134BC57B28F588997FFD23D7A5890CA12327D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
Size 18.3MB
SHA256 7d52dcc22eeb087b0993bb01dde2fd7ee0add3c0e5b786f34f698c56773ec214
MD5 7146a4b9ccdc055e053d0ba0e7f7727d
SHA1 a64af8f12f8bffc041c199efb8d3624fa2ef28b7
SHA512 79428ef0a62a3c888c6bf331474d8f503aad9a0e67be9ca1f3bb4ecd00e3078922c733c0fa4e8d09a365e38904f9d9495b64597bed034f5b17382ff8223a1194
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWxbHoQHSpLccjRckGjzR2:4JwMrcMGY8y
TLSH
T1881733E97C0EA6ABC5090C39CE464D6134BC53B28F588997FFD63D7A5890CA12327D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
Size 18.0MB
SHA256 b8692281f308ee2e2e766a56ab017bcd7b3c46be3031984326f3dd0c9f64877e
MD5 c6247ddf591b63c293f1abddf8a223b2
SHA1 1f302067fe5926176dd7c61152832eb029b796a6
SHA512 e188066abd6aebc73411b278f977c883a9867ebd2b39afd8db0c96dc798dab1143a0c7e4caa4aa4768b15bb8c63ecf8a57165176083cc8f7ed5253f0562cfac7
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWxbHoQHSpLccjRckGjzRP:4JwMrcMGY8j
TLSH
T1711733E96C0EA6ABC1090C39CE4A4D6134BC53F28F588997FFD63D7A5850CA12327D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
Size 18.6MB
SHA256 6456893e4a18c121f37913880584094d481f8076c3c0afc64f2f3b4501493ced
MD5 3b5b41d9fe8112eccbc34e3c85fc8476
SHA1 bb9764ee0686a3616b03e8faf4c84a8a6b89b6ff
SHA512 7b1ae0092da0a2ecb930586c5731057241057b1b2637d7ab9c89311ede7ee5aa9aba0420bf8804e265f6dc321b71b7c505c7efd9634fdbeb1281281d0fba3dc7
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWxbHoQHSpLccjRckGjzREKS:4JwMrcMGY8NS
TLSH
T14D1733E96C0EA6ABC1090C39CE464D7134BC53B28F588997FFD63D7A5890CA12327D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
Size 18.2MB
SHA256 a4cd5fb0aa35666bc25b26f99b9c6cbacdbbf6571d66b85b1699b0f2adc92e3d
MD5 59226f8c8175c4e87868a3cf4d922544
SHA1 9317cfebf8e6442d67a17dab03b2c92d002b6575
SHA512 b0dd0671b71dc84dd12a4878893e8509bcc942954ac476f8060226a039babeca309de04163a24c17fdb5b2bf9e3eb3e2188d6bc26294be6d396dd1e07581ac34
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWxbHoQHSpLccjRckGjzR0:4JwMrcMGY8w
TLSH
T1641733E96C0EA6ABC5090C39CE464D6134BC53F28F588997FFD63D7A5890CA12327D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download