8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
Size 9.7MB
Sample261110-tdcdlabw51
SHA256 8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36
MD5 3823720dd1d36f016e12fe27b9fc41a2
SHA1 a53757c7909356ee10d0c4b1ec75762b235eacb1
SHA512 c4f30a3902c914b969f903c1f950228025568d62cb0007af86b2abfdc42d70865ea05b3cd6e14dddf7435efd1a863c11dbd7f6b36ac44e6dde173b59372f1c65
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3wlGKEH7/41:TDpbgBr/4QAMQMrEGRONY/4VuwwKq7/6
TLSH
T1D6A633EA785E5A6BC10D1C7A8E468D6235BC17B1C7648CD7FFCA3DBA4840D831672D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 17 IoCs

pid	Process
2844	InputService.exe
5884	InputService.exe
5832	BackgroundTask.exe
4564	BackgroundTask.exe
5232	SystemTrayHelper.exe
1856	SystemTrayHelper.exe
4620	WindowsHost.exe
4612	WindowsHost.exe
2512	UserSession.exe
928	UserSession.exe
4484	NetworkHelper.exe
2412	NetworkHelper.exe
796	UserSession.exe
2848	UserSession.exe
5852	SystemTrayHelper.exe
3144	SystemTrayHelper.exe
4004	UserSession.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\InputService.exe\""	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\BackgroundTask.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\SystemTrayHelper.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UserSession.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\UserSession.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsHost.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\UserSession.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SystemTrayHelper.exe\""	UserSession.exe

Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
98	raw.githubusercontent.com
117	raw.githubusercontent.com
126	raw.githubusercontent.com
14	raw.githubusercontent.com
41	raw.githubusercontent.com
54	raw.githubusercontent.com
65	raw.githubusercontent.com
81	raw.githubusercontent.com
94	raw.githubusercontent.com
103	raw.githubusercontent.com
113	raw.githubusercontent.com
4	raw.githubusercontent.com
28	raw.githubusercontent.com

Custom signature

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c4f4-27.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4f6-94.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4fa-130.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4f6-166.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af3-203.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af6-237.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001a22c-274.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001a22d-283.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001a22c-341.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3152	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
3152	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
3152	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
3152	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
3152	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
3152	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
3152	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
3152	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
2844	InputService.exe
2844	InputService.exe
2844	InputService.exe
2844	InputService.exe
2844	InputService.exe
2844	InputService.exe
2844	InputService.exe
2844	InputService.exe
2844	InputService.exe
2844	InputService.exe
4564	BackgroundTask.exe
4564	BackgroundTask.exe
5832	BackgroundTask.exe
5832	BackgroundTask.exe
5832	BackgroundTask.exe
5832	BackgroundTask.exe
4564	BackgroundTask.exe
4564	BackgroundTask.exe
4564	BackgroundTask.exe
4564	BackgroundTask.exe
4564	BackgroundTask.exe
4564	BackgroundTask.exe
5232	SystemTrayHelper.exe
5232	SystemTrayHelper.exe
1856	SystemTrayHelper.exe
1856	SystemTrayHelper.exe
1856	SystemTrayHelper.exe
1856	SystemTrayHelper.exe
5232	SystemTrayHelper.exe
5232	SystemTrayHelper.exe
5232	SystemTrayHelper.exe
5232	SystemTrayHelper.exe
5232	SystemTrayHelper.exe
5232	SystemTrayHelper.exe
4620	WindowsHost.exe
4620	WindowsHost.exe
4620	WindowsHost.exe
4620	WindowsHost.exe
4612	WindowsHost.exe
4612	WindowsHost.exe
4612	WindowsHost.exe
4612	WindowsHost.exe
4612	WindowsHost.exe
4612	WindowsHost.exe
4612	WindowsHost.exe
4612	WindowsHost.exe
928	UserSession.exe
928	UserSession.exe
2512	UserSession.exe
2512	UserSession.exe
2512	UserSession.exe
2512	UserSession.exe
928	UserSession.exe
928	UserSession.exe
928	UserSession.exe
928	UserSession.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 5884	3152	8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe	91
PID 2844 wrote to memory of 5832	2844	InputService.exe	92
PID 4564 wrote to memory of 1856	4564	BackgroundTask.exe	98
PID 5232 wrote to memory of 4620	5232	SystemTrayHelper.exe	99
PID 4612 wrote to memory of 2512	4612	WindowsHost.exe	102
PID 928 wrote to memory of 2412	928	UserSession.exe	107
PID 4484 wrote to memory of 796	4484	NetworkHelper.exe	108
PID 2848 wrote to memory of 3144	2848	UserSession.exe	113
PID 5852 wrote to memory of 4004	5852	SystemTrayHelper.exe	114

C:\Users\Admin\AppData\Local\Temp\8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe
"C:\Users\Admin\AppData\Local\Temp\8888718ea15953747b75131ecaa117a1acb199e367bbeadc6637dc361ad4ba36.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Local\Temp\InputService.exe
  "C:\Users\Admin\AppData\Local\Temp\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5884

C:\Users\Admin\AppData\Local\Temp\InputService.exe
"C:\Users\Admin\AppData\Local\Temp\\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5832

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1856

C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4620

C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2512

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2412

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:796

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3144

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09A184963DB18218E7969055927ED546
Size 280B
SHA256 d715bcb4b19603107a525ed1f402809d9884464f985e6fadb258be7065db3610
MD5 0b22d6d944fcc7a7083bbba21522574c
SHA1 d55dd42499ae4671c74de7d9086b3137da7b10df
SHA512 42d7531e7f9b19bce718d65cfdb1cbd3db79d7b98a299d47c5226428a323400082d02325f2b0b5a967edc5ac2fa22e557bd2cb742dc7c0b9ad6694909b297e3e
TLSH
T137D02B0E99F579437D23C6109594D526701314741BE0A228AC24C32AB825D3F1F25120
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 311B
SHA256 58d1fcf9271a586bfbfae53b7c3ff43bba20dcdcd44f08a483a57025b4ba6827
MD5 d6037eeb7409b26c7c641f29bb8efc40
SHA1 646146d85aab585ba4289adbf05e1d2263df693d
SHA512 bbaa440b984682032a8ff249cc7bcd5b190a5661ef3d36f66ae3f864586ae9b0a745878cf4d8117a5b8039efc094a24a0a0d71199f78e813cefa0f79d34cd8a1
TLSH
T1FEE07D22E73C99C47221992C0F66406D7890011D89A4495679385BC54D463BB840B01E
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 3ad2ab88c78173824f34c3a8f78799a983e7907c17a767cefe92ec736b0017af
MD5 6a0ff8a73931feb880e25718580f7475
SHA1 ed3109729892632f8fc408733f0bc5f844cca891
SHA512 b75bac4bd8c5df6817f78a1fccd7ed97e2047ce4bc85622e09915298c09bd8354bf3992fae05e9ea7b8aa5b4cffcc3e90d6a3463aebd1ea8852fe987973c2dc7
TLSH
T1B441D8DAEA5C3064BF869F40593CCB362C78B291A688645571FFC8F230D6BE42D1A85C
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 236KB
SHA256 c7225a707d87403840addeaae5256351fe20bdf9c3a218e0c1791b780e834993
MD5 163b6e94c98e7fb3cd1de7bd07f3a293
SHA1 dddd66e456447f1b4e9c7e4e324d64c96def5944
SHA512 7d583904903f9a5555889a3cf6fdcc4d71745c25e0308d45d681bc5a7298a87e61b51a07a426badb7f0496eb4f44abe8270322418e5eae6a0633b88f0080e2a3
SSDEEP 3072:e7MKLRCV+6E3+bCtYuiRGTVzDZaJuJ1sGO3RjBm1CI8S2as2O05at:e7MKLM+f7+2zDZwU1a9m1j7BsJ
TLSH
T12634EE589DB7F0665E8A9D618CD79E8E47F031DB2342621B4EA35FD01C17BDB8E6208C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 eb5d684d6c9c1fc72b425047f74e1d6ad36b190cc81f6cbfbd044bcacb132fb4
MD5 4f4bfbb0768dd4b6571c76bdb9d2da30
SHA1 50284555eecb59c80a8d5559160748c6c5d986aa
SHA512 e18e5f694cd0117533c32351fcf24415ea7135fc7caecc7561b03f0442f3e8255d02be82aecd3fb8c58a8b6020883a20f12c21c6d912ccea501a557416a56127
TLSH
T1FE1154C2DFE8F1819AE257B1CAE8D5267CB464D52DEA70C16C90C8D2349A75E3B0903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 3f13e844dec517f1b5ee52ea4bacb23645885531067da7597df44918b2655152
MD5 8b154fa94733b466b201660bbeb080b9
SHA1 f9a19fdad45c39998a381f630b4b10f23dadd918
SHA512 c0e15be1563d305e47820f6ca8b905115b447041ad4f45c2d92870c7203881826dcc6fa7d5e0e680f4162e74a7fad53b6f201184bcf95f8f0d67e3292891a418
TLSH
T15541F8DB9F4D7878EF42CF8B2DB6C47A2D78847490810885B5B7C9C221EEBA6690945C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09A184963DB18218E7969055927ED546
Size 484B
SHA256 ebe92fd0161a79e5d9e30c6faf0e1f8b2912c1369a27a5b4c80d90236f09826e
MD5 604393d3ba4fa20344bd363506b90c97
SHA1 0a88c06e20eb253c68866d3ded2307487286bd21
SHA512 20d0d6838d7c2886b8a62cc26213bba384218973e059233daa4adfc9bcec5e3fad79ca58b552027206e28a47d09ccc7d03c607e18af8883fab4a0a36397fc874
TLSH
T1AAF0AB2409BD031AE43AE83882E57D75AC2EF6163B089BEB17521605AF21E100E8152E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 1322ed6bb0bb62239fd1e252910d7cdade6e7aa6b60dd61de96fdced376e74f3
MD5 61205f9fddfdc3dc23ce1263de3150b3
SHA1 a235bee4ac53d6f47f4cb162c6d6fee5725a9e64
SHA512 b6af552701aacd13f42457b5f80c4c2f7403df754776f9a8fc32a5e364ea81b8f7d2efde205e273d95d571de0432b09a9635a669615270f79b0f9006da78cf3c
TLSH
T112C08C1C1AB20A06F2A843BC02C13D039B208101E241CF061AF53A08CD9AB162838C6A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 9d9df7ed9479a51658130200ff4b035ebd0e27722aadd5c1f992829d2ef5e611
MD5 101eadc9a7b516eacde86d8fca14e15b
SHA1 17070f21e5e01c13497f56c962b09d43bff4b125
SHA512 eecc8285df9750b8d2347df4da475679d4fcf35caf62ab7fbdac5cdcb5f01e6fd606e2b677d55de853635bef611db44b860590137f6c21fb623ac502c560ea44
TLSH
T19DF05C2D12FC843DE172DBBCCED467D1B819F237340842D816A2470C9A03B013C6172C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 1e327b0e4f01b7be2a401cefa23a6ca54a541bb4841c2f87b7cdb3f912cc8e0e
MD5 9b5f04e7c6b03c966727f207eac75a8a
SHA1 8a559a12107a9514bc1e7c5eef69b5366510e62d
SHA512 820c3289a5a1b4696b68e8e00b02e4ac573e1399dfb51729e61fe79c25720d42d6f0b921d5fdca2230bc4f1ea85b7bdb12ba6fb77aadf54c5113133e1cd04e9f
TLSH
T1EBF061543DFA617BF276F578C3C530710C37A316600659BA17F043086916E112C71526
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 bb9fd355541c09396ef0ee06cfd7aa2558dfc077f3fe53718b070b80cad7e08d
MD5 9c16aea15f6b8245b26d7e5ad31a2392
SHA1 81eda8df61ba187fd56d1baf78ca971e0cdbc182
SHA512 9c868f50f8a8151a0625a1f8708c596f970e411638dd5a6f451537e19f1b2a4559b6f8455763eff8fffffc3fc7cd85f578a82dd4fee7772011263d47b0b715dc
TLSH
T1B7D022281BE40339F06C023A56300A886DA56026F8C28F0E1B7A4188482CF408C65C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 e1adca5d7ae8e14f49e7bbc839ced2031dd13f915aa9b795589025631e81ac52
MD5 cbc3a5ad7af3e28a2d54c86ff0d02724
SHA1 eeb89063100026d00aea71ab10717d64eeba3a8c
SHA512 4eb419f256e6eebc5a5b1e795cbcecf9a47a24adca5bfb765b5764c9125b6d4f85d16d7e689e7e1759dad700ee6e279be6350d1ad36759bfb8b7f896a59ea6fa
TLSH
T133F02B240AD7412EF632223981F9A3DFED15B2663400C0AB1B9B034EFE23F801D2043C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 b948281609bd1dba40692ec0956264a1f13de8a3befe1776183ede87db1dc697
MD5 f722515d0debce9512a0b1043d6d486b
SHA1 5daf751ac13439775c6b7e986c367c4cf2252206
SHA512 296fa6cbda2c0901d7de0fb7abb35922d800c49917abb4712fdadd2e818e6e765e2e2fd54122fbab425bb19bb464f79d1a0cbf98ad1c850a9bb1302d41992908
TLSH
T18CF0AB3528F7126EF2A2CA7C02C562D70662E13733093B69677182095E0AB00AA30D25
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 662d6a19f441f65ffd926db5fa27483c593ceaa7bd19bb6ab32c11fca2387acd
MD5 39403cac69f8b19d9e28391fb48040fa
SHA1 c6593dd9bd465794c95b0ad785986dac100ff8c8
SHA512 dec12f5fa8dfb378c551581a1999bbed0daf63163d93bef7e4bd79791cccdbb1d469fe9b73235e4991aa8c399707d3f95666bfd24c5cc4b7a8428b0096e1fd80
TLSH
T13FC08C1C06610606F2A883B806C23D838A208110F3819F0226B63A08CD25F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe
Size 10.5MB
SHA256 cddbc49f5c96ff47c9a94b082aa9e411f274f9c73e8331734dfddc519dd81774
MD5 5cfb4f9719845f38281f6c15660a2ccb
SHA1 293f9781a3cb06d1c6d158b514d9db9f541f95b3
SHA512 a657d0041d6fbf4884599815ff5b307dd2dce737a53d6d779754c12424f0b2473db12b187cb1563a3d375eb7d6323bf768c4043651519c5aa539095566bb9146
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3wlGKEH7/4zJ2t:TDpbgBr/4QAMQMrEGRONY/4VuwwKq7/9
TLSH
T1E1B633FAB85E1AABC10E1C798E568D2275BC1BB1C3648CD7FFD97DB60840D431672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe
Size 10.8MB
SHA256 c7e3bbd70731ca6650bc47ed7694ced26f25a489263ac2b319cfe660e85c740e
MD5 a3215684fd8ef8a15d83133c902ec82d
SHA1 4d9f7e240e151e727846bf9b7825e4959479772c
SHA512 2a2f26943e00a07306d7fb8d51a13f389f76e754eb66276c53df7977182b6f329fe49e334596ab2ec8c961b42a313e95e56a6b5cf7b079014e78dc7c9f2465f4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3wlGKEH7/4zJ2HB:TDpbgBr/4QAMQMrEGRONY/4VuwwKq7/x
TLSH
T149B633FAB85E1A6BC10E5C798E168E62757C1BB2C3648CD7FFD97DB60840C431672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
Size 10.1MB
SHA256 9347b6c26405fa9f7ecf344fda6fc793f9d2dfeab230da4c56740a83d50514d5
MD5 40af9fe5d39fb5c87e01d3de12b074d9
SHA1 cf37f7d30bfe686e6f1db06fd9c6ffb8f0fe52ee
SHA512 69822f30cf249c55ab81aca06f0fa0ceaf556c13cda560a61b38fbc1de9f9e38b0f2b7fa59d29120a6ffb7536dd3434aacf3168865c3fa96f0e5862e6b96575a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3wlGKEH7/4zJc:TDpbgBr/4QAMQMrEGRONY/4VuwwKq7/x
TLSH
T195B633EAB45E6A6BD10E1C798D56CE6235BC1BB1C3648CD7FFD97DB60800D831632922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Temp\InputService.exe
Size 9.8MB
SHA256 2dbce0c59c0868e6bda87fd5fc6d1c4e2a7f8c849b0cab0f8b26b5d8aea5a10b
MD5 8eba6e7d0e7a388abd97f4fcb76411c4
SHA1 ceeffd2697fa9908857f5c7e2019a060084f1011
SHA512 0c21de631bea01b1c204ae6624ddd68fb0e3625fc595e2587cf047c6de83ac4ce8aa0120d1b4b1e180a5ae147d465b16ac966daec46d043cc4269092d3532d47
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3wlGKEH7/4/:TDpbgBr/4QAMQMrEGRONY/4VuwwKq7/8
TLSH
T15DA633EAB45E5A6BC10E1C7A8E468D6235BC17B1C7648CD7FFCA3DBA4840D431672D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
Size 10.2MB
SHA256 e59f3a8ce44a9dd9008fe74b5d89bc1af1098f5e2e2988533ea1de63bab6f828
MD5 f41db449485a441e6873f081f93d2dbe
SHA1 90667a9d6ba682440524144c88ed00d8d74660d0
SHA512 beadf4479af0ecfb3c5de515cfaa1fef5ab0d5c25016c1ac5a9311825335c0c24fedbb7be8a993f8d4aa99aab6381ecc733a32ee4e15d29d9937e69e9fa97c39
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3wlGKEH7/4zJZ:TDpbgBr/4QAMQMrEGRONY/4VuwwKq7/s
TLSH
T131B633FAB85E1A6BD10E1C7A8D568E6235BC1BB1C3648CD7FFD97DB60840C431672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
Size 9.9MB
SHA256 f97e6d854ea837856a664d818f71ce0849782074ab13049fbf8089569a73433a
MD5 ad69fce71ccb2ef3f516a6866877e2f9
SHA1 ffe1d2038c8c85921cc1e0966fe85df78169542a
SHA512 d4cb6319d5874c16761b7e86d99a823958219726be7dd75d92de9012ba493a8d4dc51118c7e0984c4b351bae68ee87240ead2a8858eb51fbd4c5d4b62014f2f7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3wlGKEH7/4J:TDpbgBr/4QAMQMrEGRONY/4VuwwKq7/2
TLSH
T115A633EAB45E6A6BD10E1C7A8D46CD6235BC1BB1C3648DD7FFD93DBA0800D431672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
Size 10.6MB
SHA256 1c0d2bbd45cb39f4f49f6ed983edc4ba082f3b230d3f3de4e2592561b4da14f5
MD5 c43da10dafeed01038bdd4ae7e024049
SHA1 e19ee7a91ecfce101ceb90a743031345d1ef2aaf
SHA512 f96a96d8d76553710db1af14179f330f0fd26801598af6e88470b64ad642873a308af642494256fe17c7a9c19f7768da5cbe29adebe2046dfb23ee9ad8912a4a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3wlGKEH7/4zJ2l:TDpbgBr/4QAMQMrEGRONY/4VuwwKq7/V
TLSH
T1C9B633FAB85E5A6BC20E1C798E568E22757C1BB1C3648CD7FFD97DB60840C431672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
Size 10.3MB
SHA256 4e09c48f81790a1c6793056b5f3c7c36a51ac6503e5251c6255c3323702f1def
MD5 60de5c527feb9c90315450d44f5ab8b9
SHA1 74ae9376564e1adadc15d53edf81992044b58d96
SHA512 91259e7218aa54fc3d62b79c5375aa5d2e8116c38b13bb910b6a7fbc81e032c51dc58d9636947864a89bfec7f6636c037504184b4d4c36ad3a265f255dd81466
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3wlGKEH7/4zJ2q:TDpbgBr/4QAMQMrEGRONY/4VuwwKq7/6
TLSH
T19DB633FAB85E5A6BC20E1C798D568E6235BC1BB1C3648CD7FFD97DB60840C431672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
Size 10.4MB
SHA256 6061a554473640c9956243e6c6654c4bcb72899450b99e61cf87506d726cef24
MD5 883b36376bca43656aab6a90ed922c52
SHA1 bd8fffec2bae2097bef32a933be060557112a1d5
SHA512 94c3de87bfe5aa17ec947d739ea9d4d8e85f98fd92abce6cd3d7e5840f90e6a56f614126dfa5d203fe8fed357fe96b9c998fdc259247097b287c8e18011a890c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3wlGKEH7/4zJ2w:TDpbgBr/4QAMQMrEGRONY/4VuwwKq7/A
TLSH
T156B633FAB85E1A6BC20E1C798E568D2275BC1BB1C3648CD7FFD97DB60840C431672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download