11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004

Analysis

max time kernel
148s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe
Size 4.4MB
Sample260702-rvtyvsfz4x
SHA256 11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004
MD5 0aa115209f65c18e77987a28ff1f517a
SHA1 b9e7108ef235e1adb17f885574f92abc18c5e3a3
SHA512 fda9bc7c4de26827464071fe27edc9d7d7ce4eaf039d0b8988d1c9a51942b7fe8c10c601d1f0516019a5c78c2c1f55d1b589a420d3505dbb3d31f8dc8a150c2d
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2on:+0s420bTjzGlBrJTJb8QAMQCLrn
TLSH
T15C2623E6785E6AABC10E1C7A8E168D6235AC5BB1C7545C97FFC53EB70810C931B33922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5832	WindowsInternal.exe

Executes dropped EXE 23 IoCs

pid	Process
5832	WindowsInternal.exe
4472	WindowsInternal.exe
1832	SystemHost.exe
3528	SystemHost.exe
2592	RuntimeBroker32.exe
4904	RuntimeBroker32.exe
5852	SystemTrayHelper.exe
4256	SystemTrayHelper.exe
1724	DesktopWindowManager.exe
676	DesktopWindowManager.exe
3148	InputService.exe
1984	InputService.exe
1096	CoreSystem.exe
620	CoreSystem.exe
1108	SecurityCore.exe
2612	SecurityCore.exe
3180	SecurityCore.exe
5116	SecurityCore.exe
4476	SystemTrayHelper.exe
3308	SystemTrayHelper.exe
4576	SecurityCore.exe
3188	SecurityCore.exe
4392	DesktopWindowManager.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\RuntimeBroker32.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\DesktopWindowManager.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\SecurityCore.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\DesktopWindowManager.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SecurityCore.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\SystemTrayHelper.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\SystemHost.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemTrayHelper.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemTrayHelper.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\CoreSystem.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\WindowsInternal.exe\""	11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe

Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
52	raw.githubusercontent.com
75	raw.githubusercontent.com
78	raw.githubusercontent.com
87	raw.githubusercontent.com
100	raw.githubusercontent.com
107	raw.githubusercontent.com
9	raw.githubusercontent.com
26	raw.githubusercontent.com
39	raw.githubusercontent.com
65	raw.githubusercontent.com
90	raw.githubusercontent.com
103	raw.githubusercontent.com

Detect suspicious telegram bot 12 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c517-30.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c51a-89.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c523-136.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c524-170.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c525-205.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c524-209.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c525-244.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c524-278.dat	suspicious_telegram_bot
behavioral2/files/0x001100000001c526-312.dat	suspicious_telegram_bot
behavioral2/files/0x001100000001c524-347.dat	suspicious_telegram_bot
behavioral2/files/0x001200000001c526-382.dat	suspicious_telegram_bot
behavioral2/files/0x001200000001c524-415.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3924	11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe
3924	11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe
3924	11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe
3924	11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe
3924	11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe
3924	11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe
3924	11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe
3924	11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe
5832	WindowsInternal.exe
5832	WindowsInternal.exe
5832	WindowsInternal.exe
5832	WindowsInternal.exe
5832	WindowsInternal.exe
5832	WindowsInternal.exe
5832	WindowsInternal.exe
5832	WindowsInternal.exe
5832	WindowsInternal.exe
5832	WindowsInternal.exe
1832	SystemHost.exe
1832	SystemHost.exe
1832	SystemHost.exe
1832	SystemHost.exe
3528	SystemHost.exe
3528	SystemHost.exe
3528	SystemHost.exe
3528	SystemHost.exe
3528	SystemHost.exe
3528	SystemHost.exe
3528	SystemHost.exe
3528	SystemHost.exe
2592	RuntimeBroker32.exe
2592	RuntimeBroker32.exe
2592	RuntimeBroker32.exe
2592	RuntimeBroker32.exe
4904	RuntimeBroker32.exe
4904	RuntimeBroker32.exe
4904	RuntimeBroker32.exe
4904	RuntimeBroker32.exe
4904	RuntimeBroker32.exe
4904	RuntimeBroker32.exe
4904	RuntimeBroker32.exe
4904	RuntimeBroker32.exe
4256	SystemTrayHelper.exe
4256	SystemTrayHelper.exe
4256	SystemTrayHelper.exe
4256	SystemTrayHelper.exe
4256	SystemTrayHelper.exe
4256	SystemTrayHelper.exe
4256	SystemTrayHelper.exe
4256	SystemTrayHelper.exe
1724	DesktopWindowManager.exe
1724	DesktopWindowManager.exe
676	DesktopWindowManager.exe
676	DesktopWindowManager.exe
676	DesktopWindowManager.exe
676	DesktopWindowManager.exe
676	DesktopWindowManager.exe
676	DesktopWindowManager.exe
676	DesktopWindowManager.exe
676	DesktopWindowManager.exe
3148	InputService.exe
3148	InputService.exe
1984	InputService.exe
1984	InputService.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 4472	3924	11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe	89
PID 5832 wrote to memory of 1832	5832	WindowsInternal.exe	90
PID 3528 wrote to memory of 2592	3528	SystemHost.exe	94
PID 4904 wrote to memory of 5852	4904	RuntimeBroker32.exe	97
PID 4256 wrote to memory of 1724	4256	SystemTrayHelper.exe	100
PID 676 wrote to memory of 1984	676	DesktopWindowManager.exe	105
PID 3148 wrote to memory of 1096	3148	InputService.exe	106
PID 620 wrote to memory of 1108	620	CoreSystem.exe	109
PID 2612 wrote to memory of 3180	2612	SecurityCore.exe	112
PID 5116 wrote to memory of 4476	5116	SecurityCore.exe	115
PID 3308 wrote to memory of 4576	3308	SystemTrayHelper.exe	118
PID 3188 wrote to memory of 4392	3188	SecurityCore.exe	121

C:\Users\Admin\AppData\Local\Temp\11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe
"C:\Users\Admin\AppData\Local\Temp\11358d16f8d5ae8e4d3ccc2b89e462bc4f6db2260d5ebdbcf5eafd2a118cf004.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4472

C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\WindowsInternal.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1832

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2592

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5852

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1724

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:676
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1984

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1096

C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Temp\\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:620
- C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1108

C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Temp\\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3180

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4476

C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4576

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 281B
SHA256 f00758063c2e9d1e8c0c2b777d9ea9c3ee2d87f02d05c3f469bf48a4d7ac9b89
MD5 87dcd1b18633a56c020097e6a6038d75
SHA1 437a533a8833c993c2ac186a88ac1e87baa3aad9
SHA512 e5a1e69f79efb54b7fe1f760fa0b03ae0375320f52d38a70faff578b36dd11aeb35e792701cf8e94d925d66ac84d66119598b1fd47f022ae10a22b0b89378e98
TLSH
T16CD02BCA01B6E5063923F91448CED0183102386211D729305CAAFD067C40E7E5E02304
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 315B
SHA256 632b4c2ee7635de2ae515de196d3e2339e2bb13d4893938100bbbdc65b7385e0
MD5 89112141212784485ec51f02395b2bfa
SHA1 84589d48d7c26f4ea55e6378ec3fd0580d173951
SHA512 8539e1eb4cd5e6fabdb1f8c144f76c0eaabdb0bfeec2921feea4aca8d879f7f670b3e479a324a24014ff9989954d26fc72eb640532f637ccd9eab24b5398cfac
TLSH
T13CE07D5E0E5DC0E5F6234F280691C83FF881510E28C56655302C65C30E5336B4D1F201
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 35aa51831b3a4db3776f8b739112777f6d434a45ae42a886a270f8a34e1f1407
MD5 edca132988bed0942606e55782e6919d
SHA1 b8164ecbd9b14160d937461763457657d62a0dc5
SHA512 0908fa0d9731befe0529a9805a1470d214f2035b7955b5f04fefa3bbbd8d1ef82ebbf1d02703a3bd342f67e5d1bf8aa22ecd5006a0f844c7cede833a48ad0ec8
TLSH
T13F4118E92A1CB010BF808F8055B8CD3A3C7CF2D096C4255931F788926093FD33D1688D
MD5 SHA1 SHA512 TLSH

Submit Download

A8A4CE43DA65177907B85FEC6335160B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A8A4CE43DA65177907B85FEC6335160B
Size 63KB
SHA256 131805ed04499def9b3517d4583643ff9d32e652e1002b72ace1e830193c263b
MD5 697faefc1074743d75912ee19e0be0c4
SHA1 89311148647c5ad2ac8de757f1a524c24a06bbeb
SHA512 67e8bffae00fb74d73f08a91b46c663c8e626971ac546e3e8b9441f2b93631321724c3c4f9712fba789f913c4481acc0b0b7111067292be03d6297aa1e365bb9
SSDEEP 768:V9MNkTYV++lj+Pgliwfjb1Iyx81DjaoBT+p/jEmqtnKRoYRmhNmlkaDz7/K5F79k:G+P2LfjZIyx81ioWjE/KRKmlk0zDK4f
TLSH
T1FB531C689D77F2A1ED0A8EEA4EAEDE9E1EE551D71E01030F4E307E901C13A97EB57050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 0c1fbda8566fef4c3292e96cc9c74f5d0068010774b706d0a137fd29f429e144
MD5 059b996253c140f683fc5fc4e2082659
SHA1 35f753f0033984130135091ae891933c9df7a551
SHA512 52c3c2af505b038067044cd6959e7551311c264a1dfb30606b6f5f2db09415da8c30036506cf1d63d849cae0c04771b75c5b240a2700302d29f3ca72bdff380f
TLSH
T1071121C21FE4A0D085F35760CBE8C12A3DB964822DEA31E118C28493349672D271A43F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 3ba7ba18f7dbcc08870ebe773dd548b7573a3aae06115849f1570089f24ad09f
MD5 83e0b6719f48c7007045d0e71fa09f73
SHA1 431c0e95f31ad3d263a3052b4835c95a2178b68d
SHA512 5d8575ef338691ce7893a8cf600cc52c578b830f7ae83e1bdf1a9f6a85e80646ff378ee9a911dcb7b3d6540fc1c4dc31d9470d78c03846a4b40403150476f40f
TLSH
T1AD41E7E72F4AB460FF4B9FC5ADE8C6761D7C8578A18049923572C9D600EE758292608C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 ec95509f351ca2d6c48ac69a1f3b404842655baeca78271e42dd5940e321b13c
MD5 74d8f19321fceee5daa4d07ce3822be7
SHA1 f3afcb76053225ef7f4272bd78e533967a65f65b
SHA512 fc5bc1bbad72e3cda674146a70cee87c0dde9f536faa131b2bb6f2daea2174c95c404f63c56d72c1fd53554e2d3a81f69228fb70fb95e886bcafd3f3b82c628a
TLSH
T16DF0A3103D7C8238F0B3DC7AC7E772655C18F1177C015AB31653010A9B02E414D6342E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 d85c4c9f56199f5118cbdbe56dd7515040c722e0b6c4e5898accfcc54a0049cf
MD5 672da31e043fd840d2016eb1087fd825
SHA1 6adb9f49c86abf04570016105f9a76b7d4bc147c
SHA512 abdb1d1cf444c3ba70e2eace68394e00a3b9d330628b11161695bf748c01f70c44fa28df0d38d9058564798ac4f769322d5081dd6d5953eced5547b01e11f5ad
TLSH
T1F4C0801C1E650505F194437C02C1390357205101E7418F0516F12504D956B152878C3D
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 e42b3e36f287ddae4bae01edcc6eba5baa686f36cc6173737420c360ebd5ed2d
MD5 a76ef2f8827ad88e15a466c7b98f5429
SHA1 18d13a643a426d6044541b14d1307f8e4d1f4144
SHA512 a3c34541fc6859006caddc84f857748d36616635befb833928ecf1c41712730f617ad8378413832c3ab85c582e3b0bd17303d373868765d228c7c1565b4aae03
TLSH
T1DBF05C2C8BFC817DE0B1DA7D8BD5A396AD2CF217285406EC16D25B496E03F01AC5043C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 54f7f5831bacf5d1f00ff55d98e8a3ed5a9b94b91fdd3f766e08e076306fb1ec
MD5 c4465ef088fdc3448619bf425a84ca76
SHA1 6171f857c2b40652233236fb93fe837039df2512
SHA512 5f64d0db42369a02e6ddd74ac6af7efccb6319a4ff3d4f9a60cde70d6109ad040b26aec5757b419c620d34c7873afb59b164f506483513de41c4e7ad3f0f94d2
TLSH
T11EF0682479FE913BF036ED3903C571B195B5E31A380526B939B01308AE08F305D9260D
MD5 SHA1 SHA512 TLSH

Submit Download

A8A4CE43DA65177907B85FEC6335160B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A8A4CE43DA65177907B85FEC6335160B
Size 246B
SHA256 22402cc2baa9ea27f9a570a3997a23a9170d17f97aaa3bf5c22649f4d3f58199
MD5 dad3e2a6d582ef61596353bcd6dc7a89
SHA1 73f42f81d5fb5ffd3b85a75a02f728c22b6ed268
SHA512 81269f5900e95f688abc052ce0c0a64c6cad01decc6e8c22f56893e70b29a92bc928d3537e07795f6b01247ce814e3c6f7edcd53772f50b2d2020cff460f0dc1
TLSH
T1BBD022382BE20332F0384B3948B126464A647A02B2428B0C1FA6D70D043EA2429A380C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 39979fdac015689b051d0974323a4db0685c5389238a9c521facf7e1a9c7297d
MD5 bd87d21249105b069a36555eb160d661
SHA1 f94177d71cdd34bd3a966e91acc802034bd34b97
SHA512 5adf3d4ef044ee7dffd57049f81e3c184363879c21df62526aeb0e13995df1de8cd939de922c547771b4298db716b034ced6f5a159ff35c0b8a497b823a49aa0
TLSH
T110F0AB242AF60A3CF372237986E057AEEE18F2572004CDA83696470AFB17F800D2183C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 b598db9d1be20acec9dda3c6d62677dcb5c9e29ccf83d1b3ecb76e48681128d8
MD5 60f064f6468973962f69ab18f7716cbb
SHA1 09f6c2fe94364390884252f644921c3753b3f7ef
SHA512 4eb737cfa672b967f2ab87f898c9d92f35c490d3cd25916f7cffba94c627bbbf8cb79c25ccd6e5de597a4ae856e3983e2253c1b8e38c96603d2e4db00223f328
TLSH
T15AF0AB3820EB401EF173C77802C01AD94433F1333688BEEC6AB163881D4BE82B961928
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 0e2a6429d7796d051329ee7898eecc6d2e8f9c96d64a9d458e5fabc16e4574bc
MD5 301ae8698d04f8eccfdd7acb827435a0
SHA1 b8c2ead691deb33140a07bda559a2bc361d54019
SHA512 509db2c5da23c9fd54bf756cfabc8ae76c8f0dea72705673284090265750f78bc0501fb59cadc19a1eeab14915e292c4eea55797a35dae7a1dd7fa4670e03ead
TLSH
T13BC08C1C4662860BF2A883B812C229838A218511F3819F0126B12A0CDD24F162834C29
MD5 SHA1 SHA512 TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
Size 4.7MB
SHA256 13f5178e2011116ceab5694c6680c85bd14f9260c7abda984b77156526e64df1
MD5 92e8ba4403ac69f937e4a9c952f24c98
SHA1 38f53e05cf21aab17e958d87438273fea9d43d21
SHA512 2c763809d8ab0a24170749479ec1906732b055e7fb5832c9c7d8e9c460fe9b5c1056bb58fa82b34f6a62f1d7212ec92c0d7baa5ebd5b26a59b51e1c4f34e5418
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2ovPY:+0s420bTjzGlBrJTJb8QAMQCLrXY
TLSH
T1B33623E6785E6ABBC10E1C7A8E168D6175AC5BB1C7545C93EFC53EB70810C931B33A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe
Size 5.3MB
SHA256 fb605e2041389455912ac2da230c7b59a97345a3dd98b90ea3cbacfb94b466e4
MD5 57d6958e944a2e9aab9081d8ccda875d
SHA1 36581806ee0c5f009187b76247943aff8eaf5927
SHA512 ddfb56063c2f393c794acdb2868ffa02f406c55c701597feb27549fa933a7378bea4810a06b97992dadbe0051f8a03d61f82f51cea94e12e0f9785ee7b0a3578
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2ovPg5MrK:+0s420bTjzGlBrJTJb8QAMQCLrXg5wK
TLSH
T12A4623E6785E6AABC10E1C7A8E1B8D6135FC5BB1C7545CA7EFC53DB60810C921733A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
Size 4.6MB
SHA256 49017f90deebc91d621286d3aadaa4abf6a0c808db2c1f0d84caad793643bf7a
MD5 5c66c1f0ab23390e7f93a385729f3f98
SHA1 26a218726430fa645ebf2c63167faf9a24e0719a
SHA512 9787bc8e629df6d28a68d46a00aeec0c8889ecd4a07486604d6fb7717ebe49dc2ebefdd449e408146634a01e399425e25b8d1468620d903da95910dbf8076281
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2oZ:+0s420bTjzGlBrJTJb8QAMQCLrZ
TLSH
T1C52623E6785E6AABC10E1C7A8E178D6135AC5BB1C7545C97EFC53EB70810C931B33A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
Size 5.4MB
SHA256 df7ee5a60488e31bffdfd0abba8c36af06b852cd0b2f7da8eb5ff1fbf3aff717
MD5 d6c9c6bb5b8600d8e98f20db4f36fb6c
SHA1 700f007b24d5b20b703a81337c6df009b515a2ae
SHA512 97491b4e46a92457dcad1e915d4eaf4db8d6d61a93d5f132036fcb7a7ac49a7c1d92919f63c768d7ef89e44a14c4253edf82f8df266dda81ab1b79a166da227a
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2ovPg5Mrg:+0s420bTjzGlBrJTJb8QAMQCLrXg5wg
TLSH
T1644623E6785E6AABC10E1C7A8E17CD6135BC5BB1C7545CA3EFC53DB64810C922733A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
Size 5.6MB
SHA256 fa6b4ef6fca939c609d3e4417d3aa27ae64a580a042a40e87b60684b408320f7
MD5 ad6d4d51e52244adc0850bc8c8b8607e
SHA1 19e1fd1fa3f4989080628f6abfe89ff0353a1514
SHA512 dcc828694cc59b862215eaef3dd40f71a831c88f3b5f915ebcd1f26d2431f4901e6ad250d35fb367705d3f4c6736e8c7c6cfece3c7e1f27a8046b127d0958b17
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2ovPg5Mr6c3n3:+0s420bTjzGlBrJTJb8QAMQCLrXg5wd3
TLSH
T1414623E5785E6AABC10E0C798E1B8E6135EC5BB1C7545CA3EFC53DF64850C922733A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
Size 5.0MB
SHA256 3359a68d44c16fc9938584faa0210e13c76ffa107c288429c27decfd4e7ba0c0
MD5 89452086a10133c26d4c3049d280ee00
SHA1 55e2d83bc35be6e90f3a84f06f0cc081a9ccdbb3
SHA512 5b4f0add5af26358b0e95b623026c4e709a9d32dd32a68ad045e1d30898d9a748d54db2fc2c1109edfd0e2c92281cbf8b2f8fd8391b0f581e7d46b927f93d97c
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2ovPg5Q:+0s420bTjzGlBrJTJb8QAMQCLrXg5Q
TLSH
T1DB3623E6785E6AABC10E1C7A8E1BCD6135AC5BB1C7545CA7EFC53EB70810C921733922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
Size 5.8MB
SHA256 35687f2a3e067147e29f563738172d19ed689760c980544717dcf200f2dcdbf3
MD5 fd642a0a0ff1a0934d0a01c6c83f2923
SHA1 ea86fb193d8529007b18f9bebeca4754cf6047c2
SHA512 357d421500739810b1e21f4ffc521a03264156abbb07c08a1f7a57284fadfb51b6ed5f1546426d248bbbd5dfb7fb5648f3d8d4c0f1c5b0eccbcde5fd9e614ce3
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2ovPg5Mr6c3nlfv:+0s420bTjzGlBrJTJb8QAMQCLrXg5wdl
TLSH
T1645623E5785E6EABC10E0C798E1BCE3135AC5BB1C7545CA2EFC53DB64950C922733A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
Size 5.5MB
SHA256 1d9c39788f26ac5f0e84e400af71279c16905815501742f63aaf87f322b37280
MD5 69433d529d62cb9a9082265cbf62a4cd
SHA1 c3e8aa6d02fa7fce3af1d716ea3600d4c4dad8e6
SHA512 e570852c84ae68b7401026a61f0f7a955f2a4c2d351ab16eb73b669b14d79efeb28fa8284c1d9d641424c38beb6f637417418d1b4a29e2a87a4cabf44ad435b7
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2ovPg5Mr6c0:+0s420bTjzGlBrJTJb8QAMQCLrXg5wm
TLSH
T1584623E6785E6AABC10E1C798E1B8E6135EC5BB1C7544CA3FFC53DB64850C921733A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
Size 4.8MB
SHA256 b1f738d41e0f27c99c5030c4a25168fa3a7d44bb5a218a356182424aeef6be7d
MD5 bb7500b5d927c4287d879793c48b19f3
SHA1 d012196065204af74deac491535d3bd5677757fe
SHA512 f8c0a5fadada6e0ee16624e0c62cc371c5ae64f16354c3ce7bac7e55dd52f05ba88c5eef091531fa53947c08ef272385d8346342adc678dc95246c2621bf3599
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2ovPgI:+0s420bTjzGlBrJTJb8QAMQCLrXgI
TLSH
T1253623E6785E2ABBC10E1C7A8E178D6175AC5BB1C7545C97EFC53EB70810C921B33A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
Size 5.1MB
SHA256 d67660420e2192481d61c4d10792e7bc68cfb7ef170c072bf1cb5f80c5bb26e6
MD5 7ed4900fc9d7d6758853cdcea3ed10b1
SHA1 a9889881da95dfe5ac81b0e084c2bf09d3e62d13
SHA512 9a563506db7aa54004bdaa70801f79d3ac7ffe6a1ece39eb22d4f48d61074d11bcd411a933abb515fdbfa2a6d2c7be633d1d551243496217b725b7e3e7e71075
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2ovPg5v:+0s420bTjzGlBrJTJb8QAMQCLrXg5v
TLSH
T1544623E6785E6AABC10E1C7A8E1BCD6135EC5BB1C7545CA7EFC53EB60810C921733922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
Size 5.7MB
SHA256 cbc170ee4f4bb466001498a0ca2020593423acbb76d14c492c78378c4dc07544
MD5 9adc79fe42f6e5e412af97cc624ff646
SHA1 fc43df39398a61be94ea994cee9c34023507aae5
SHA512 cc99ef654d93f5e0eb452fd789fa6f1e6c678e3372057a3352ff0a8317c95080351089419758d313afa41aa18fdd475a2d5412c998473e2f1b3a1e067bcc72cf
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2ovPg5Mr6c3nlb:+0s420bTjzGlBrJTJb8QAMQCLrXg5wdd
TLSH
T12D5623E5785E6AABC10E0C798E1BCE6135AC5BB1C7545CA3FFC53DB64850C922733A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe
Size 4.9MB
SHA256 159aff6f9b248f4c4d632e4891e275070321143a7e199bbbde52a9894bfe5004
MD5 ed993b481b02ea4086bafc6e65d636ee
SHA1 e21e1b4fba0fa2cae40760fbff31fe45dcc11850
SHA512 8d65eef7ba066ff1cbbf7bbf6e4b239dbfaaa27f6f3d2235459bb8b4570208b44b5cebff7fa4ce03a3adbfa748ec71ff5917b3be0abacce6d3b9355147d6ac48
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2ovPgW:+0s420bTjzGlBrJTJb8QAMQCLrXgW
TLSH
T1883623E6785E2AEBC10E1C7A8E1B8D6175EC5BB1C7544C97EFC53EB64810C921733A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download