f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
Size 5.2MB
Sample260824-v5xdhs1eph
SHA256 f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc
MD5 3e183194f08bddb0a0f8c0493fc5e781
SHA1 46bf67e26d16f3a0e704528b9092b4701c19c050
SHA512 243d54a446148b6635eed9750eed85b60d7cbff0e9e5458962cd31a287ef8d33476972f23c466e5e2f5cae0f064bc9b73b60f79be9f7205c338fd16d45bb7b25
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6hzZ/ag:+0s420bTjzGlBrJTJb8QAMQCgGh4g
TLSH
T15F4623D5785E6ABBC10E1C7A8E47CE2235AC5BB1C7545C97FFC53EBA0810C921A63D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3948	InputService.exe

Executes dropped EXE 20 IoCs

pid	Process
3948	InputService.exe
1492	InputService.exe
120	WindowsShell.exe
5800	WindowsShell.exe
3376	CoreSystem.exe
2616	CoreSystem.exe
432	DesktopWindowManager.exe
5156	DesktopWindowManager.exe
3864	InputService.exe
1684	InputService.exe
1676	WindowsHost.exe
2404	WindowsHost.exe
3356	SystemTrayHelper.exe
2536	SystemTrayHelper.exe
5668	UpdateService.exe
3972	UpdateService.exe
5708	SecurityCore.exe
4420	SecurityCore.exe
5956	CoreSystem.exe
5216	CoreSystem.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\InputService.exe\""	f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\CoreSystem.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\DesktopWindowManager.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\SystemTrayHelper.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SecurityCore.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\CoreSystem.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsShell.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsHost.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\UpdateService.exe\""	SystemTrayHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
34	raw.githubusercontent.com
52	raw.githubusercontent.com
1	raw.githubusercontent.com

Detect suspicious telegram bot 10 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c530-12.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c535-65.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c538-102.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c539-136.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001a333-195.dat	suspicious_telegram_bot
behavioral2/files/0x000200000001af97-229.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001a333-262.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001af97-297.dat	suspicious_telegram_bot
behavioral2/files/0x000200000001afac-331.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001af97-364.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5336	f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
5336	f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
5336	f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
5336	f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
5336	f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
5336	f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
5336	f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
5336	f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
3948	InputService.exe
3948	InputService.exe
3948	InputService.exe
3948	InputService.exe
3948	InputService.exe
3948	InputService.exe
3948	InputService.exe
3948	InputService.exe
3948	InputService.exe
3948	InputService.exe
120	WindowsShell.exe
120	WindowsShell.exe
120	WindowsShell.exe
120	WindowsShell.exe
5800	WindowsShell.exe
5800	WindowsShell.exe
5800	WindowsShell.exe
5800	WindowsShell.exe
5800	WindowsShell.exe
5800	WindowsShell.exe
5800	WindowsShell.exe
5800	WindowsShell.exe
3376	CoreSystem.exe
3376	CoreSystem.exe
2616	CoreSystem.exe
2616	CoreSystem.exe
3376	CoreSystem.exe
3376	CoreSystem.exe
2616	CoreSystem.exe
2616	CoreSystem.exe
2616	CoreSystem.exe
2616	CoreSystem.exe
2616	CoreSystem.exe
2616	CoreSystem.exe
432	DesktopWindowManager.exe
432	DesktopWindowManager.exe
432	DesktopWindowManager.exe
432	DesktopWindowManager.exe
432	DesktopWindowManager.exe
432	DesktopWindowManager.exe
432	DesktopWindowManager.exe
432	DesktopWindowManager.exe
432	DesktopWindowManager.exe
432	DesktopWindowManager.exe
432	DesktopWindowManager.exe
432	DesktopWindowManager.exe
5156	DesktopWindowManager.exe
5156	DesktopWindowManager.exe
5156	DesktopWindowManager.exe
5156	DesktopWindowManager.exe
5156	DesktopWindowManager.exe
5156	DesktopWindowManager.exe
5156	DesktopWindowManager.exe
5156	DesktopWindowManager.exe
3864	InputService.exe
3864	InputService.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 1492	5336	f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe	91
PID 3948 wrote to memory of 120	3948	InputService.exe	92
PID 5800 wrote to memory of 3376	5800	WindowsShell.exe	96
PID 2616 wrote to memory of 432	2616	CoreSystem.exe	99
PID 5156 wrote to memory of 3864	5156	DesktopWindowManager.exe	102
PID 1684 wrote to memory of 1676	1684	InputService.exe	105
PID 2404 wrote to memory of 2536	2404	WindowsHost.exe	110
PID 3356 wrote to memory of 5668	3356	SystemTrayHelper.exe	111
PID 3972 wrote to memory of 5708	3972	UpdateService.exe	114
PID 4420 wrote to memory of 5216	4420	SecurityCore.exe	119

C:\Users\Admin\AppData\Local\Temp\f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe
"C:\Users\Admin\AppData\Local\Temp\f79e92361f15fe09d98f085e99ab7d2ab5ff66aa7b590800684f1072a30884dc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\InputService.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  PID:1492

C:\Users\Admin\AppData\Local\Temp\Diagnostics\InputService.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\InputService.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:120

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3376

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:432

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3864

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1676

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2536

C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Temp\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5668

C:\Users\Admin\AppData\Local\Temp\UpdateService.exe
"C:\Users\Admin\AppData\Local\Temp\\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5708

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5216

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 280B
SHA256 f972875e70c1d8c955370e51cdaa2b30490a3310e08c9e21d4692e6c275b845e
MD5 47917683f6d20b03a810600da6bf1eb9
SHA1 ce60426040ca9d355e3a0a139168bff74bc5822f
SHA512 a48ef5a8c01891961f5958de55d39b9531c1242946a677c346322edbb78b09769844fbd5e77cb7e6fc1aa5dc887c0545d69dab38cfedf2febf115a8c2f5b0c91
TLSH
T173D02B0556BD99A33B32DC8048DEC5B0BE0291A112D43C211C0DC27624480B6B706044
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 9066534b093088a317bb7df20fec902d509d2b711c016a7d7600e2716cb4a79f
MD5 89d8bd33620c0cc6a7066158cc9551a9
SHA1 f358fa3cd3fc34fdc112817e3ac8489ac78de970
SHA512 d34f5dec12f5487e260ec7e5f257341e8bac0bcab006bb98e6a0b7b8c244cb330c2254529dd6dd0a1ea6c48c485a1a481aeae71d1c6e5091b2c39843fa85728d
TLSH
T1B1E0722A6B0C46843AA3CF2407E89C733C6A518964921215681897E20A426EEC30F29A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 3d6f060b7287bcdee784465103ea19d69bca480ac8447dfd700d1fbe5e1ce249
MD5 3f6184d4c8785f712b1bcb749f965a0b
SHA1 8b30abfeecef80535e5695bd5065be355fa0e592
SHA512 9eb1d8db17d40def7a5de67410bc05b231a02c43c041a61fac31f4296e823ddbcfbc17200317bfe4a4ad5b5b520f324f04c2970aa61cda5a9b58b222629dcb36
TLSH
T1CA41FACABA1CB854BF45DF4448B4CE222E7CF2D41540159635FAC8F22486FC86F0B89C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 173KB
SHA256 c7b9d277fb9810ccb8ac0dc28bfbc2e4ff0c7e9a3aeba6cf637759a244603a75
MD5 1dfdd5ac9429284163068218ef41cd1f
SHA1 5dc8df4e2c3ed96a9602bb8c2258044cb4d9f173
SHA512 448a5e92ba7bebe61d7ff732ad157b6ee933f141d6e50d95f43197a0300b6d7c2199e5c017b9f65d3b1bccec3086a128d4131dcf5baa9695e5fe7b6d9350a3e9
SSDEEP 3072:Y6xnYMFwK35BgXrXgYHYpH/AmyRQsHcbJ7k9:Y6KuwK87QCYpH/Wx8bJQ9
TLSH
T1F8041BA85C3BB6A3AD07CF524DAEF69612E591C52912732E3E347E505C13ABFDA13C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 06e16fc816cd78ffb99afac3ddb8b50e6aec5ca8ccc83e66de02bdcaae6d3567
MD5 51184e69ed2cb5631bf01411ef13d33d
SHA1 84c61f6ada63505cd720ca6ee0ac30270c5acb41
SHA512 15b935ce752932e8289f8523ed04c757bc6d4b011d385b170321b1ac6361cf7d413e43e9b355393e7fb14e276476ebbf58638670d1513fb9065755b7e0752296
TLSH
T1E91121C29FE4A09085F786B0CBF8D5337C7870C62DEB30C12C81C59220967186B1903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 5e0da0c14e7fef70362aee75c9e2979dd0cca4a13928df4973ebcd8543c4323e
MD5 689f4ce33f1494aa0c0d06780ff6bd1f
SHA1 4698460496879e0fec4bbd182b0eebca05393ac4
SHA512 c46723e00d45e3afa925c7a6e60a5ab9577a5a2b8d9631360d31af6af736db3d8aaa7a19c3a459649fb19d97a9207c4915356eb072beb35bbff90f5a961f1d03
TLSH
T1DE411ADB4F0738A4BF41CF4A2DFDC6771E3954A8A2982541B573C892109E7902D2784D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 37fb4c369e081c39da8a5b6d7ce7ff40023b08de9fbf969123d1e32f3f23a96b
MD5 5befb329a6b1beeb345e04e76c005009
SHA1 bfbd1eabff18d53077870fe24392c4bb331fc298
SHA512 bf66ab5880ddac86cf6a8726bca0955a1c94479575ffadb98f25ae2c30fab7e7217f9615b7e79e8538e64d5a3bc0a4759f0512ebb9ba3c8a29c43b7675ac8094
TLSH
T110F0DC1828BC4238D032CC7586D97157AD19F015B804A7A706EB5208DB18C422D1202B
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 8c347f89780faae4f2f7927820fff94701afb884e072cbc3f9f88e8365be595f
MD5 1c4bf72018710f5dfe579255f5f9c175
SHA1 bb72c3fc6e706dfdaedb546983bea6f3376d3854
SHA512 d7839d1951a8d5e32f361c595be43d3fad1ff23cab8dcb02b875a4d0579b334a355535fc3af9a823b4814e2c73ce598ae86cc089859f531e71cba3dfe22626f4
TLSH
T1F2C08C1C1AA20A86F2A883BC02C179039B209101F7418F452AF52A08D99AB162C3AC3A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 cf85a504cec53b21353ce48ef28e4c355fff3afa7c171fc712476a684d18251f
MD5 2f4e507abab1fbbf03b850d6910a0b6a
SHA1 84fc48d10f2b89653b08c9ba7ebc8c1569b27cd1
SHA512 d7c1beded73bfde2497af2cbf3aaf142d6e2a6233c384e46aff677be23474df5ad84268602dc0bf730014cba302789244b6cf6a193ac3d1122c087025ae13b9c
TLSH
T177F05C2C06F851BDE07ADE7C8FD9A7A25C15F53314044A9E26D1574D9B02F026C42475
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 955eaa3d30596f3a4f80c1d83accb6c6535fd9a75ab81b3516471bde19c290c5
MD5 a76bb1d4c5f6db5be57ccdff2b5363a9
SHA1 1f44a2e1d2dbc4ab435daebd557fdc904fa6cf43
SHA512 180ae39ecb2b29eb4478d9f13a2e51729534bbd2a75fb72c015e255ba40f13c0f711af2669ef75a7c0940c6e44742f737ec716f9c213ae8d016425b829483a4d
TLSH
T1C5F022107AFAA07AF026EA3943E530B5D629B21A24015ABD26B363042A50E242C0391E
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 4621a87f5c5375bade9082e0fded032a7babf3cf3f983521897872681018d56a
MD5 1def4eb9eacf1aafe88949836d13b06e
SHA1 99ffe31d301bd9084f5211f9ea969a4488cdc7ae
SHA512 4fa6c2e53d3fa60b75e05c845b87977ef7c89e74c6a5c13aef53bdc03212887783e40fb15637702110ec0fe536d31cc253c5aa08ee28444a7204d1363b71095f
TLSH
T1D4D0222C2B201216F08CC17888E04E007E606A20F2808F082BF9200CCC7DB0A3D2281C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 8a61aaa3591d90da5a6afa1da4a6b82967679bfc8c2bb3a795d74081efdcdab1
MD5 6f5521242371e6c62b5f598b1bb3069a
SHA1 d4e4fdc7ea7a6e1b0a0f95f4b2b369e5a953c78d
SHA512 bed861fe79a73a3c20d60e537068e1089045c9d7a9821d704a827b6716b93a95c19997f1ff734431c6a4678d47f909027ed5f770cb93551ec95aa708723de86e
TLSH
T169F0A32516D1411EF67276394EFD53FEEE15B2523401CC9526E7070AED17E005D1153D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 a5b707728d9ee96b8b5a1b08c370dfd11b85b16acefd41db6ea305aec0eb366d
MD5 79ce94654cc3265c1a05261f1667e538
SHA1 46e00c2801f1e180c07c54ba131c7fed51d9645e
SHA512 352073ca3a42aef0cd4df0e26370b71f91e87a4e24cbb2ed89e25b28217914df3000235ae7e265ab27a7ea806347b3929004856b45c782c71e74db532fcc2e0b
TLSH
T125F0AB7825E7003FF132CABD06C022DB4623F53332082B6E367043095D4AD407D23925
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 c7c609c78f402dcf2b48e6b7eb623970fff95bfa8b529fef9be085d3e28d06fc
MD5 d2f69932db2edd14aedbc1fe01e9af13
SHA1 e4687c898b201e99905f31a967563f696a566257
SHA512 a116c75dca86c5a8e8a6a82a817c82326835448cde1e6a1a78d1d4f3006dbe0058f6b995d6f81c2d7dfbd6c46aa2e2878ea3e1ebdf41eeecbf0d65b517813dc9
TLSH
T16DC08C1C07614606F2A8C3B802C269838A209110F3819F0126B13A0CDD28F122835C39
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
Size 6.2MB
SHA256 cac5def8e8c4f7dc5207189fe3481f7478e1e1ede5585c3e0940bceb50173671
MD5 b35fb584802ba144864fd3ddbbe0caf4
SHA1 62d61c0f76e62abb3d0d741224d811ff218b2b40
SHA512 2e51095074413fee5ab322c4d1731fe7e8dfd68fea078281107ed31a3b2534d5e8f3f9532eaa45ade2715be402c5c00daffb9dc4b0aca0dfd1b242f5d4f1cbff
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgGh4w08gRM3:TDpbgBr/4QAMQWh+8IQ
TLSH
T1096623E5785E6AABC10E1C798E57CE2235AC5BB0C7145C97EFC53EB60910CA31A63D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
Size 5.4MB
SHA256 7cdc1257b0d1db5de07f1cf7127e7d0e868dcf1ec856d23c99079ed5f6423e62
MD5 4ab68e38d7a608c9ee6b0b0b535c5524
SHA1 e2e722b8c229d2dd37a9290cdfd690a05e7cb078
SHA512 f701362cfa0859ca7e216e7d29b80c0471e8f4e9c5115f2fee9880cb9a073142e6648d595b3ffafcc465acab499899cc8e66f0cea39dd3e0de4fde049a7ee056
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6hzZ/aw08I:+0s420bTjzGlBrJTJb8QAMQCgGh4w0D
TLSH
T1F04623E5785E6AABC10E1C7A8E47CE2235AC5BB1C7645C97FFC53EF60810C921663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\InputService.exe
Size 5.3MB
SHA256 b4a19a01fa9ed7a2dc7a8b59151df3e93d0db3f89cd90978d14fec712345ce8f
MD5 66079845eb11af4419b269348020bc6c
SHA1 3426180646a075716be248a32df5fa081f55d637
SHA512 abcc47e0c967a0f8b9aff70602d4d42eb92b1d17a9b6d9159ece90fcef55ec621edeeb2cfc453d6938309ac7685312d6b5a98ca52cada1a6cdfd117fe4aaa361
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6hzZ/awD:+0s420bTjzGlBrJTJb8QAMQCgGh4wD
TLSH
T1494623E5785E2ABBC10E1C7A8E56CE2274AC5BB1C7645C97FFC53EB60810C931663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
Size 6.0MB
SHA256 0a449ff9526351578d9b9eaa0522dff869ef577c107ea10b5e58da1f20f43ef5
MD5 5250048344ab47a3e0f00daeede518fe
SHA1 d32ef99697d6d2ebde971bd7ab560a2c5f4e3734
SHA512 3fa4ed151a173f6b7ed292d4a6094e764a40c3a5654b2b4b2793844676f01775c43468cf329e611d294b3196d0349fa5c2f7affa2d757ce4fa53fde93c10ee14
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6hzZ/aw081gDY:+0s420bTjzGlBrJTJb8QAMQCgGh4w08j
TLSH
T1EC5623E5785E6ABBC10E1C7E8E5BCE2235AC57B0C7245C97EFC53EB60810C921663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Temp\UpdateService.exe
Size 6.1MB
SHA256 daf0a01615826ce88481b0d25cc81afec1900eaef6d1369b6414352bfe0c81a5
MD5 8e0984658e3da24d0c81127e67c66bfe
SHA1 a28127c09e05cd0a101f80faf1dee9b6d6a15324
SHA512 37d5d46763ffab572d9102b1fb05a5cf6c2b9b2936b830f989a4785ca5b885916dd314a63f200862928e423d7b5cbb10d8aff5e911053c8642db904a99a9d86d
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgGh4w08gRV:TDpbgBr/4QAMQWh+8IV
TLSH
T1605623E5785E6ABBC10E1C7A8E5ACE2235AC5BB0C7145C97FFC53EB60810C931663D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe
Size 6.3MB
SHA256 de2eeb8173f91e33829ac56bac39ca47cf8652ba5076222c0a266284d985cb3b
MD5 948af4ea8e5721dc94062c8d735408c2
SHA1 725bfce428172889498d80369b9378f78d91b9d5
SHA512 ee21337fa2c8100de10e9e68f322f0b1523b090c6aaa417dbb017a18167f046f1b27e43fbd3cb8f442b7d925a6fbd3ead8a657333c5997bd4cc4fc69c30bb64b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgGh4w08gRMs:TDpbgBr/4QAMQWh+8Ip
TLSH
T1CC6633E5785E6ABBC10E1C798E56CE2235AC57B0C7145CD7EFC53EBA0910CA31A63D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
Size 5.9MB
SHA256 07439e7a0f811e27b7a055e85f13eae59923ce2bda914a2045293b3a70fb70b8
MD5 6030b3ff9b00cbeef35ebed029d82504
SHA1 d0cee6cb4c8f4d101cdf6e658325ca3f801df4ae
SHA512 d98999837be84ba19171a415928acf056e2aaca10a433de00db9c6e3b46c3bad0931cfed5c7f366245a8cd366b22847d5f88a6cbbaa9388a718ed3dee169a6c5
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6hzZ/aw081gDs:+0s420bTjzGlBrJTJb8QAMQCgGh4w08n
TLSH
T13C5623D5785E6ABBC10E1C7A8E5BCE2235AC5BB0C7645C97FFC53EB60810C921663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
Size 5.6MB
SHA256 83397f7058c81a75f4abc3bd954cf72a7243b376121e45e9801da39ec66afb72
MD5 e104446884abbdddfa0767aa97bd7f0c
SHA1 66cd4ab1ca33a4943704e9075e60b4e6bacfb401
SHA512 f5994c903efedd4dd59747a874ffa2ecf52edf2af274e3a650defaa15e90101fd657047affe134905b3cdd404b58bd43f20deaa39e528a2ddf9dcd193696b9d3
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6hzZ/aw081b:+0s420bTjzGlBrJTJb8QAMQCgGh4w08b
TLSH
T1355623D5785E6AABC10E1C7A8E5BCE2235AC5BB1C7545CA7FFC43EB60810C931663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
Size 5.5MB
SHA256 fd1b89280bb2912083ea6689ba11ddccb091453842cf03033eac9078db21906e
MD5 ef62f9b489bea8a327f7e4832796df7d
SHA1 2b5d76e4fbb7aec4cdd5033f7e3bbb639f234894
SHA512 62afa40d5ff1d0ef9cf852f9cdafc4daa73480018508d81446e6926e33ad281699839887d3dbbdbc76c1f43ccb2be5ca5cc233504cc625a960089ca590e43b5a
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6hzZ/aw081+:+0s420bTjzGlBrJTJb8QAMQCgGh4w08+
TLSH
T1FD4623E5785E6AABC10E1C7A8E56CE2234AC5BB1C7645C97FFC53EF60810C931663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
Size 5.8MB
SHA256 e97e4137d512e2b699cc7137c84eadd665e731e85cc346d1d96875efbe10110a
MD5 f02dfbb6ec439fc047ae768248c0c61f
SHA1 f2135f18cf42fdb7191f1df8312357e37e94694b
SHA512 96ad1d59b9a3cd4512a6d59c07acb2f451f396ce14d5821ff4fd567693d60886ac02657525f7b852e924473ceac4215d9dbcc5201a7720ae41b1b3477ca25b2f
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6hzZ/aw081g4:+0s420bTjzGlBrJTJb8QAMQCgGh4w087
TLSH
T1125623D5785E6ABBC10E1C7A8E57CE2235AC5BB1C7645CA7FFC53EB60810C921623D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download