d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/06/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
Size 4.5MB
Sample260622-tcdj9set7v
SHA256 d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c
MD5 a584845be84859ce0635a410832e3d8e
SHA1 eddad0242107dcd46914d3497603441309034d64
SHA512 7bff96363394b6f8c3c8640f99667ee49f9a5022f1a149139959764b986f0c77fef6ec2393ad4f3c2bac2e8a7708549b0c89a940f5bfa11505795713ed7e2c82
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2oUC:+0s420bTjzGlBrJTJb8QAMQCLrh
TLSH
T1082623E6785E6AABC10E1C7A8E168D6275AC5BB1C7544C97FFC53EB70810C931733922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	DesktopWindowManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	InputService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	ServiceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	WindowsShell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	UpdateService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	WindowsHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	DesktopWindowManager.exe

Executes dropped EXE 16 IoCs

pid	Process
1728	WindowsShell.exe
1688	WindowsShell.exe
4880	UpdateService.exe
4828	UpdateService.exe
4704	DesktopWindowManager.exe
3472	DesktopWindowManager.exe
3792	DesktopWindowManager.exe
4012	DesktopWindowManager.exe
4044	InputService.exe
740	InputService.exe
3060	WindowsHost.exe
1184	WindowsHost.exe
956	ServiceHost.exe
4528	ServiceHost.exe
4116	SystemTrayHelper.exe
2060	SystemTrayHelper.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\UpdateService.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ServiceHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsHost.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SystemTrayHelper.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsShell.exe\""	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
71	raw.githubusercontent.com
76	raw.githubusercontent.com
88	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x0007000000024402-10.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024405-77.dat	suspicious_telegram_bot
behavioral1/files/0x0008000000024409-113.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024412-157.dat	suspicious_telegram_bot
behavioral1/files/0x0002000000021eb2-212.dat	suspicious_telegram_bot
behavioral1/files/0x000300000000071f-247.dat	suspicious_telegram_bot
behavioral1/files/0x0004000000000721-283.dat	suspicious_telegram_bot
behavioral1/files/0x000300000000072d-318.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UpdateService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	DesktopWindowManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	DesktopWindowManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	InputService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3812	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
3812	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
3812	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
3812	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
3812	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
3812	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
3812	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
3812	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
1728	WindowsShell.exe
1728	WindowsShell.exe
1728	WindowsShell.exe
1728	WindowsShell.exe
1728	WindowsShell.exe
1728	WindowsShell.exe
1728	WindowsShell.exe
1728	WindowsShell.exe
1728	WindowsShell.exe
1728	WindowsShell.exe
4880	UpdateService.exe
4880	UpdateService.exe
4880	UpdateService.exe
4880	UpdateService.exe
4828	UpdateService.exe
4828	UpdateService.exe
4828	UpdateService.exe
4828	UpdateService.exe
4828	UpdateService.exe
4828	UpdateService.exe
4828	UpdateService.exe
4828	UpdateService.exe
4704	DesktopWindowManager.exe
4704	DesktopWindowManager.exe
4704	DesktopWindowManager.exe
4704	DesktopWindowManager.exe
3472	DesktopWindowManager.exe
3472	DesktopWindowManager.exe
3472	DesktopWindowManager.exe
3472	DesktopWindowManager.exe
3472	DesktopWindowManager.exe
3472	DesktopWindowManager.exe
3472	DesktopWindowManager.exe
3472	DesktopWindowManager.exe
3792	DesktopWindowManager.exe
3792	DesktopWindowManager.exe
3792	DesktopWindowManager.exe
3792	DesktopWindowManager.exe
4012	DesktopWindowManager.exe
4012	DesktopWindowManager.exe
4012	DesktopWindowManager.exe
4012	DesktopWindowManager.exe
4012	DesktopWindowManager.exe
4012	DesktopWindowManager.exe
4012	DesktopWindowManager.exe
4012	DesktopWindowManager.exe
4044	InputService.exe
4044	InputService.exe
4044	InputService.exe
4044	InputService.exe
740	InputService.exe
740	InputService.exe
740	InputService.exe
740	InputService.exe
740	InputService.exe
740	InputService.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 1688	3812	d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe	101
PID 1728 wrote to memory of 4880	1728	WindowsShell.exe	106
PID 4828 wrote to memory of 4704	4828	UpdateService.exe	114
PID 3472 wrote to memory of 3792	3472	DesktopWindowManager.exe	118
PID 4012 wrote to memory of 4044	4012	DesktopWindowManager.exe	123
PID 740 wrote to memory of 3060	740	InputService.exe	128
PID 1184 wrote to memory of 956	1184	WindowsHost.exe	133
PID 4528 wrote to memory of 4116	4528	ServiceHost.exe	139

C:\Users\Admin\AppData\Local\Temp\d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe
"C:\Users\Admin\AppData\Local\Temp\d016871af763f87535ad97d62dca10698efdbc8a6778929e8ba31e887e04128c.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1688

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UpdateService.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4704

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3792

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\DesktopWindowManager.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4044

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3060

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:956

C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Temp\\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4116

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1590DF81A65FEC0F13022A69A8A4AE74

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1590DF81A65FEC0F13022A69A8A4AE74
Size 279B
SHA256 6e48114e935e4884ecc34f0f58a3a5f0093d285709edc1134a92f6d8344ae539
MD5 3ea3a1000b712adbb080747071f4b414
SHA1 4e85d48198e8078ee27315f73aa0542184953153
SHA512 981a8e33894feb047920fefd6d919f6375890f1d588fbb83ec43da551a050543124b9d4f3c84d6a91a739504accfe29838162ae91ca55232da47c16fb1a32c9c
TLSH
T11BD02B09E3FD41BE3C92EE22E9D9817D7052353B56D5195C1D20C44E200196A3F02534
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 077e1e100c0c035fc1af995413d761a6c5eae2b3ef3852efa4ef87d0d168e23a
MD5 49121691ace3e41a1d5b1090b200da04
SHA1 fac4d403b5a82ec2b641a7f603420e3c81205c24
SHA512 ea161ec62511fd3ee0fea8f9038a5938c54371aad2c176870818473e5d1451d42cc8422cce88ed8e38c224eb98210eaa9bf04b1b75dcd86b105693e270648674
TLSH
T1FBE07D09961D49C9B7378F5447E648363CA1088A648544093C1906C4DC42225430F00C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 b45964e00be9ee4e8f33a8ea357d251cb7afe2e918a6beeda486e24b5cc0b25b
MD5 1ec5072d52ceaa78a57a5f861c2fc54d
SHA1 c34783c0752df071cb613d3a6b920e9e5a172b06
SHA512 067572537c784c9f60f150bede63ba463d04de96018292f6ca02dfb12390d220d0a2b66aeaf2eb86aa6d14e647af2a111d13696b8bd267c09a489443c08c65f7
TLSH
T11241A5D96F093065BF81CE85A879C6352D79A2C0A59015A6B2FBC4E27046B946D1E84C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 0c98e23f35dfc143bc99dd848a920944c10f2666e2a2750018d38cbc73439a0c
MD5 3abf112ea6f7a0903720b91961c3a6e1
SHA1 b420d33a8c450bd0496c50f78b3d532f41f60c6a
SHA512 7f82c0d68434715f624c0d00a02c1c9a41ce2f64b6bb70c8ca7de13f009a00f66ccb44574c7623a58f0f1e19c4ec91de17d30752c10728e245c46fd3a33a2408
TLSH
T1E21121C39EA4A09099F28B64CAE4D5327DF874C62CEE30C15C8288832496B1CBB1583F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 9caf4b04df431b35e8052e564e4802391d5e271d2dc0782c5559a76a67366d89
MD5 36a61c96d20d1427226e7dab085d8a61
SHA1 d3636d9100b8472da93e3e741d85327830f9997b
SHA512 ef1b5808dd9f9c5bcada0e5df7b193538513dc6ed892fdcd68d56b0f7ee749f2e9527749de7b4d82900c19063acd9f2ab3b2f56b957f996f0064814e01ec8dd3
TLSH
T12641C7F7170E35A4AE06DF89AEFCC5342E7880E49480498279B3C4D610DEBE66E4744D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 9ea0f017d71bb03378036cc332e123581528540b52d64e9a6c2f1be4414b0337
MD5 de849559cfd785830f62ac7ed9074f8c
SHA1 a629cc411b2f074d53b1b67e43ce75daa029d1ca
SHA512 df876bd35e15059cb161354d00ac9d9f4c3971be38059ec6c8df1c97cee2f3757d9910051cd1a03e0732910bda5f1fbb883c222c091f80db88bf59f2baedcda5
TLSH
T160C08C2C1AA22A06F6A8437C02C17D03AB208101E281CF051AF22A08C99AF1A6838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

1590DF81A65FEC0F13022A69A8A4AE74

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1590DF81A65FEC0F13022A69A8A4AE74
Size 488B
SHA256 fde8860118262f5cf2619dc8ddf0a0de84986f2b06ca325d4e9cce2ff5495002
MD5 1fd0d66782fd976454a2ae56cbb5190c
SHA1 81de392df3e1a2da6fc4da82256335bf0c4df680
SHA512 497e66fd25b918af5e0d122fbecf8f08809be7bece872bc4b5f01e54508ee8205c9ae82a1f175fb4fcab3470231395e5c2c695d176b7d0f08379b97edd3f81cd
TLSH
T193F0230025F80139F072C434D3DD6B30DC08F01A0D41C2B907E36707AB235050C81C3E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 c307f1d1e0504232fcdb0614f2b41d89d072b3c4c30ecfe6845d2fba0d1bf5d2
MD5 905066d110a9cff4f429603d5c7168a4
SHA1 fc5116e9995f693aab9028d89050ea221cfc24fa
SHA512 6aacd55d995cc62016c39e3d3e6e861c78b316c1476f71e5d799ddd0151bc2b2ae812d26bd6cb83990d88a098cb740fa3a0c09e13f36db47f2455e93524cc4a4
TLSH
T16AF0552C13F8805EE5B2DEBD8ADAF2936C25F1232C5409AA1AD81B49AA02E402C81029
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 2cb8d7119a484ee38b324023363ed24d71a3e72211e4b1f05b819fd7bbbe6e4e
MD5 0b81ff72289423d6505fc350693788f5
SHA1 be83fd14d954db44acda89c4fb3a81af9d176dd8
SHA512 57d9da44182f8d9bf5e867fa44d0c06f78b4869c4e092b980b2fcdf6134c92acf14b6f070afab7932fc6a6a95393edb92000dcb6ab64e91cbd2222018fb5ee93
TLSH
T1E7F0223839FF913AF032E93447C932E6596AE21274062EBD26B01704AA15F906CA2609
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 5661ee8df8a7d3f3e1dff505eca1e48936865f8d081610e1d26e3b65285a01ec
MD5 e8451c750065cefcd0c572e731cb6928
SHA1 7688861eee70141f70ccfa5430a9dfa69fd8b674
SHA512 513a27c9c980cda33b6c9b76d23f7cf1b7cd740e496d45a01020fb12fbd2ce7c34a45718b0d07125789fe76b1a879f4c9015ef82acbadf1e1d2bc407244f7045
TLSH
T10CF0AB281AE2011EF2396BB812EDA2DBAD0DB2173904DDE52FD2470AFA4BF401D1143A
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 342983bccf28985f4a526a6d1928848b438fe16d67a17d95a268ba67246fdd72
MD5 f14b3477e632be408d1514776a55429a
SHA1 81c5608e0a266bb841754d5abc31ee49eee6b736
SHA512 e50e115726f508f8e35eca8d2588a62bc0c88a02cc5843122ce042c1d88d73f0b61fbec2c7f5c461d96a2640d7f5b939fab56e11c4fddf782c91d2eb007ca1cc
TLSH
T199F0233514DF016DF2B1D67DC3C515B95117E23735056A797E7143095D06640B6E1D31
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 76e7c67b4c59da20882a0b17183f149cf2206fec302e0313e80e4aa467b5d706
MD5 dc293e86c2868891ed7d8c41591638de
SHA1 2dd2405d0f6876419c4ad39275059a3e191c40d5
SHA512 12e50b660a8ddc220361bcf9ae9c6de0434634d09ed11573bde3c13ff0604a97ee4f20b533c7f04567b5897caa1c4545e51ad11e2eeefcef35fbf16ad408c6ce
TLSH
T1F2C02B2C07650A07F6E883BC02C23D839B218110F3819F1127B53A0CCE38F163C34C29
MD5 SHA1 SHA512 TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
Size 5.4MB
SHA256 a1f7f523ccf24c341fa3fdf57bfe954be9bed7a6d15bd4ba728605ed449c22ff
MD5 aa126947d599181ef58349715ae6f1dd
SHA1 31a850d246373b2c81cee83f00c0d4c5aa5a24f4
SHA512 8ae652f7468fceac1607f45b11d6c85c96a998ba2c60a0a5e6be724017ac24543488dc69cab0968a3cfa0732f23e1d68d016ce41254c345d0667bcc49dd92e81
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2oUep9PatvQt:+0s420bTjzGlBrJTJb8QAMQCLrktG
TLSH
T1434623E6785E6AABC10E1C7D8E168D6135AC5BB1C7244C97EFC53EF60950C932B33922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
Size 5.3MB
SHA256 127a0356b64c1435af614dbc2b17ac10ad9d7e22c9478663e06e7d2e56611a50
MD5 b195466ceb258048942e159fdda3019d
SHA1 85ff7527a659275b90f1b771198b3003512e28e0
SHA512 4bbf51f432d46aa1f8cf18d60d727b8ad37c28f86a2b62549c7c018aafb51276d7839a6d3fe0888eb93523adf603803801ef3b6f0bc5be698f3141dee9a8a82e
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2oUep9Patvb:+0s420bTjzGlBrJTJb8QAMQCLrktj
TLSH
T11D4623E6785E6AABC10E1C7D8E168D7235AC5BB1C7644C97EFC53EB60850C932B33921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
Size 4.6MB
SHA256 7b8d7a8daec2d06da561dc936aa2de5dc0c02bf13c6713a1b132ea637aff15a6
MD5 272467706750fde6c11282fd423010fd
SHA1 d6efd7798947345ad31b489ce5678ffb429a1a31
SHA512 f8d7f02af0e6698b3e009cc495dff15ff8fc477479e1bbc168b6f67d904d3a08e6fdfc193b7acfad0d4b079bbcc10f2a63c3c3d865d0258296a1b1616ed61be9
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2oUi:+0s420bTjzGlBrJTJb8QAMQCLrX
TLSH
T1FF2623E6785E6AABC10E1C7A8E168D7175AC5BB1C7544C97FFC93EB60810C932733922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\DesktopWindowManager.exe
Size 4.9MB
SHA256 022ffe0e2036a79581f23a625c8ca2b5bf56c4610ca829b7c05fa4f9fc220ccb
MD5 b341bc9e4fa81cca895f86ad306a5e34
SHA1 31f395032d423c59c21cb03a60237238dd0e2173
SHA512 8397626322b5e1555efd34c6188638dff910bd41d17c978f0e882bcf87b0bc570c6d3da290cf832ed0a4cbf9d5a0633f1a65d26339873790c98295f51a618cdb
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2oUep9Pa8:+0s420bTjzGlBrJTJb8QAMQCLrk8
TLSH
T19E3623E6785E6AABC10E1C798E168D7235AC5BB1C7644C97FFC53EB60910C932733922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
Size 5.2MB
SHA256 1688125a8e84c3e1a2a41c30d4a0394a4384b3c12753b511b4b1417cbdc37485
MD5 d6e535966d7eb2c8cffee38245f04461
SHA1 bc899280d4e9ff1632af9305e31c2ea4a9d68d74
SHA512 93ceca75fc6bf590c6ebd3fb6372fff1b9cd1428e4f50ba8e569cecaf3cd565c24b55b08455760fce12760935374debd21e5c8a6059ec4629d54e5ae96e8b950
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2oUep9Patv2:+0s420bTjzGlBrJTJb8QAMQCLrktu
TLSH
T1734623E6785E6AABC10E1C7D8E168D7235AC5BB1C7644C97EFC53EF60850C932B32921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UpdateService.exe
Size 4.7MB
SHA256 46ee1120a510f320d2f383569280adfb99233b13fa3a5580bc152bc3437f74d3
MD5 c767d1d3029333a1750348374dceba08
SHA1 0b9ea62cb8d54d832696cf81c38996676784fdb0
SHA512 8b565ddcf276f9e8eaf0a9ed440e990d22476d330ef92f0e7cd5eeec78f743732973cbdf37f50cce4361bf276ece94a0dd69519a92292ddf1754fe937c9d8ab3
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2oUd:+0s420bTjzGlBrJTJb8QAMQCLrw
TLSH
T1313623E6785E6AABC10E1C7A8E168D7135AC5BB1C7644C97EFC53EB70910C932733922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 4.8MB
SHA256 9b96b461d75216ce5c0d7e130a482036ad54ffa98553c3c1ab3a5249d984b34f
MD5 2e84657b5ab089d7c1780333e131a068
SHA1 c5d3ed3fd38d686b84eaca45e3e5e1b7c7f00540
SHA512 0435e4a49eb7b791ed2a370fcc516c5c0c9377dfe74c541efe9c04ad139cd06b5c15602cfb808b8ff0ba4fe88283a889084a05bd0e1ceecbd038986c52b2d43c
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2oUe8:+0s420bTjzGlBrJTJb8QAMQCLrS
TLSH
T11A3623E6785E6AABC10E1C7A8E168D7135AC5BB1C7644C97FFC53EB60910C932733922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
Size 5.0MB
SHA256 c360c38cb56289c2d5edb14e65de82ea21e32688d558570417641d3b238ff81b
MD5 5d30f63fe100ee5a9c22793047dd2c74
SHA1 58e6ba314e5e4b3dd3cd73e2fb79a83f38cbcb89
SHA512 115263eb378b7af41c8e7254017872e9182238a9c8f117acdb220a3ba42aaf93f2b21ffdd9257f0e00535dd380ec71a21028a2227c71689d276791cbd692c0a6
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2oUep9Paq:+0s420bTjzGlBrJTJb8QAMQCLrkq
TLSH
T1FF3623E6785E6AABC10E1C7D8E168D7235AC5BB1C7544C97EFC53EB60910C932B33922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download