8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
Size 11.3MB
Sample261027-vf9ybaea99
SHA256 8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933
MD5 1ae00c848166cd27beac375efbff89f4
SHA1 1ddc3a8fd726b519afa4977b4415ac2733a69a1e
SHA512 5e250f365de7eedd01b305e0f7617d485f71e95fffe6356dcd9e6f96b01a7b1c9a767d26290faff0bf093cbf68e14dcb45487d67a690923ca733a2baf6e584aa
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoRpFrhu:TDpbgBr/4QAMQMrEGRONY/4VLjlBLScC
TLSH
T1D8C633EA785F57ABC10E1C7ACE068D6635FC5BB18B648C97FFC57DB60800C621622927
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1344	BackgroundTask.exe

Executes dropped EXE 15 IoCs

pid	Process
3764	BackgroundTask.exe
1344	BackgroundTask.exe
4220	ServiceHost.exe
5564	ServiceHost.exe
1712	SecurityCore.exe
4656	SecurityCore.exe
5400	ServiceHost.exe
1076	ServiceHost.exe
4156	InputService.exe
4328	InputService.exe
3652	SecurityCore.exe
1836	SecurityCore.exe
5860	UserSession.exe
2044	UserSession.exe
560	ServiceHost.exe

Adds Run key to start application 2 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\InputService.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\BackgroundTask.exe\""	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\ServiceHost.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	UserSession.exe

Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
52	raw.githubusercontent.com
56	raw.githubusercontent.com
65	raw.githubusercontent.com
69	raw.githubusercontent.com
103	raw.githubusercontent.com
1	raw.githubusercontent.com
38	raw.githubusercontent.com
77	raw.githubusercontent.com
80	raw.githubusercontent.com
92	raw.githubusercontent.com
99	raw.githubusercontent.com
13	raw.githubusercontent.com
28	raw.githubusercontent.com
43	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c4b2-27.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4b3-104.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4b6-139.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4c2-173.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016b09-208.dat	suspicious_telegram_bot
behavioral2/files/0x0007000000016b0a-241.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016b09-271.dat	suspicious_telegram_bot
behavioral2/files/0x0008000000016b0a-305.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 32 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3852	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
3852	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
3852	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
3852	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
3852	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
3852	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
3852	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
3852	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
1344	BackgroundTask.exe
1344	BackgroundTask.exe
1344	BackgroundTask.exe
1344	BackgroundTask.exe
3764	BackgroundTask.exe
3764	BackgroundTask.exe
3764	BackgroundTask.exe
3764	BackgroundTask.exe
3764	BackgroundTask.exe
3764	BackgroundTask.exe
3764	BackgroundTask.exe
3764	BackgroundTask.exe
4220	ServiceHost.exe
4220	ServiceHost.exe
4220	ServiceHost.exe
4220	ServiceHost.exe
5564	ServiceHost.exe
5564	ServiceHost.exe
5564	ServiceHost.exe
5564	ServiceHost.exe
5564	ServiceHost.exe
5564	ServiceHost.exe
5564	ServiceHost.exe
5564	ServiceHost.exe
1712	SecurityCore.exe
1712	SecurityCore.exe
1712	SecurityCore.exe
1712	SecurityCore.exe
4656	SecurityCore.exe
4656	SecurityCore.exe
4656	SecurityCore.exe
4656	SecurityCore.exe
4656	SecurityCore.exe
4656	SecurityCore.exe
4656	SecurityCore.exe
4656	SecurityCore.exe
5400	ServiceHost.exe
5400	ServiceHost.exe
5400	ServiceHost.exe
5400	ServiceHost.exe
1076	ServiceHost.exe
1076	ServiceHost.exe
1076	ServiceHost.exe
1076	ServiceHost.exe
1076	ServiceHost.exe
1076	ServiceHost.exe
1076	ServiceHost.exe
1076	ServiceHost.exe
4156	InputService.exe
4156	InputService.exe
4156	InputService.exe
4156	InputService.exe
4328	InputService.exe
4328	InputService.exe
4328	InputService.exe
4328	InputService.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 1344	3852	8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe	91
PID 3764 wrote to memory of 4220	3764	BackgroundTask.exe	92
PID 5564 wrote to memory of 1712	5564	ServiceHost.exe	96
PID 4656 wrote to memory of 5400	4656	SecurityCore.exe	99
PID 1076 wrote to memory of 4156	1076	ServiceHost.exe	102
PID 4328 wrote to memory of 1836	4328	InputService.exe	107
PID 3652 wrote to memory of 2044	3652	SecurityCore.exe	110
PID 5860 wrote to memory of 560	5860	UserSession.exe	111

C:\Users\Admin\AppData\Local\Temp\8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe
"C:\Users\Admin\AppData\Local\Temp\8d739e19064142953a260d180111e960f54a52b9a280cad152b369d14d9dd933.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1344

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4220

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1712

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5400

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4156

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1836

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2044

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 fc74daf542642cc7fbd3da172569a24d6044b1aced251daf43eeb132bba6941b
MD5 ba06585434062dacc3a5f731f0bdfb5c
SHA1 0a88d58b9a8fe0d0f8d9a02c8294a6cf4e06a178
SHA512 5ae20cf5c98d1599ee1e63383bb58c2fcf0b68f9c8b32db7ba88eca4a4d764fe86b01cdc20910adb2ee4ae2887d9318cb70c0c66b67f5c6f8e02178ac7ae2641
TLSH
T19AE07D19E60D25A13E120F714171452BB401108D848EA60DB91C09D10C47326D907508
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 3180524812ab237ad27611c53c5607d396767eb8dab1b495aa108ad0718713f6
MD5 1cb6ab2ec4f2493cd42f4d805ae8edfb
SHA1 5ad1376bf30c15ce11941a60cc438beb08b16298
SHA512 d4dc95503d44168359b6ae615f96a5d850ca97f8303026ef6ed683ef4e4afa3510839fef5ffae14b40cbb18527655d6117714b19ecf4b395bf5910dbea559ac7
TLSH
T14541D5DD5F5C7425BF81CF481978CE222E38F2D0A588A096B0FB84B2A4A5BD01D0AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 278B
SHA256 aa127391105344e3fdc5bb79aa83e5fe84fbe3fbdab295c0a15844df595163e3
MD5 07ee69dc747b4e11ce7d8cb7c16175d2
SHA1 7b541c98dacacd622306b3c9823d314023c14657
SHA512 5e84548c6b41c0cbcfb85f39c81f32b41bc5ab5534107f77da39df5633ef41890d4e09b07416ecb3ff50bfb90f7e08a9abb69866a98b24a43b06ff353f02309e
TLSH
T1D2D09513ECF75D223F35CD3454D05A15724364A793D6D658F5C1C5D454459791F03248
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 196KB
SHA256 d2f716de09681bae28e405822a4d24d201da0a3c91d93dfbad78a76f568b237d
MD5 750928eee653410f84132920af60d313
SHA1 a575b2d320cdc6c0f6e1fd8b87f3ae71c692ffa4
SHA512 3cd35cdbd61134b401cbdc916ab6b321ca04a624ba1ef349caa7546cab67b694ebda4b5f3221e1906e113dd21a2abd6717453be6c3ebc294bc69d3902bf8f9c4
SSDEEP 3072:vX9EdoYXQvuuLSQvzchlQcYm+RnWZPhmRf32G7z6aW5bOtC4:PKNgvuuLSwchwoPhmNzgq
TLSH
T132142E286DBBB1619E4ACDA24CD6AA5E03F171DF1312631B4EF76ED01D43A9B8E0344C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 207179faf26a6ebc403dd83b5738f28021908c4e215860249e4a8ed2966da9aa
MD5 76221549338e81ec75836e5f1d55ae5b
SHA1 5f33b2c044b9616580782fb6cde56a6b9f79c16e
SHA512 844c4e04a1cf0beea2965792660147b999db61014605004e0ed34e3fb3eaf78ef96550e9a54bca0f273e503a4996a0e15c3da0cece6de562508dd194f65a605d
TLSH
T14E1121879FE8B0818DE757A1C7E4DA267CB5B4812DEA38D11C91C592245B76E2B0803F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 69c62b679d61b04847b57b8ff71a29b32fb54389cc2a39225e1d38bed5ea5500
MD5 0ae180dd658c9f60554677dbab108c57
SHA1 5c27581deb483a5b1889909c57bf80a8862fe2c8
SHA512 eb78143ee00a9e4678af5bc2a5fa7ecd06091139ae07d6be3f802824d34a2cfba53269a7258f2d19b980a0c0bc340f6618dae8ab9a0c9d03016807b51a9f2c79
TLSH
T11141E5EB1F5A795A7E05CFCA58B8C6352D78A0A890C44C42B8A3C4E2059DBC02A4A88C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 f2089681544c90d5e98cb366be2692744af0e345986aac211a225bb11517e3bc
MD5 b2fbdbbe3efd6cb1164a7757b43308a0
SHA1 15f6a3ef3f316b8116301900852148b0e7711139
SHA512 6b2edecb80723b7c99abbf2f97503d6544241272a1dbdbf80665422e0f192304183e6bf6f179a3e74718200c940fcf040609f5224131540b8f4dfd67655f42c5
TLSH
T1AFC08C2C1AA60A0AF2A8437C02C23D139B608101E242CF052AF12A08C996B167838C6E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 88461d4b65f5a31570a44182bd0998e7ef967cf6758af734e51c82c7161e37c9
MD5 44b0b7819308653b43bbd0826ba291f9
SHA1 2d03debd9d0460b694dffa6a7d1fda33fc383e00
SHA512 dd163a3c7650b59832191a59ae0e34d2684e417ffe55bfb6bcb9ecd4f3d76f7b388aa5668f9ac3286ca86562efd7735b845dba4f25556794bf55e5b406035a7b
TLSH
T198F05C3C06FC40BDE036DE74CAD6F2532C15F2322408459D0B924B085903F426D51524
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 6234c0e31e2c89107a5e3bde108ef9f343c85045f4ec5653b71a7bc5ab85dc74
MD5 6b1a8f7ef61a96e42e150e52f5fa949b
SHA1 097e28dbe3e27c473a1683e616293d397f473251
SHA512 86a184f6656315cb9cb02db70ab23e603586ff6186e023714002ac62df29a88d74aa7a19a4d5f671885be419fb85808e0a891bcfba8b9e181873c5d8bc31910c
TLSH
T1F6F068143AFE917EF137AD38A3D131B54A3AF206B00296BD3BF10314AE16E616D42A0D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 a646ef8d79dd52138959dfbb407e3cb83c5210cf589dd798a7b8c4d7afb339dd
MD5 372d88ea96b388fad1ec6a9a7a039099
SHA1 1dabefa8ff5b923c210e7a9a1a97fa34dee4e054
SHA512 8b32edc0a1438c7b8021369e94644defae904621547a6a50aded3ebf99ae8151694a72fc2b3d7dc557c99be2374c52132b7111fb25cd54dcd9ca3a66f3e04557
TLSH
T1B7F05C186178406AF0B2DA38C2C121B5AC75E0163409A6A505D6010A5A16F012D6253E
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 986d6a38b10edc6b3b1f70597efce2f36fcb7a0b1d31bae8bba099d9a19aac2e
MD5 c4b6e8762b8a942e1f77c4fde9f7073a
SHA1 8ec25bd22136b59e1a644b0e2f6c3132de7cc14a
SHA512 601d97864fdebcf6a27de24a0d3a90a279181b75cf2d54add54a1b430fd08d0090be736f5ecf8ade83ecb20e2f3ccd8493dcd723c8aab6cccae0071ff46ca5dc
TLSH
T10CD0221893E4022AF008873941B00E8AE69EB612E0F2CF8D0BF25648882DF920971D5C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 adadab559f656bc6a7a59eeb34f456eff5a0288aa03526a1a32e5884ef65945a
MD5 2b513e36848324d28c1f7d08106b4100
SHA1 cc15d6b49cca1cf3a7a4d695205ae1da14bb944e
SHA512 0c1fe324883a6be95a658bd5bee288819a8ced1422f401856aa5177d79c017b43dba207d38721c1569ff26437b6bbc8acfb31f8b47fbb4c9194840960735451e
TLSH
T187F0553C1AD69A6DE63227B40BF492AABC08B25A3801E4642AE1020AF707F401D22638
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 1d328abb8b9fe92325234dd76878114d262de7d183bed3191772cb231cde023b
MD5 510def9c1f2a6112f9ec9f40d2244028
SHA1 c0c23c3168af8a7ae0a128c657fa912e4afeabd3
SHA512 cf823faa48eb66c34a8b89edbaf8ecdf49b1c4612f51f63a4457ce1926c656118902b87f1bf4e07b51b71c0b1790afb60403f519ac222f136667e6a3aeaf2049
TLSH
T112F0AB3921E7012EF2B2E6FA86D457D68923F2363208236867B2430C7D4BD42A9B0A14
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 20cf0b31cc9ff2e295c3dd9a390ef95261d0cee38195c30f5bc5831ff71bf32c
MD5 c274ea8211f19af0313ab06dd67349ac
SHA1 420e974e131d7025ebe9fd529d4be2bf9e5e4116
SHA512 2e7026f99e86ae99be9c88e60528363cd027abfb8dfad9dec4c1f2fb8cb17e30457e0080d3877a920ff36bb0dfcc3d48fa2b94e9f94097a97afb168e6f50f435
TLSH
T1CDC08C1C06654606F2A883B802C22D838A208210F3829F0126B52A58CD64F162834C69
MD5 SHA1 SHA512 TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
Size 11.8MB
SHA256 02873e14770923d2229335582711de4258d25b4e57fb93d9cbb8ef13fafc8e85
MD5 55e3ebd519ccaa57e70efa0d5f8627ca
SHA1 f512c98cfec7e701e7b619eb9df2125e70eb78ff
SHA512 09785fd6a70ac469a6d26cf91ec5247dfbf8e17c632668f5450ca4398be5c94ea7541de5c21f9e6a0fb432612f05fa560ec08dc13dbbe4d00390a813a362304a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoRpFrhIUbCc:TDpbgBr/4QAMQMrEGRONY/4VLjlBLScx
TLSH
T183C633EA785F5AABC10E1C3ACE058D2635BC5BB19B688C97FFC57DB64C00C521722927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe
Size 11.5MB
SHA256 781c8000fc2dc3951873f1920091f55f7d571a166b140a242fa9884f74497eb3
MD5 94ca734dd8ceedfaebfee69af61e6918
SHA1 b71fd23a83a55fd5a0e0d9cec7da4d8dea09e5aa
SHA512 639f63c960cca28783721cfc009dbe16b040dc212db94fd512d546e629910ff1c023a25d7f54feb593eaeb4cae8ec79d372bd3335b8558a9edbe791da5fbc334
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoRpFrhIUf:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSc7
TLSH
T1A7C633AA785F57ABC10E1C7ACE068D2235BC5BB19B648C97FFC57DB60C10C621722927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 11.6MB
SHA256 ca2895febdc76a2dedd3a9e04d3f9e8dd5bedd0baf213427b12e7553da85acd2
MD5 a7f336ef193f93c991489c4bf17cb82d
SHA1 0a7ee4faf076e8871627b31e355994016d605c17
SHA512 5937f7bb1faf325d6ced34387eafa874b3bbe0c98989715566a60f937ea2781f9a92fa95e6132279de6ea15c344450db6ae160f70e0f5b67570bcbf53c05ec72
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoRpFrhIUb8:TDpbgBr/4QAMQMrEGRONY/4VLjlBLScU
TLSH
T1D0C633AA785F56ABC10E1C7ACE068D2235BC5BB19B648CD7FFC57DB60C40C621722927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
Size 11.4MB
SHA256 e02cb21985b932ef03a75f0044db96a8234410164173657ffa04e3a0bf50d26a
MD5 747085c57d27906e19e3387d5b3b5ca2
SHA1 9887f43231a2c198d13ce0dab9093a04baae2d6d
SHA512 fa93590111787866b2300c6e839569680766952274b2e4beddce81df752089d184544467d0f0d0ddfa93ca371d61fad525f6d2fab6a1e52e8c19b664c72e3416
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoRpFrhIa:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSc7
TLSH
T156C633AA785F57ABC10E1C7ACE068D2235BC5BB19B648CD7FFC57DB60810C621722927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
Size 11.9MB
SHA256 ae8809128059d0fd2dc8e5b83c3ddfc32f8c84b9a06d4a2ebadef76f153102e3
MD5 d51133f379b690db3b7e78f16c5d2dc6
SHA1 8807a6e4bfc03f0da2ffd005217e1bed0e7138a5
SHA512 0cf08ec994ade2503cb96b4f70e55ca2690c3c225fb868c1c071b0e88648983bc68114f30a8f97fe05b8fd28ff6f728bc27e8e53b7664de15c30ce2c8c8a72c1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoRpFrhIUbCkg:TDpbgBr/4QAMQMrEGRONY/4VLjlBLScg
TLSH
T1AFC633EA785F5AABC10E1C3ACE058D2639BC5BB19B648C97FFC57DB64C00C521722927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
Size 12.2MB
SHA256 09ed8e5b6357e24dc11322fe0d9d86a77e2c11dc418a3fe4b85af1fc7ce297d5
MD5 91b9805e9a06b71de86dcc699df23bea
SHA1 fef8271d69cc0a731423dbb9a2c10d7d211997ec
SHA512 817469f6ed472cad4e5d3594e74cbc4ab47b6b8b1f210e97cbdd5d0bf6714958036bf3019b5f3a77aa9a7fedf001340c21de7ddef5de7db4b8728d1e2f3efc81
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLScFrhIUGkw2:4JwMrcMG/IUn
TLSH
T15DD633EA785E5AABC10E1C3ACE05CD2635BC5BB19B688C97FFC57DB60C00D521722927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
Size 11.7MB
SHA256 2ec38ecbbd19f25552abf155a1826a8e58fed9d76ff9616e5618090dda2bb91a
MD5 8ccf6e208876614e66736b521ef11e5e
SHA1 ff3227d1a30d90d07067c8c32c7fb04e58b97d04
SHA512 ec87a3546da160fc32b39b13ce6fc45336a7a73672f5eb56de3d91868efa916ac1e79f173b8f0c2ba734cb496d259056bf606d431746e42272b1ed40be702498
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoRpFrhIUbl:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSc9
TLSH
T1CBC633EA785F5AABC10E1C3ACE068D2635BC5BB19B648CD7EFC57DB64C00C521722927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
Size 12.0MB
SHA256 c58523c1d5e33a0d6f7589ca81d15468c866685da0fb5b823155b9f8788e48b4
MD5 a284397484c587983b508178c34cc822
SHA1 cc3dd4dc6b062bb4c92555f631ffaf6b8c96e520
SHA512 8dab83a15dab9297992632c509b9494a62e56c6d916b0cf0b6a63a87fbc7a55e0210eece2d2e6035bf947dba44aad449b1e16549167c919b7085abab8058bb87
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLScFrhIUGkk:4JwMrcMG/IUY
TLSH
T17BD633EA785E5AABC10E1C3ACE05CD2635BC5BB19B688C97FFC57DB64C00C521722927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download