bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74

Analysis

max time kernel
145s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe
Size 5.0MB
Sample260909-29ms7stxcx
SHA256 bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74
MD5 0c33a7805f0bebf6e0ec2218de25bd20
SHA1 4e96dfa99e25b1f6a6c93b76e60f1c969af6d4b6
SHA512 d5f922fdf060c33fdcad4818e7ea4f73e6f2db6440ec648813c092284e01f8b02d8ffaf2d1461dfd5921969e623c46f7a17c00dcd552a90f9907de441cf7b03d
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C82R+:+0s420bTjzGlBrJTJb8QAMQ/ZH86+
TLSH
T1E83623D6B89E6AABC10D5C7E8D168E2675AC5B71C7604CA3FFC53DB70811C932633922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4916	DesktopWindowManager.exe

Executes dropped EXE 22 IoCs

pid	Process
1900	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4644	InputService.exe
5428	InputService.exe
4496	WindowsHost.exe
1464	WindowsHost.exe
3256	ServiceHost.exe
4256	ServiceHost.exe
2324	UserSession.exe
4960	UserSession.exe
1936	SystemHost.exe
396	SystemHost.exe
4168	WindowsHost.exe
2696	WindowsHost.exe
2136	WindowsHost.exe
2352	WindowsHost.exe
3168	RuntimeBroker32.exe
4092	RuntimeBroker32.exe
916	SecurityCore.exe
2196	SecurityCore.exe
4728	ServiceHost.exe
4100	ServiceHost.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\WindowsHost.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\ServiceHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\UserSession.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemHost.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\WindowsHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\ServiceHost.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\DesktopWindowManager.exe\""	bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\InputService.exe\""	DesktopWindowManager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
122	raw.githubusercontent.com
26	raw.githubusercontent.com
47	raw.githubusercontent.com
60	raw.githubusercontent.com
85	raw.githubusercontent.com
97	raw.githubusercontent.com
106	raw.githubusercontent.com
1	raw.githubusercontent.com
15	raw.githubusercontent.com
68	raw.githubusercontent.com
101	raw.githubusercontent.com
117	raw.githubusercontent.com

Detect suspicious telegram bot 12 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c471-28.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c472-105.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c476-140.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c477-174.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c476-209.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016984-243.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af5-277.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001a341-312.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001a342-346.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001a341-381.dat	suspicious_telegram_bot
behavioral2/files/0x000500000001a342-415.dat	suspicious_telegram_bot
behavioral2/files/0x000500000001a341-449.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1804	bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe
1804	bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe
1804	bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe
1804	bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe
1804	bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe
1804	bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe
1804	bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe
1804	bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
5428	InputService.exe
5428	InputService.exe
4644	InputService.exe
4644	InputService.exe
4644	InputService.exe
4644	InputService.exe
5428	InputService.exe
5428	InputService.exe
5428	InputService.exe
5428	InputService.exe
5428	InputService.exe
5428	InputService.exe
1464	WindowsHost.exe
1464	WindowsHost.exe
1464	WindowsHost.exe
1464	WindowsHost.exe
1464	WindowsHost.exe
1464	WindowsHost.exe
1464	WindowsHost.exe
1464	WindowsHost.exe
3256	ServiceHost.exe
3256	ServiceHost.exe
3256	ServiceHost.exe
3256	ServiceHost.exe
4256	ServiceHost.exe
4256	ServiceHost.exe
4256	ServiceHost.exe
4256	ServiceHost.exe
4256	ServiceHost.exe
4256	ServiceHost.exe
4256	ServiceHost.exe
4256	ServiceHost.exe
2324	UserSession.exe
2324	UserSession.exe
2324	UserSession.exe
2324	UserSession.exe
4960	UserSession.exe
4960	UserSession.exe
4960	UserSession.exe
4960	UserSession.exe
4960	UserSession.exe
4960	UserSession.exe
4960	UserSession.exe
4960	UserSession.exe
396	SystemHost.exe
396	SystemHost.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1900	1804	bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe	89
PID 4916 wrote to memory of 4644	4916	DesktopWindowManager.exe	92
PID 5428 wrote to memory of 4496	5428	InputService.exe	96
PID 1464 wrote to memory of 3256	1464	WindowsHost.exe	99
PID 4256 wrote to memory of 2324	4256	ServiceHost.exe	102
PID 4960 wrote to memory of 1936	4960	UserSession.exe	105
PID 396 wrote to memory of 4168	396	SystemHost.exe	108
PID 2696 wrote to memory of 2136	2696	WindowsHost.exe	111
PID 2352 wrote to memory of 3168	2352	WindowsHost.exe	114
PID 4092 wrote to memory of 916	4092	RuntimeBroker32.exe	117
PID 2196 wrote to memory of 4728	2196	SecurityCore.exe	120

C:\Users\Admin\AppData\Local\Temp\bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe
"C:\Users\Admin\AppData\Local\Temp\bd0b314a6c3da0ee95d246fb45ede9bcc0ed7ff609346b6ae37ca55306f28a74.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1900

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4496

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3256

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UserSession.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2324

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UserSession.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1936

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:396
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4168

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2136

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3168

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:916

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4728

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4100
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe" --monitor
  2⤵
  PID:5568

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe"
1⤵
PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 6ac45142693bd1c458512e3b8def1881e3fe3a81b85425044c0f460d67eac362
MD5 c10ea189c98d33ce0e871d19b27d2ee8
SHA1 b8e07c52568b0b8ac43d24df87ce133dedc95e96
SHA512 fa95426053eb82e9c3468f3bdf385197b306b22556ae80e4d255de3a1b6c7ded2b605a67dbac0f9295cd922e395aa2e0e0401d4057b15eaa1d26aec4d3524e3e
TLSH
T1B4E07D0E572CC3C3BD164C1026E5857A3AF270AF44D2150E643517C9CD42137C847049
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 abfaa383387b94cb47972294a6ad04c5972c1cf14d442b3d690d1bfee70d0236
MD5 abaf1327c08dcda4c923beb93d0e490c
SHA1 019b69404eb5f4b55254e6eb31f66b4be36ed78f
SHA512 f45ab94e40c5d8bcce0aa115b5dbca2816996583ab3249106dbbfb7bf37db00eccb04a17190c05b2da8790978833d896eded1d6b39895eaf90f06d863ea302ff
TLSH
T1CF41D8EA7E1D7064FF498F851874CA393E38BAD05585005DB0FE84B2349D7D16D1981C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 0e88a5f0db492c6d183a9c530238a34b60ddf8e643d59bb067a8bed73f3b04d7
MD5 ca45821f82f18cbccb347fd3d2edbdd0
SHA1 3c0bbcc22bc271a84cee8414221d42d021d221e3
SHA512 85a9f6c20f07e9bb0ba9aeaad0ed6dde142cc456dd82f56db61ea2b8b1f6ac821d6921fd59aef0530ac8cb3ac1ce2ba85a4108c3780fc861e81c4090bd7a1425
TLSH
T13ED0951715F6C9553B53DD044DD0D170B423AEB773D36C1AA48FD0D65800D2D3F0A215
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 efa069b762b4bb65ae633917c1003f6c8f5da4d9d8589f5903f26059fa2f7d9d
MD5 e39b4b8b9248851e5e25f901e24b400f
SHA1 f0ea77f15ffca2b98d3c6e9ac0891bdc0db06a23
SHA512 4d844ee152d109c6f33223d679a289e6c9818f26e20ba956b46e99c07d7e4dbcbd6c421e1f3a85a06e9d21afb93ee4a85d3899cb7298d4a800d45006a00ec7d6
SSDEEP 3072:ZBHlBm9wPx745/pChDucyGGBe0g6tizL+:XvAOx7S/ywRBedqaC
TLSH
T100043B645C7BB6A35D4BCE524CAEF69612F591D92812732ABE347E405C03ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 979B
SHA256 40733033c1cbb77c1f524ca34fc162fca7d358f2c2b897d3f8d826ea83c7be58
MD5 468e77b14ab7a8d9c2d6285dc4d270cf
SHA1 464109a45a30bc42bc87cc8b7927378a70f59998
SHA512 03d87cedff009e0a55adbd00e3f96360578130e7caf75a9cf4623c30a277c58d8409c5fa3244cd9c3b76617e829e7902761055ab965b89d694e362bdb786a7c0
TLSH
T1061121C36EF8A18499F39760CAE8C6313CB9608669FA30D11C9198D3205B72C6F1803F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 a163fb2b2d7cf2c5f4b08bbb02846819bb6aea66f9c32942c5ae71748ff58fa4
MD5 8b17e61ad6fc16e485aa9a141f2617fe
SHA1 29b6b9b2078752420be6cfc9d1beb035c7d9cfd8
SHA512 bdfb351d2e3df55e18029ebaac7a275cbc4c924bba0cf5efb687a14821d40ddc50883f372e913e5d98f416bf37b4a0d4228b68e4097b7bae2456ee6f1a771442
TLSH
T16B41F8F3574A3928BF428F4A5DBDC2756D38A0A4D2815983F5B7C5E604C9BD02C1798C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 ec545d50cf12aaf4bbcde0dbb569690ee9c96aa7a13cb05b9beedd651f9fdb4b
MD5 360e60b5e66ce22c62feeae84189c41a
SHA1 6bccd1e63e61744f569ce151ac1d16ee4f3a7873
SHA512 f889af611f36d52ebef49ab788687660dd244665f5423f5bad3a93b562c86e818a7ab4af22c5871bb535cbed7ea495bc63df1a836230bb0b567e40e89a9ee807
TLSH
T1D6C08C1C1AA20A06F2E8437C22C139039B208101E3428F091AF52A48DA97B162C38C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 0de176416dc18efeb4422cf2936d1675a0e4e0f4e48a8de4a16924544cb146e7
MD5 165d055f07d6848440640533f20124f3
SHA1 cb45c46cbce3e3529c29ede1228a3896aa304518
SHA512 21b1f9ac69f046a934cd03dd42e15ae22f5579eb028b0952a3a6bbf85de85243c14ff94de8c1bf4aee374228d3c8c7c03a6bab26573b1db48278422af2093560
TLSH
T1EBF05C2C16FCC01CE032DAB98ED5E6E65C1AF323280405E90A950B0A9902F441C5053D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 39ed47aebf8086dcb5771cc06f4a4c3f9b4da4f62a179bb4784219c92c764b11
MD5 2e47c620aad181e72d80b0526e2a02b4
SHA1 ddbe48605322ae956a4bff9ca27cef7fb8b12e91
SHA512 ab567e355a5b3c8015e00dd738697f62946671c1144250215145add3b1d949e74696b29feb700a4215c804209f389af1034dbc596bb302efdc396cd9787f33df
TLSH
T110F0681039FF917FF133AA3603C131F8962BF25270122678AA7213182A14E106C9150D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 c94645a9632f5423de698a9324012ea551a039a17015296f9d822086212c2a78
MD5 3666e9c5a6ddf39cc030f73c0da9c858
SHA1 7e6036b7fd0564a766c6196f6e4ae8ea66da90ea
SHA512 5960023b32f1404e74fa24a6815dde36bf109d6d44074d86b821585aa8e1de63ad761fccc22477e624e764c48433395e5461f4e78467b4f7780a7b92c61f42d4
TLSH
T17EF0A30C05B8410EF0B2E874D2D471F5AC35F209280586E707D711455E07F103E12AFE
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 7c6ab97cd74fbbc1e81ff2fd53ca6768ea12a329fdabbab13fa4316f4f529225
MD5 cabfb5a9dce3d287aee672c2451e693d
SHA1 be6f8084edecc206647153b8a4c07e9373f33c7b
SHA512 937bc83cad89a1050c4dd49323fb64d1772f86003ceda72ad960dfaf87584a6dd47677a5be5372ee3761be85fc6bcf689d3015694e20838e3284f1a226d17dca
TLSH
T144D022183BD61277F100C33EE2F206C68768B012B1A32B2E5BB2190C892E50F3C53C8C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 d20e88a779e1e950378fe63d0f9d3993facf2ecd81447c2ced7b082583983477
MD5 171d053d1bb860bc0998c99f61795803
SHA1 9d4e23b707c4c8e44d9c012b86973cbb1143c90e
SHA512 19b022ae8efaece25a5fd898ff23d4f467bce37ab6254fcafeb7646beb45d20ded63a661c96e5c2573c6360a2bfafd2898135dc3577a7bff766efb53184f532e
TLSH
T152F05C342A93407EE635677A4AE4A7EB9C09B3023408C46635D1160EF607E421E51439
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 77175d1df240a418531b95847b615c6aa0e544a0d1746898cda8f579d26dfece
MD5 a78e611340655973569b3ac6dfaf3d16
SHA1 dc621068b4d9dae567c5aca252b643b1424d34d8
SHA512 bd17b1f28f4afc134e49567fa8385995c01259128a9058865833fc30ea08a7b92104b3141f1c23cc14a5ffd934ad5206f9ff6dcc5930c6409d8c6a98cf9f9fae
TLSH
T1E3F02B3D24E7066DF221D67F02C116D68B27F6323554A6557BB042196D4AE01BEA0A12
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 7f6561f5241cbce5b748696763ea22cf95e1e6853c68191ac8709e32944069f4
MD5 6c6e34fff9f163ffd6ebd9d4ef17f277
SHA1 5aa775ac864cd1aa61b39a11f51cf3b6d0ae134f
SHA512 90b92187089883b59b1c0ba9c1f133a027f2be9ffaf78b287519afc58142b5b7e88f634bfeeb531a366f3af3bee7ef44b713153079c0bf52ddec788dc9a7df72
TLSH
T1A4C08C1C06620616F2A883B802C229838B288510F3819F0126B12A08CD24F122C38C29
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
Size 6.3MB
SHA256 d2dd449ed3780cf486dfc58ff3054a23280b72e4ab581b50368c954f6019d743
MD5 0d03579392f3c991628e9e8d9f43beec
SHA1 f8b263cf8d0053a2a6fd13f557ea05d5be55b357
SHA512 16e55241c0baa05173670170a2415fb4a079829c00570b13aca4fda90bd3d4df158e85698c053b0cbaf2e75685ccba2d3c081048f654caf8fe8d1247a62d8ff6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZH86kpS0U7ZpI:TDpbgBr/4QAMQ/ZH86kpS0UNq
TLSH
T1056623D6789E2AABC10E5C7E8D168E2635AC1BB1C7644CA3FFC53DB74850D931633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
Size 5.9MB
SHA256 385a3b76a56f6dd55bed4d5db8a720d70124e8a67581dae31c8adef2875cb72b
MD5 8887c9d34cd2fcf19f24bc6d241c17cf
SHA1 de33c286612d8912da16e54c10ec15a2b40c0990
SHA512 c90447a88d6eaddc8152616f734d5416d7e8d81cf6e073f7e5986dc12160bf097a41baa760f0eb510b38e1e1a54ef2ba12b72a48519a911035995dabf500d114
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C82Rn9PapUD0Ut:+0s420bTjzGlBrJTJb8QAMQ/ZH86kpSf
TLSH
T1CE5623E6785E6AABC10E5C7A8D178E3635AC4BB1C7644CA3FFC53DB60850D931633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
Size 5.3MB
SHA256 0b89800a8390eb8cdb2cd6c22888225efa5d0235a7bea6af487ab8c5a22fbf0f
MD5 73edfeb5c8d818381b53412dddfa6635
SHA1 f9da1631d1c65d304262ef8d101141801d8db5e1
SHA512 e12fb5ea9f0c92be5cf28868e1e0a9f995148d21ada2c5768a8d6d1e8a3646916352c03e0b4463942b023366e5754afe43ceccb56fc5948c9959dbfd7f34e275
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C82Rn9PapUDY:+0s420bTjzGlBrJTJb8QAMQ/ZH86kpSY
TLSH
T1814623D6785E6AABC10E5C7E8D168E2635AC4BB1C7644CA3FFC53DB70950C932633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
Size 5.2MB
SHA256 605232ba347296216a26428fd1f4158afc5518e428a0eec0ca34a9f33e272666
MD5 3560f3889503f2377ec2bb25d20fbf3e
SHA1 f189dfad23ece9103ec85c2f6f29ebbf6728633f
SHA512 768bc3803aa5c6b9c0b131a5d7f09ab13cb46215b25bb81ff660f8df680b073fc3a0e497306f5cf18fe8d91bb2b41501bd6a5da0e4e89cb55f4a89e0c1b87c76
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C82Rn9Pa1:+0s420bTjzGlBrJTJb8QAMQ/ZH86k1
TLSH
T1414623E6785F6AABC10D5C7E8D168E2675AC4BB1C7644CA3FFC53DB70850C932632922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UserSession.exe
Size 5.6MB
SHA256 23e09317ad732e0250a44586169374edc712d52920ae4817d0bf2ba382c2341d
MD5 4c41e3f8d2c7dc6b31b5701cd5dc589a
SHA1 92bd1b84bf53fad58c6271468efe76d0ea2f5065
SHA512 4149307dc46b498df16ee410b13cd14ddcd95e5b61d2b0ccaa3f79a0b1192e0a4da8f82d1b99271e28b8c8bcc85d3db64650c05f07f1215b73098c3b94d51385
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C82Rn9PapUD0i:+0s420bTjzGlBrJTJb8QAMQ/ZH86kpSv
TLSH
T1A04623E6785E2ABBC10E5C7A8D178E2635AC0BB1C7644CA3FFC53DB70950D931632922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
Size 5.1MB
SHA256 e586c9e8447f92d7f148dbe55a22b71201facdbb69b26b497f3e3de9b1f9d23f
MD5 9734a8dabdaed6d59863e92a281d0a1a
SHA1 07ce6140597cfffbfdac564dfa71d71e0acb6e95
SHA512 903c130cd70ba844ead409952ea6d8b20938ae6a534affc03a84e6bf9f2225020d8d525241e0fdfb051ff8b3e025b50bf29bbc86a9d2bb2c1bb8cd8a16389c08
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C82Rn9PaJ:+0s420bTjzGlBrJTJb8QAMQ/ZH86kJ
TLSH
T1434623D6B89F6AABC10D5C7E8D168E2635AC4B61C7644CA3FFC53DB70850D932633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 6.1MB
SHA256 3cb4101eab95f7657484aedce29d5dc545385f46c2c192442bce606743588b6a
MD5 c9d4455d5189298516fed91c5bb2d5d7
SHA1 330b5d009180dc0ebda57b595358bf2659799ab7
SHA512 819abc822e53d1a48f4360c2b7bc0d3a37dab17573454bd4c2effdb7e096658a3fc82f652e2ef19198aa81df74e0940419cfd63cfc06bf088ece1fb2bd840d76
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZH86kpS0U7o:TDpbgBr/4QAMQ/ZH86kpS0U8
TLSH
T1075623D6B85E2AABC10E5C7A8D178E2635AC5BB1C7644CA3FFC53DB74810D931633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
Size 5.5MB
SHA256 41990ebcf43b15f1ad61a08e78ffa640c4a0f3091eff8b1d43f766313f933078
MD5 0519a27a4b5d6ac29bb06ef0883c3897
SHA1 3083d4ed423a30bda439f038b0af3b7463820d6e
SHA512 29c84ae798f78352b910f6f2825a1a677e69809565e4227568703dfcef3c4414dc0658f22082ca0ca676d6356ffe77f8b0f328dced54c347bdc99651e17f8bc7
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C82Rn9PapUD0D:+0s420bTjzGlBrJTJb8QAMQ/ZH86kpS6
TLSH
T1F24623E6785E2ABBC10E5C7A8D168E2635AC4BB1C7644CA3FFC53DB70950D931633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemHost.exe
Size 5.7MB
SHA256 ee98fb9dde2701fc15660f1d748705f92fe0da7e5e127ad8073aab86362011f1
MD5 e4cd15996af48a5f5a3d22e511dd9632
SHA1 de33b5076a302fa926e1d9286fd1e69a7ed77f03
SHA512 60ab61d3019ca62b2aeec38066fdd2014cdbea5e22b6122ecca118b4a42a8685af712f9e1fef36df953cd125908d6f711d6ddb47b824672909540503d62378f6
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C82Rn9PapUD0y:+0s420bTjzGlBrJTJb8QAMQ/ZH86kpSj
TLSH
T1EF5623E6785E2AABC24D5C7A8D178E2675AC0BB1C7644CA3FFC53DB70850D931633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
Size 5.8MB
SHA256 1050890c1b6e073a0b09b6afa06a7dfeefd471efecbc1eb814d7c8d1ccea29be
MD5 4bbe2de470ad5878a7477f699a839886
SHA1 81bf1b402df00e362d2aada1ee021c7b63ee819e
SHA512 de94bc24ca5f746392faa4c44f15b69b507ee3210f768bc06c4f115e5e88b7b1c7f8ff9885e1709da77a833db865577a1fae2e07900fe2551e748cf65650204b
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C82Rn9PapUD0Uo:+0s420bTjzGlBrJTJb8QAMQ/ZH86kpS2
TLSH
T10A5623E6785E2AABC14E5C7A8D178E2635AC0BB1C7644CA3FFC53DB70950D931633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
Size 6.4MB
SHA256 4854ccae57ee48fec6b76f6aa395e8dfa8816277a3a9c0b035cc1abd1ef3ceab
MD5 9a7ca9e0285975cbb677fe580c0fe825
SHA1 0bb9f7d16c51afed5a18709bcef7426aec62d72c
SHA512 3dc890ac30a5c618f6b60a3bf2615a6f9cea453075ddf317d7fb4d7932732c6445a97676de6e1b56f223c85c30f86a6cd7f54b3cc3158b1258c9c39fe72a1720
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZH86kpS0U7Zp+:TDpbgBr/4QAMQ/ZH86kpS0UNA
TLSH
T1F16633D6789E2AABD10E6C7A8D178E2535AC1BB1C7644CA3FFC53DB70850D931633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
Size 6.0MB
SHA256 68f5f6d30e36388ea511d45df8fc2fba45ab17b09227267a04ab7d42fcb90d65
MD5 b20fee8700021cb787e65fc791600f64
SHA1 7a4c69fbebd1824e0fc96e257857e4f771dc7040
SHA512 890fa6fdbdabd3851b4f5c3e5905c3c7590458a8f40c68c9cb8658dd0fc0d6e092cf7aa3923228d105fb266905ae67f771dc12450d729dcde01f127d750dc95a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZH86kpS0Ui:TDpbgBr/4QAMQ/ZH86kpS0Ui
TLSH
T18E5623D6785F6AABC20E5C7A8D178E2635AC4BB1C7644CA3FFD53DB60810D931633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download