33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
Size 9.1MB
Sample261012-sdk53axvbt
SHA256 33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8
MD5 0e11ee325be99c3ebd9ca519e93a852c
SHA1 2ffd1eb062e8097f35ea7ed9d7279411481d2b63
SHA512 bc584446f8a3e177893fe912478e663afaab48ece32b50ef1ee6590d2aec64da501cbf2d4e0de2cacce25a192df8884d5c9a203bed8d82daf571a3d6cf41ad05
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSryEn:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSrz
TLSH
T192A633EA785F66ABC10E1C7A8E068D7239FC5BB187644C97FFC67DB60810C521722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5552	ServiceHost.exe

Executes dropped EXE 17 IoCs

pid	Process
5552	ServiceHost.exe
3848	ServiceHost.exe
4848	WindowsShell.exe
2588	WindowsShell.exe
3592	UpdateService.exe
1636	UpdateService.exe
2248	SecurityCore.exe
3384	SecurityCore.exe
2824	SystemHost.exe
3096	SystemHost.exe
576	NetworkHelper.exe
1644	NetworkHelper.exe
3364	UserSession.exe
1544	UserSession.exe
5388	UserSession.exe
2360	UserSession.exe
2620	NetworkHelper.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\ServiceHost.exe\""	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsShell.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\NetworkHelper.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UpdateService.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SecurityCore.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\NetworkHelper.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	NetworkHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
79	raw.githubusercontent.com
84	raw.githubusercontent.com
114	raw.githubusercontent.com
28	raw.githubusercontent.com
39	raw.githubusercontent.com
51	raw.githubusercontent.com
64	raw.githubusercontent.com
87	raw.githubusercontent.com
99	raw.githubusercontent.com
105	raw.githubusercontent.com
4	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c52d-27.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c51c-99.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c52f-134.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c531-168.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c532-203.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c535-237.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c532-271.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c535-305.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c532-340.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1304	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
1304	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
1304	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
1304	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
1304	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
1304	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
1304	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
1304	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
3848	ServiceHost.exe
3848	ServiceHost.exe
5552	ServiceHost.exe
5552	ServiceHost.exe
5552	ServiceHost.exe
5552	ServiceHost.exe
5552	ServiceHost.exe
5552	ServiceHost.exe
5552	ServiceHost.exe
5552	ServiceHost.exe
5552	ServiceHost.exe
5552	ServiceHost.exe
4848	WindowsShell.exe
4848	WindowsShell.exe
4848	WindowsShell.exe
4848	WindowsShell.exe
2588	WindowsShell.exe
2588	WindowsShell.exe
2588	WindowsShell.exe
2588	WindowsShell.exe
2588	WindowsShell.exe
2588	WindowsShell.exe
2588	WindowsShell.exe
2588	WindowsShell.exe
3592	UpdateService.exe
3592	UpdateService.exe
3592	UpdateService.exe
3592	UpdateService.exe
1636	UpdateService.exe
1636	UpdateService.exe
1636	UpdateService.exe
1636	UpdateService.exe
1636	UpdateService.exe
1636	UpdateService.exe
1636	UpdateService.exe
1636	UpdateService.exe
1636	UpdateService.exe
1636	UpdateService.exe
2248	SecurityCore.exe
2248	SecurityCore.exe
2248	SecurityCore.exe
2248	SecurityCore.exe
3384	SecurityCore.exe
3384	SecurityCore.exe
3384	SecurityCore.exe
3384	SecurityCore.exe
3384	SecurityCore.exe
3384	SecurityCore.exe
3384	SecurityCore.exe
3384	SecurityCore.exe
2824	SystemHost.exe
2824	SystemHost.exe
2824	SystemHost.exe
2824	SystemHost.exe
3096	SystemHost.exe
3096	SystemHost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 3848	1304	33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe	91
PID 5552 wrote to memory of 4848	5552	ServiceHost.exe	92
PID 2588 wrote to memory of 3592	2588	WindowsShell.exe	96
PID 1636 wrote to memory of 2248	1636	UpdateService.exe	99
PID 3384 wrote to memory of 2824	3384	SecurityCore.exe	102
PID 3096 wrote to memory of 576	3096	SystemHost.exe	105
PID 1644 wrote to memory of 3364	1644	NetworkHelper.exe	108
PID 1544 wrote to memory of 5388	1544	UserSession.exe	111
PID 2360 wrote to memory of 2620	2360	UserSession.exe	114

C:\Users\Admin\AppData\Local\Temp\33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe
"C:\Users\Admin\AppData\Local\Temp\33a0f334d7c9793944d42caef6e6f8f5400bc4887198aa2d89849bf5841fd4c8.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3848

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4848

C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3592

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2248

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:576

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3364

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5388

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 6b815011c150cc87bf82cd8921c4cab58c8ee0341c1a78a48b9b67fa7a3754e8
MD5 34da0d404b796df75e60601acc06ae12
SHA1 47e22b08f2d02095731e882625549f5e8eda5f91
SHA512 65504505ef8976d2037b3eb64a52bc24b9100b4a1254adf140b6f45d32a5f24c118763339e630dac5d234cfc1459c18d17bca84fb12ffb910fa9f2b52f1e096e
TLSH
T1B0E07D23F20C50907F324E7D4623A02B3813204814C69105292C8BC20D036E68A03504
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 a137c87e05159088c59471c7a403068f2273fa908d7c297ee8d311b3736c159a
MD5 3922a3c8a84ba5d5027b2e834aa1c26f
SHA1 322ff9d4a5bfd5477e3b4918a98456f19cfa7ccc
SHA512 375fe3c5f0520d7484e034f281a8dc2138cd2e807df5ad8223320ab9e6395da10e4f30005334d7963f1349a244c96a19a027729a633b164a77afbb6aa5677742
TLSH
T17F41B7D9AF0C3024FF868E844938DF327E7CF1E5A495605534F644B264A9BD51D1A88C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 49c88ce337728b0d9e1cfb31e7632547d904dec233c3dcd6e160b9da69ee7d53
MD5 be1ffdfb21fa8a54b61d1500c07f251b
SHA1 50fbb71c8bd85e7c47b12c6288c15eeab10e0dae
SHA512 6290e37783e3edeee5d37907fe91079214d280d7a6731beebe9997d95fcb47b0c614aed9bdbef74d605a6f11934069dbebc7dac356b688c23707b4133686ce35
TLSH
T185D02B06C8EA78433F2398244DC6AA5570A3681922D35D28764E851A2C614F70F0A15C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 185KB
SHA256 b462769aa54cef10a7bb9eae73889b190194734754750afb4958144f9b8e571b
MD5 7481e0eec551e59b2a70ca3f77d83d3f
SHA1 9341301cbcdcc750ffaf4010fc8027a96ebe5620
SHA512 d55c0e25bc8d19da18ccd6d872bbe6cc69d7f5e0294c2f5b66baa507618abc80b273ed86c526cda00ff604f15e1849732b625a83e9a4d13d92da05626baef6cf
SSDEEP 3072:V/1Cl9+XOvJtlpDGlC23zjwVqf0/DP6gne5qlyT1:V/wnvBpD/2PGqf07d+1
TLSH
T1A0042D146DBBB5639E4ACE620C9ABA5602F171DF2112731B7EB46E901D43ABFCE17C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 975B
SHA256 9588ef7646a6cf09decf879536489ce9a4f33ce6091955c40fe47b4331b5ca01
MD5 b36e41947b341b1403320e932f700c42
SHA1 a1bf70049b85910754ef945341ff356709dac152
SHA512 4679b94bd85ca8e0f63bb81745de49f18d6a19c216cb440f9ad43bf9e87212d594b0c2f8e7b40f770695be86a7fb92abddcfdf11bbe85fbd03d2f306e7f4fdb6
TLSH
T137112183AFE870509AE696B0CBE8D53D3CF4348228EA34D11C91C896245AB5A2B0803E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 21a3150a5b53cd8f4722505be245f21174df59b9933401fb086744809373f105
MD5 f6e2deba8cf53cda716a5b1e5f8f65c4
SHA1 94a083201701aa2bf2281c89f56b90486c5bbb6a
SHA512 a3807a8e23ac108e395814b9a00000223d46196465d400a0ed09b577b3e62e247556b0670f48134c7fe771aafb3bd589197fe89c5ae7e6ae112264db42aeabe8
TLSH
T1D841FAEB1B0A38787F469FDB6C79C4371E3462E4A0C44842B6F7C8D614EE7915D1954C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 55a9a4658732b576f72e2ab51f8ca57242b561e75a0111a6a2c980c28eb38576
MD5 8acc34728fd66d8c73d0160b02b0b0d9
SHA1 a7484c0ea85f8477d20130cded99682f52d23a65
SHA512 a323dc282f3650ada17f4c7372b9606d54d2f8673752fc142e4c08310f055aa394838ebcab4c42aa8881fb49f566552b5998bce0a1688fbf46fbee1047edf0fc
TLSH
T175C08C2C5AA20A06F2A8437C12C27A039B208101E241CF052AF22A08D996B166878C3A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 a51c1e31277ccef74f7f5dc644b86e354c949a02750211fccb350a4f50b2d673
MD5 b79fe91538ae8c1d927f83c3e952212d
SHA1 377ae815c64438ec8e7c94a93be475559327d92e
SHA512 4c319f7364a0079f20ac90261eeec50081a8ea3914b6725e23d7b55c5701cef2ddca11490c1861b1ce34209fce0262a4dcf47847b0ee811f43a1ad2324d01269
TLSH
T10FF05C2C1BFC847EE133DEB8D7D5A3639916F116240445E906D24B489903B427C5153D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 88f2d6f2a4d9fee183dbe30af84323b68b9a6f2e57d6ed018d563104301c13cd
MD5 b2e8044005a20e09e3bf9df54ae0bd57
SHA1 c16298b3dcd18121c420e9db19fad1c4bd984545
SHA512 69f5bcfead2ac2bd1cb3a2bbe9e7af55c065f9a82e97a8ecf8d258bb5b3845e57684790627c0bd30282784036e94e52031a1d580456368463fd547df298d99ac
TLSH
T179F068283DFE513FF033D97843CA31B0592AF20A300276752AB157082A26F112C41619
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 b550154a1851d0476ac50228d2db11499ecb10c7a1c8509a2fa7fb03a36599fd
MD5 ac0b0cb23d1eb1e1abcc8a035cbd7bac
SHA1 6e215d80f786fbd230830f722c5848d8b1d1a93c
SHA512 6b84fc1ef2c2bd77c710c2fd3927010a31106db4bcca08a10851c69144ac8fc1af901e78b4676f2346dd0a4ec7ac54720424d3b6296d9e2ee1c7a1ad503831e7
TLSH
T1F4F05C1421F8410AF0B3E8B8C2E122FAE939F108380982AA06DA26075616E110D9162F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 4fe6ac6398c6dc7a604317bbeeb5b2b76f64b33c2638e98be76fd442e88b082c
MD5 f0afe60e1f728b325bc46fe599088c5e
SHA1 8b107ce5642d1f732764dfeef01265ffd5dc5eed
SHA512 8b4081ab87c7eb725905f1992a642d1f6d8b918947d8aeb3c89e3374c106770c9e0fd6d04ea7283c8fd6fc73a3248ce93c6b75d606de8eba975e194e013c4728
TLSH
T12ED02234ABE40222F038073D89B3568ACB203162E0D24F8D0BB1219F0C3CB134FA390C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 475c3715b0317a66a7c93db7358717a46c9469dfb0cda0679684ff408b7461d6
MD5 db5a7f41f963e978c39e94df39f80465
SHA1 9946f6814fa58fddd825561856910f089cee7ac8
SHA512 4ef25215250251bd5501a8e005d83dad3c45b23eef7a1e0048bf929ced7ee5febde7c77353125acef6385a4cf8a07a03f955251bf8f3b3b35197d8fcb52e4e8a
TLSH
T13AF0552426A2013EE232627809F5E3EADA06F2167404C4A926EA130AEA4AF801C2143D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 fa6eb90700970935740ba68305c5180fe87813da6a79cadafdb8a6f4568a3894
MD5 cefae1793d259dcd0d58720f6e616862
SHA1 6a3a29458e99e63963eb0fb8c4e2dd806935caae
SHA512 941df7e355890379831a22d52aafa9b7e7e77fdfb724d5fac326b3afd199905a4fa8c2e1492140ef3c181ecdd6d1f48a40c7907e51d18e01a1a7d6f3423f842a
TLSH
T149F0AB3814B7022FF233D7FC43C642CA953BD53632042BA02BE14308AE86D42B930912
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 06728b404e6da1656be211bd6f4a1fee2141dc120e3e76152a14d51f4d551003
MD5 8c008b3ab45b01310bd72fd4ed46cd2e
SHA1 f037c0ceac14d003762627d23d71beb796df1b9f
SHA512 afa86409886257ba1fa1bfe459ca90a923e0aa929e0ccf3086316e5013a42a74317453ac6ba315eba664e5232e797310a442ee5981b997b7d76d2eb1ce29d775
TLSH
T19AC08C1C46650606F2A893B802C22A838A208610F3829F0127B92A48CD25F12A874C2A
MD5 SHA1 SHA512 TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
Size 9.8MB
SHA256 d713bffb18ec860398b3f1be32042061dad4a9c87233eda78bc6129472011d38
MD5 4519bf2384e0152ca9e5b658fe875ad1
SHA1 f73585a11dca784985dea3c5f117ae05177cd63b
SHA512 d7579f7c165c02686e4830241bdf85e74f0737f18f64903126013561cba17a1337d13776153e6c932a00f0cc9b7b875ac5e8f9751adfd7803e713b3e18a975b7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSryEIq:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSr1
TLSH
T19DA633EA785F66BBC10E1C7A8E068D6234BC5BB18B644C97FFC67DB60850C521722D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
Size 10.1MB
SHA256 99ad2725c615b1932415f89470e7e362871a0519a9113f6c482fe70c2ccdcf7a
MD5 ad3459d1d1e15aa061aa7a78788009ca
SHA1 8781b24f002409c1e6e483e98fa0b644361f59af
SHA512 266e1c269b03be3fc2a10556c232d66d91023ef0cc30defe94e55ef836e049617f3215fa00c60125a7701ee77a793920d958f1947d6bb0f2aeaf6279187ddc38
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSryEIDyB:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSrL
TLSH
T193B633EA785F66ABC10E1C7A8E068D6234FC5BB187644C97FFC67EB60D10C521722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
Size 9.5MB
SHA256 64090f20add4acd3d16ab2e3da3f98724855ce9f29e82b4e9db0ce495bb9b24a
MD5 48fdc62ca0319696d62a2f0a1458a5f6
SHA1 c1e20430b0339a9d8bbfdf3b42e7f6e3352cda67
SHA512 72925b1d9111270c19c1005fed55dd0260bbb63130b00f257c78751c22e3fb095c4ee5a531a8c212e456f2f01ffb3b77a1542b3218a7cdc6c60c465f148dcd98
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSryEIn:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSro
TLSH
T183A633EA785F66ABC10E1C7A8E068D6235BC5BB18B644CD7FFC67DB60810C521722D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
Size 10.0MB
SHA256 c017e2bb19ac743a4c609d7f111b681eaef3118dae005a6bcf99ef383320083a
MD5 e014caf6b003b91c901b029dd1d5a004
SHA1 2eab4f18435c11d753167c72b5caedbb9d7edaca
SHA512 d018271c2a1fedb4842095a3e907694e0c4af5df429b26b05fd0569cc38a24d17f3db514d9749b33236be4e2aed8ca8253a21a13ef8f3934ff34d9b6d773c3da
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSryEIDy/:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSr5
TLSH
T105B633EA7C5F66ABC10E1C7A8E068D6234BC5BB187644C97FFC63EB60950C521722D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
Size 9.3MB
SHA256 5d9370dd83eb418d8edd80e088ca93086a634e5d0d44924007cb855bce78dfb4
MD5 9a45310805efd6d4e021fe5323ffdc6d
SHA1 096367fca3e38570b5744c2f4b9167b56a852540
SHA512 1f97efddb8ad84f41a8596a99d547c9cd5d3d922bca10c4e2eb142474538bd4933ebea533858c4a74b23819deb0c07b3216dad3c64a5e28e55cae9d482b65d36
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSryEj:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSr/
TLSH
T1C6A633EA785F66ABC10E1C7A8E068D6239BC5BB187644CD7FFC67DB60810C521723D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe
Size 9.2MB
SHA256 97eb6d2681f13e7788c01de75c27cb6f885426cbf4d9797894fd75fba63a573a
MD5 edfb98f46b242f0966818d08f25a76be
SHA1 4b87948f6f4e746c198de4fcc2826f0c321db58d
SHA512 66ad0940c35513707995e970719d68d1135622c38167cd6cffe1b1fda4ebeb1b0bfc6354530d6264b06a87d6af8b9bcf2d593c40455f6defbe257afcbd264a23
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSryEy:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSr+
TLSH
T1F5A633EA785F66ABC10E1C7A8E068D6239BC5BB187644C97FFC63DB60850C521723D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
Size 9.4MB
SHA256 5f865ef0a3ca0da4a9c7a76a5475cc1c6d327e7f5886be1b25b8cb46d7e436c1
MD5 f471ba65d484dd1b7be11314c8ed36c4
SHA1 ec7ff43a94f67a9f61bb2f10667026fdebdaa488
SHA512 ee843ee3e462cb525860721fecf546a573d2ebb12e5df71b9733dedebbf9689afc17383e8a80582d074fa6959b9bfcad50f7e2c1060b8e8b3b502b7f48c28d87
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSryEo:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSrM
TLSH
T199A633EA785F66ABC10E1C798E068D6235BC5BB18B644CD7FFC67EB60810C521722D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
Size 9.6MB
SHA256 9647f33a2fab9b4fe4e3520a2976b2718527f9cb6a957b428e8a96399e62a627
MD5 71e679f4548b7bdfb80f6112c905613a
SHA1 e444680012aaeaa64a0226d69d4f19071f43946d
SHA512 af8b5b97876df1aca2a6bcbe8604ec52e7e1e59db7c10fce35054f2954765cbf9783d6519bfbece536892129a88f7946b60bc5d9350fb50817c99dd7747c0337
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSryEIp:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSrw
TLSH
T19BA633EA785F67ABC10E1C7A8E068D6234BC5BB18B644C97FFC67DB60850C521722D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
Size 9.9MB
SHA256 7b8bf4e6589ce321b14a04be7a37e6d904e1494187edda1f584786d3c3e89d3b
MD5 963b619fef0b8fbd43c9075fae6bedd3
SHA1 687144284cfc08b7d2f2a463cfbdbe8fd2e95c53
SHA512 3bcbaf5b08bdf48039969816fe0e42f0664f2b333a49911a24a059e416d34ba73df27de8bfbbc7f15607e1933307995595b983e78396e2fe39ed755cb357eaa6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSryEIDy5:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSrf
TLSH
T13BA633EA785F66ABC10E1C7A8E068D6234BC5BB187644C97FFC63EB60950C521723D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download