00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7

Analysis

max time kernel
146s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
Size 8.7MB
Sample260815-wjgllseq4x
SHA256 00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7
MD5 df87dd7a570e6dd1dfad8221edc396e9
SHA1 be1e680007c67f53eb0d6d2774e17e4d68b2cf39
SHA512 de046be40fb0921729e7c59c888a1501007b705b89115eeb716441a98c6239d145292cad96c10d094c6fc0dd7f587e2722d75161ce68dd6defb3284d3199e23a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWeR:TDpbgBr/4QAMQMrEGRHsww7Q8RuWeR
TLSH
T1429633E67C5E6AB7C10D1C798D16CE223A6C5BB1C7548CA7FFD53EB60810C931A22D26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3572	SecurityCore.exe

Executes dropped EXE 10 IoCs

pid	Process
3572	SecurityCore.exe
5812	SecurityCore.exe
4948	RuntimeBroker32.exe
5768	RuntimeBroker32.exe
2824	InputService.exe
2432	InputService.exe
5508	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
3752	UserSession.exe
1568	UserSession.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SecurityCore.exe\""	00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\RuntimeBroker32.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\InputService.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\DesktopWindowManager.exe\""	InputService.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
28	raw.githubusercontent.com
47	raw.githubusercontent.com
58	raw.githubusercontent.com

Detect suspicious telegram bot 6 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c5cc-10.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001a227-86.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4a5-119.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016acb-157.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016ad0-191.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001a224-231.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3720	00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
3720	00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
3720	00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
3720	00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
3720	00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
3720	00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
3720	00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
3720	00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
3572	SecurityCore.exe
3572	SecurityCore.exe
3572	SecurityCore.exe
3572	SecurityCore.exe
3572	SecurityCore.exe
3572	SecurityCore.exe
3572	SecurityCore.exe
3572	SecurityCore.exe
3572	SecurityCore.exe
3572	SecurityCore.exe
3572	SecurityCore.exe
3572	SecurityCore.exe
5812	SecurityCore.exe
5812	SecurityCore.exe
5812	SecurityCore.exe
5812	SecurityCore.exe
5812	SecurityCore.exe
5812	SecurityCore.exe
5812	SecurityCore.exe
5812	SecurityCore.exe
5768	RuntimeBroker32.exe
5768	RuntimeBroker32.exe
5768	RuntimeBroker32.exe
5768	RuntimeBroker32.exe
5768	RuntimeBroker32.exe
5768	RuntimeBroker32.exe
5768	RuntimeBroker32.exe
5768	RuntimeBroker32.exe
2432	InputService.exe
2432	InputService.exe
2432	InputService.exe
2432	InputService.exe
2432	InputService.exe
2432	InputService.exe
2824	InputService.exe
2824	InputService.exe
2824	InputService.exe
2824	InputService.exe
2824	InputService.exe
2824	InputService.exe
2824	InputService.exe
2824	InputService.exe
5868	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
5868	DesktopWindowManager.exe
1568	UserSession.exe
1568	UserSession.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3572	3720	00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe	90
PID 5812 wrote to memory of 4948	5812	SecurityCore.exe	92
PID 5768 wrote to memory of 2432	5768	RuntimeBroker32.exe	97
PID 2824 wrote to memory of 5508	2824	InputService.exe	98
PID 5868 wrote to memory of 1568	5868	DesktopWindowManager.exe	103

C:\Users\Admin\AppData\Local\Temp\00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe
"C:\Users\Admin\AppData\Local\Temp\00d5d351464f6d1fd1240bcd9e9dcc992291443ff91e39625116bc36569c60b7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3572

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4948

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5508

C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Temp\\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1568

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3752
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe" --monitor
  2⤵
  PID:5452

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe"
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 282B
SHA256 a7e3ba5c844a8dae624021af089b9862e81e7b071fc021e000b96541aea11a1e
MD5 958aa4d2d3b9227da9560332173ec9b2
SHA1 3017eca5ab54bfff1d11d2b29dc4b3600bb0371f
SHA512 1dc60a278eee788416ede973459e7ffbfe50c95db55ceb91730bf50c01ea1c9c16289d1c19e5583f44a32d24a7fc98c341a5ed16ed493fd100338c23f25a3081
TLSH
T1A9D02B8686BA6DD23E22CD8445D5E2307403686262E059658C28856F7411579E706500
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 37765ce9f198a9aae9d465643b2a44aa150bd915040e834ed087ba4a8b396025
MD5 7ce71344583e9e5c80d0005cc3c4d6ca
SHA1 59289a8e0235271e27fbf45b8c23fb41f8eb31a5
SHA512 73de71472041529e39f8b7d589870c865ea9791317620f1390e3600d970a92e737b4e540947b557ffdd7d4ee76e97a916db89861f4bf0475115c297c5926dddc
TLSH
T101E0E722971F56D97223DF1003E050777E11511F14A0170E3C19C7E34C4216DC90725A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 a798b9138c9f5b566047510f02398bcdd86a64a00449d50cadc0db7f62498706
MD5 4061ff4d3db71a10ab51a99bd584edab
SHA1 365871c96f879e4d44781f0f3dc871e6fc8ce160
SHA512 85ef7721688d10f3cd5751cdb2808508264ac8cc779547d21914c72b724c3eea88f92da9dcb335ea4eaebe8141533098a404d2188cbc308be1acf1f110f2fd85
TLSH
T19041A5D95E1C3520BFC2CE955879CE231D7CF2E0D8C5159976FA88E66086FE01D1A84D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 9b9892684065eec656347a9a8ec9486e4829777bd3d726d47430654baf307ac0
MD5 e184a82ca0ba55b38e7c74a08b3907b6
SHA1 898f3dfb43554fbb27fa02537134cc66ac85d67f
SHA512 198c2250d700b9e81d73dd45cf63737763c21b17fbc48e5653cd0c84a0c84223ff3d9efb0e37021c83fd89a82974fdf5e9a0b9fafc64e6e787f8bf494c7cc193
TLSH
T1C01161860EA4A1A199F39260CBE8D5353C7564C51CF634D01C828CA3249636D6B0543F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 b446cb80f5950ef78e649c8f9f372e693c67e97a3b4ee9ebf5e36eed4dc53d3f
MD5 5a7a86527b7f4829a5f424ab5c6a1b13
SHA1 7e68e8598992812d9c916f6f43944b1315f54994
SHA512 084e9f8003395b4e9b12b9a0c375477d03f29cbad775bb963642dd955039a867b54f810db6fce703db650eb66183231760d122be70fd5d130614d5eb01e3efa7
TLSH
T1FC41F8EB2B0AB954BF429F45ADB9CA3A1E78C45441404C11B8BBC8E210EEBC06C1784E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 7cf1700373e664e6e120118bb46e977eefc535ccf7d03f705fe5077a824afbc7
MD5 0bc2dab25ba06de999e179545415b3af
SHA1 acc1bac0e128c027810341c61f759b9771723e92
SHA512 5835cc4bde064b85d2730aa0985665085cf01cc5ec7435b82971a85c5a25edcaee4f85574ba09d05393759d8ec7c2f3369d629efde2493abd9121e911b99ee42
TLSH
T165F05C00687C5125D076DA79CAE9B06A682DF111B81596B7059716055B05F005D5592E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 819e76564dd1a943a2294e8fc90e5f71ffa585cc7ef3a93f01703edc2b053ab0
MD5 8f6471b4b2e52cdf0e2ce0ac62b91639
SHA1 8c7a9e32981bef9b3e7c22d2295f3ff7cfab2c71
SHA512 72a6f738488f83c2a189dde1b2387d03120923affcb87689ccceab3d4b2174deeec06b899aed967753e232c660b29f3d129989f6e16f30b6512db9c9351e8080
TLSH
T131F05C3C17FC412EE072EA758FD9A3959C16F122344445AA1BD2464C9502F027C4117C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 0199ae2dced4ccc3418b9c7952cdef63670054e3b35dca69ee6bd2addc782970
MD5 d0aa18f46a46ab0f789e845bc671561d
SHA1 8817726f51a208f161193011965b58636958edce
SHA512 675fb7d40c15edd96d3335041e2be69e67c0377485ba197ff059741921897da3f587a6b8b6b25952a52d7500c23b86f8dfd216c56b8b16974ad914d842256735
TLSH
T19FF02B743DFE813AF43369B88BC521727925E216340615B5263123057907E511C8151A
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 c3e813969c2656d663ce5dc871b210c143fd13a19491b470d62b5447839ff646
MD5 29121dafc1bd7f545cc0fd1f39c65bee
SHA1 f97a62b9bdaf3acf79eba32ecd4ec458d509c10c
SHA512 444bc97a48dd39f6c1225c5b77f959dc54db50b75e93e72e36171066940ae08f78f70e95d1409cfabbc086606e1cc1c15d83b8f205b152da8bad8779b6db96f3
TLSH
T168F0A33411D5401EF572567401E452E6ED14F3673444C5711AD2160BE563F411E1153A
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 1203804fe33b762f1746c8c3c3f038b5dedf6f05e5bc14291034dbff1411bff6
MD5 6119d8ab49b2ce560082eba38b4d7340
SHA1 4ba454153465c26a65cb2817da03465b75bc8507
SHA512 64f481d9fe2004838c261d749955669b656b7e8f36ec25c5d51684381b54632c0f9654667864727ab4a4d0abd36ac6dd9d7f81b2252019b0f99523a0a4e435c2
TLSH
T1ECF0AB7828FB013FF350FABC02C012998632E233312826A536A0E24D6D8A9417960A19
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 671465aa9e6eb12d6de6a920adf01889e61deb41493c29d42cad18710d71f138
MD5 c3de4f0a9c53abc806341bc31ecef8fb
SHA1 9350c681fc9567e6bb0a7023ede8feb630cab3a5
SHA512 a0f02030b2e9638e6c0777ed690c0f275ab92c5c9db70e1ce53b7efa3a16c2d9e1725653797b52fdb39dc7820ae017899bd3fe10e62bfe9fddba15f7092a2ebb
TLSH
T1CEC08C2C46B10606F2A897B802D23A838A208110F781AF0126B22A08CD68F122834C69
MD5 SHA1 SHA512 TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
Size 9.0MB
SHA256 3e29816102cc2f8854518cf8d95dae55ab92c1fbcfc2f61218180b4e6d5f4130
MD5 e95825b6befdd895dd7088629aaf8ff1
SHA1 2d916c6e0dd2fd395241b75f9d19f48abaed815b
SHA512 ca3420d2bd45c54f0761a1bedeea75e55fb475545451ee286991bb58c64d2ebce6bdeb5dcc0e9ed4ab3c77451aa835e6ca7f5cc66a45e0859eb44ac0e5fb452c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWekff:TDpbgBr/4QAMQMrEGRHsww7Q8RuWee
TLSH
T1249633D67C5E69BBC10E1C798D52CE223A6C5BB1C7549C93EFD53EB60810C925B22E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe
Size 9.2MB
SHA256 e0127ab44418e4818fa8a0712ab9c29677705bc3792fe6f175f42df34ad958b3
MD5 f33a68b45fce3a5c6bb7350ccc7089ce
SHA1 4bcf8a4ea20617b01c02291ccb4141cce0561272
SHA512 88af8eb911bf7b63aacb65bbe046d46b967c0469d8de777c359983ed0adced66a0973513f9491084b97c19e491720c4e0f13328a43c48a70a4fcb7737bb3b1db
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWekfg:TDpbgBr/4QAMQMrEGRHsww7Q8RuWeP
TLSH
T18BA633D67C5E69BBC10E1C798D42CE223A6C5BB1C7549C93EFD53EB60850C925B22E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
Size 9.4MB
SHA256 b14b2ba76801128cc7331436e9966137015bc52755b2114049912e849c42cc0c
MD5 59a437deeaaa3a540aab3942343e432c
SHA1 838687d0a5be5c1c5272846c63179ad4228d5014
SHA512 e8d1d5d2f4eb33989f20f2c077d55a858d2d3c5a3945dd101431e62d2350c27b95f5312634a8ef4dca660a3cd59d89b3299699d38c4d1f83b054394a3adef9f0
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWekf8a:TDpbgBr/4QAMQMrEGRHsww7Q8RuWe1a
TLSH
T1FAA633D67C5E29BBC10E1C798D42CE223A6C57B1C7549C93FFD63EB60850C925A22E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
Size 8.8MB
SHA256 1a3eb71504590d6ff0b50b0e9f058cc8482a9347e1951883d542a0344d21bf9b
MD5 4f293c9142654576a7c42ea9cf5bf6a2
SHA1 637191b1d24a0aa42ea66e3bbd0e1becc6ee5c8a
SHA512 ed1cffb2b3e5331e429398565d88577ef080c475efa45f6135f12e7198e466e9a54ec504126720ec858643d934a734010369e401b56785691b6d916cf97b1a66
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWen:TDpbgBr/4QAMQMrEGRHsww7Q8RuWen
TLSH
T19F9633E67C5E65B7C10E1C798D16CE223A6C5BB1C7548CA7FFD53EB60810C931A22E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
Size 8.9MB
SHA256 862972c86991e5d754021b688c44dbca8c5d0893ab217f7cd975cd4472dea1fd
MD5 3dbf447af1012ec04fdfa34ef0660999
SHA1 3ef3781c06bde9cbd6d2cd388ffbd20d74de04b1
SHA512 4abdc486ee65b9a36ec7b921846291ac5945fa14867ab5786c39657470698928a080083def2cb524f1d9a41309cc0a75fb5ae46719410a1498f570e27dc1d280
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWekb:TDpbgBr/4QAMQMrEGRHsww7Q8RuWe2
TLSH
T1AD9633E67C5E65BBC10E1C798D06CE223A6C5BB1C7549C97EFD53EB60850C931B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
Size 9.3MB
SHA256 6349118d1f5090f5b59250cc10c6685ba415ea10cffa396a1a3f18a148abcb3a
MD5 ac67eb4ada14cdc60b757c26e806d2dc
SHA1 cc633c1c519778f159b6492c1ce35200a24cd1f1
SHA512 a922ba85c4971721af5db19a5722bd7cd6145aaf442dbc6c7caf6618d0f45f2c229441d5efef80f1a5ed73867fca0cbc5ffb76062ebaf883d95e026d5a4ed93f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWekfg:TDpbgBr/4QAMQMrEGRHsww7Q8RuWeH
TLSH
T138A633D67C5E69BBC10E1C798D42CE223A6C5BB1C7549C93EFD53EB60850C925B22E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download