c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
Size 9.7MB
Sample260910-w7fn8aec26
SHA256 c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86
MD5 515dfa4bccc8e59a1f71acf080d7141d
SHA1 335009fbff03e0c9f2fce81e0371f100c46e5b1e
SHA512 b7b41dd65feedb0d7cccbdffba95e98b80ca6888d61e3d4ed3d2acd309a9ca8d021c1964b10c2354a84cc907f392a14905186dad14d31c87db296bd5a70b90ec
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ7b0U:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrE
TLSH
T10CA633E67D5E2677C20D1C798D16CD223A6C5BB1C7549CA3EFC53EB20C10C936A22E66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	DesktopWindowManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	UserSession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	BackgroundTask.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	CoreSystem.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	WindowsShell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SecurityCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	WindowsHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	WindowsShell.exe

Executes dropped EXE 18 IoCs

pid	Process
4960	CoreSystem.exe
5080	CoreSystem.exe
3616	SecurityCore.exe
2076	SecurityCore.exe
3556	WindowsShell.exe
4084	WindowsShell.exe
1016	WindowsHost.exe
2284	WindowsHost.exe
3296	WindowsShell.exe
4016	WindowsShell.exe
3584	DesktopWindowManager.exe
4440	DesktopWindowManager.exe
3712	UserSession.exe
2132	UserSession.exe
2940	BackgroundTask.exe
2388	BackgroundTask.exe
636	DesktopWindowManager.exe
3852	DesktopWindowManager.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\ServiceHost.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\WindowsShell.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsShell.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\DesktopWindowManager.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\BackgroundTask.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\DesktopWindowManager.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\CoreSystem.exe\""	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsHost.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\UserSession.exe\""	DesktopWindowManager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
153	raw.githubusercontent.com
22	raw.githubusercontent.com
23	raw.githubusercontent.com
65	raw.githubusercontent.com
120	raw.githubusercontent.com
125	raw.githubusercontent.com
133	raw.githubusercontent.com
33	raw.githubusercontent.com
89	raw.githubusercontent.com
105	raw.githubusercontent.com
110	raw.githubusercontent.com
138	raw.githubusercontent.com
148	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x000700000002454b-21.dat	suspicious_telegram_bot
behavioral1/files/0x000700000002455b-84.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024563-115.dat	suspicious_telegram_bot
behavioral1/files/0x0008000000024564-150.dat	suspicious_telegram_bot
behavioral1/files/0x0003000000000733-189.dat	suspicious_telegram_bot
behavioral1/files/0x00040000000162e9-232.dat	suspicious_telegram_bot
behavioral1/files/0x0004000000000733-272.dat	suspicious_telegram_bot
behavioral1/files/0x000400000000072b-307.dat	suspicious_telegram_bot
behavioral1/files/0x000500000000072d-343.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	CoreSystem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SecurityCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UserSession.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	BackgroundTask.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	DesktopWindowManager.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4032	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
4032	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
4032	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
4032	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
4032	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
4032	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
4032	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
4032	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
4960	CoreSystem.exe
4960	CoreSystem.exe
4960	CoreSystem.exe
4960	CoreSystem.exe
4960	CoreSystem.exe
4960	CoreSystem.exe
4960	CoreSystem.exe
4960	CoreSystem.exe
4960	CoreSystem.exe
4960	CoreSystem.exe
3616	SecurityCore.exe
3616	SecurityCore.exe
3616	SecurityCore.exe
3616	SecurityCore.exe
3616	SecurityCore.exe
3616	SecurityCore.exe
3616	SecurityCore.exe
3616	SecurityCore.exe
3556	WindowsShell.exe
3556	WindowsShell.exe
4084	WindowsShell.exe
4084	WindowsShell.exe
3556	WindowsShell.exe
3556	WindowsShell.exe
3556	WindowsShell.exe
3556	WindowsShell.exe
3556	WindowsShell.exe
3556	WindowsShell.exe
3556	WindowsShell.exe
3556	WindowsShell.exe
3556	WindowsShell.exe
3556	WindowsShell.exe
1016	WindowsHost.exe
1016	WindowsHost.exe
1016	WindowsHost.exe
1016	WindowsHost.exe
2284	WindowsHost.exe
2284	WindowsHost.exe
2284	WindowsHost.exe
2284	WindowsHost.exe
2284	WindowsHost.exe
2284	WindowsHost.exe
2284	WindowsHost.exe
2284	WindowsHost.exe
3296	WindowsShell.exe
3296	WindowsShell.exe
3296	WindowsShell.exe
3296	WindowsShell.exe
4016	WindowsShell.exe
4016	WindowsShell.exe
4016	WindowsShell.exe
4016	WindowsShell.exe
4016	WindowsShell.exe
4016	WindowsShell.exe
4016	WindowsShell.exe
4016	WindowsShell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 5080	4032	c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe	94
PID 4960 wrote to memory of 2076	4960	CoreSystem.exe	98
PID 3616 wrote to memory of 4084	3616	SecurityCore.exe	102
PID 3556 wrote to memory of 1016	3556	WindowsShell.exe	103
PID 2284 wrote to memory of 3296	2284	WindowsHost.exe	106
PID 4016 wrote to memory of 3584	4016	WindowsShell.exe	109
PID 4440 wrote to memory of 3712	4440	DesktopWindowManager.exe	112
PID 2132 wrote to memory of 2940	2132	UserSession.exe	116
PID 2388 wrote to memory of 636	2388	BackgroundTask.exe	119

C:\Users\Admin\AppData\Local\Temp\c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe
"C:\Users\Admin\AppData\Local\Temp\c40b9b3dd59fbc2b15af5b2428681ca4db1776cd0c9fda8fcd68dab581940d86.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5080

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2076

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4084

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1016

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3296

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3584

C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\DesktopWindowManager.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Users\Admin\AppData\Local\Temp\UserSession.exe
  "C:\Users\Admin\AppData\Local\Temp\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3712

C:\Users\Admin\AppData\Local\Temp\UserSession.exe
"C:\Users\Admin\AppData\Local\Temp\\UserSession.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2940

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:636

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 6ac45142693bd1c458512e3b8def1881e3fe3a81b85425044c0f460d67eac362
MD5 c10ea189c98d33ce0e871d19b27d2ee8
SHA1 b8e07c52568b0b8ac43d24df87ce133dedc95e96
SHA512 fa95426053eb82e9c3468f3bdf385197b306b22556ae80e4d255de3a1b6c7ded2b605a67dbac0f9295cd922e395aa2e0e0401d4057b15eaa1d26aec4d3524e3e
TLSH
T1B4E07D0E572CC3C3BD164C1026E5857A3AF270AF44D2150E643517C9CD42137C847049
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 407466a7bf7a775973c4c9f5277feec33d64debdc13b130e25446b9b5af3893d
MD5 415bc882f76a7b3e971dc0f091c9e07c
SHA1 37e4314fdbdd38a097d7371dbcd9f06f0becbbcf
SHA512 2ed928ae36c0e8cf7573c495786e80c6025f58a0972de548bc11eca029059e6c8bf7f7bf498e5cfbddaf40626fccbbd859d43a65e18b3a059b1ca0c59fa4a28e
TLSH
T16041A9DA2E187422AF814F805874CB353D7CF1D49988505974FA84E36495BA46D1A85D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 0e88a5f0db492c6d183a9c530238a34b60ddf8e643d59bb067a8bed73f3b04d7
MD5 ca45821f82f18cbccb347fd3d2edbdd0
SHA1 3c0bbcc22bc271a84cee8414221d42d021d221e3
SHA512 85a9f6c20f07e9bb0ba9aeaad0ed6dde142cc456dd82f56db61ea2b8b1f6ac821d6921fd59aef0530ac8cb3ac1ce2ba85a4108c3780fc861e81c4090bd7a1425
TLSH
T13ED0951715F6C9553B53DD044DD0D170B423AEB773D36C1AA48FD0D65800D2D3F0A215
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 177KB
SHA256 93ad6d3241391a25d7712a1f9fe3cabc6a5af307dd155274ec627f0511a25d54
MD5 6178b1ef905fce195f5227413609c595
SHA1 b910e3767d3f5cf07abac15a0aa29a6f5a03fb03
SHA512 0bfa96aa2340afbc95a425e9578ff86ab1c5e2c5da88b9e13dd31f474409e70c92f8ea1f7ee66bdce9920e51ffc2f08df2bd30ae9d896be3f8c328db2c97a042
SSDEEP 3072:JHlcm9KPx74X/pCh8ycyMGBeDvu6tizLH:l+AEx7I/fcrBeiqab
TLSH
T1AE043C645C7BB6A35D4BCE524CAEF69612F591D92812732ABE347E005C13ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 d47f36305c57a449d1209353c65cf916990d10c10bbb8dce40387ad034ead9fe
MD5 da2321ede03f4a5aa95d46060ca64ab0
SHA1 426f6b6524e6e41e03b9d2897076c8d0a2fdfa43
SHA512 d30bc6ed1e2abf680fcd8a7902f8e931ba1b7c64f3d794e9ea55fdbad2282ee766386816ce8dd0cd5782526e61b61d5eb17817d8affbb31ba58a43724ef579dd
TLSH
T18B1125C35FB5E19045F65765C6E4D5313D78708638E938C15C939842245772C670943F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 f38d96786bd6c666347abdee0f69f50848ed6702f7d9b73485da564b84aa9a0b
MD5 be6e0072d59511894c2a14958121b04a
SHA1 8727081701ad59a1b8fb4c7ed045354dac35f51d
SHA512 6e33c6591cbe2a5d5c6bfd5dc0b0cd86a3a5d78e6052654e460582454cce3b6107069aa4af04ff8a03f40482e489a122251f407aa7b93a5a22b018f93608728a
TLSH
T1AA41D8EB1A4D7568BE854F4A5DFCCA395E7CD0A881800E52B9FBC5E7209EB40690B49C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 ea4956d88a8552fd18f3d39dc62795f089aea9d4ecf4dd71964512a3602380cb
MD5 0fa71908bbc26c67ec7dc97f374a6fdf
SHA1 6f42349d858e9ea0d6171215d753452c752c471a
SHA512 482232be94b384291b840eb9c97394e81c4451e095ef14a102b8fa76cb99a7c02a36e46cd1540c321e3b379c9fe6a00c146ea02ffc3cb851cdc651db5e3a8598
TLSH
T144C08C1C2AA20A06F6A8437C02C139439B208101E2458F151AF16A09CE97B263838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 005585c7f331a7bb8adb3951c5e9f5498e688d5b679323c58e9845f7058fba34
MD5 688992bf64c0648d6ae30695b257e5b2
SHA1 a4cfe029e1bd24c0e596cc96620715bed4b62c60
SHA512 651836b182c87a7f7468a31e5a7aa04c1748553da32fe5bf0373439dd90c273d4beaf08ba4a70879d92cc5995fa6b4c5c1cb1317743109d7244308d887c404fb
TLSH
T111F05C2C1AFC812CE076DAB98EE6E6E65C16F227280445E90E914B099E02F441C9153C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 a43e890b3b3b47f518b3199d88ccdda7c22b8b3950af3f8efb5e10c2a50e52dc
MD5 f1e2598e9c038a7eecd04a8725c8da14
SHA1 00642c9580ca0a4980644fb67ac4fe60f2f25d15
SHA512 99fe9e9b245cd5466f70948c1bdf59766afb076d91dca43fe164ba991680ad1044991c4644c345cf260e01b5c10b6a083c9aa65f2fa38e20045ef865583bd227
TLSH
T15FF022203AFA903BF023AABA83C961B1096AA3067402ABB61B6023042E24F206D83511
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 0837199a5973f697dec77d3d061f366c0272c22bf3fd23dc6d2c08e149e828d7
MD5 a65302de54a8f79e5612ec50b2fc15de
SHA1 8de352377ca7c4fec5f6d2838735965b769f76d1
SHA512 dae08ad1b69afbb3a32caa46f6d11d68f1da719fd574d65da45e1c4c817a41411ce1ca1f6ad5019e1eaeb6bf4d276dc40d3bd185d8ea6ea4cb42026734701d0f
TLSH
T188F0EC0C15B8404EE4B1E878D2D565F56C35F209680586F707D611495A17E117E529BA
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 b51bd8378a07ef97a840e7eed4fb22d223211942cf17804e58cfb0db5177005f
MD5 33cd1439888564dbe4f00f643a0c08f0
SHA1 a31be27667ed8737bae4d22875a510ad87da9d13
SHA512 64959d5526eda494a6d20cac76399acb641bce2bb6b22d66f8dbbedd83c0c6ccbbefebdc1c0a59358d4dffe547a1a1ec98aba289a7833225d1865e67ed750d8c
TLSH
T11FD023183F645322F051813C45950F03DF236C096141437A3B76071CC43CD451ED3C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 f21838f16a5f844fa1ed1ee9ec6461f748d851754a09112e4e291ecfb4db41f4
MD5 8f2e60f93d2818b16fb896d34809b007
SHA1 f9900d3bd8655a43f8ea705458c039552352f846
SHA512 872261225537b096e46d669e72714334c02e96f7436ab74069dd5f4600f98c95ad78f08f8bd6178aea02e8785227f87af38ef3da2fc6664f8cc63b69ad3e8849
TLSH
T143F0AB285AEA005EE331677A4AF553ABA826F3423408C5A51BE9130DEF43F406E22434
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 b27546167e22311f38c317d1a8c50ffad31346316325f0e4f25c832aec38f69e
MD5 92f7757fe66044a6d9786a1c069df675
SHA1 957f8f20a2616e4bb96f45390ea826b4e9b28a73
SHA512 abe2129938c56d829b3300d6cd0ae28c527df20d61c20ecfae26f764f2d8fa83a917fc9bb9ef2d5b9fda8bfd6e1abc3355e1c0749f44f209c0c85d33d5b1cff5
TLSH
T100F0553421FB002EF133EA7A02C101CA8822E13722483BAD2662560D5E42A01ADB1D19
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 948e406c6039e53c16c3b95ad2e521e6ec0443799eca28d5cf175a53b9373ea9
MD5 cf81bce6a3b9c1ebd937bddad816723a
SHA1 922f3e157000269146259bec0cb928f9aba805b7
SHA512 ded5d578796c274282599e2032e96c91e79a9a890fd66d29a058671554013756d49cc7a7e0686e4f440ae1c7eeaed2f495fa6a7de63f1aad44bf16ea9441c3f0
TLSH
T1ECC08C1C16620606F2E883BD02C269838A208110F3819F1526B16A68CE25F262874C69
MD5 SHA1 SHA512 TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
Size 10.6MB
SHA256 436b6d588b9180bda7c3ac58b9642c9bca6949f179944bf2caa46eba7f9b3fd0
MD5 56a986fc978044f5bff9e580a6a3662f
SHA1 1145995348d0189434e57e61f408efeab9d56a9f
SHA512 70ec2a645c05131ce4c1378705b68a7a07fa4a47d4989227214696505ea760efc2e32648006547dc2b0aa375eba4315891913bdafbfe8e0cd7adbf671445de5c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ7b0X7L3:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyr3
TLSH
T1CFB633E67D5E667BC10E1C798D06CD12396C5BB1CB548CA7EFC53EB20C10C936A22E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
Size 10.1MB
SHA256 c415df70d4e33147f0f037d66e745c6ae6cb70d0b044b4b81f24d23a07a10a27
MD5 841d56ed459b80ab2c09252f4eca27f1
SHA1 bd05250df213529f90b91f82151ab5bc32b6698a
SHA512 47a3910b47998f391f867400f426ef46f18fefb193e4ec35d5ecb79f2fab3393f13167e4b5802563e7d1acd9631d67366a1f1f92d46c476d05d73a861b4ed1c6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ7b0X7i:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyr+
TLSH
T131B633E67D5E667BC10E1C798D06CD22396C5BB1C7549CA3EFC53EB20C10C936A22E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe
Size 10.7MB
SHA256 0c335d9f35ed9f487102ddf637c199ace2ca78dcb9454efc1c3f321d8b95ac4d
MD5 9f09579429a2918529128f72a65e20d6
SHA1 a7f963729fb1d37fa4728999d4a6138e1327821a
SHA512 bcbffe97388465a70c4c105d00e02ca346b2b914ac6d4f9c7dc2a05d22677f44ff6e90c05039615cf4ad24b7541079e8293d130b90a73ecc0da44f3d6b371615
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ7b0X7LB:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrB
TLSH
T1BEB633E67D5E267BC10E1C798D06CD22396C57B1CB549CA7EFC53EB20C10C936A22E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
Size 10.3MB
SHA256 232b37a1c0574df7804db66def123617f5759870e0e052b300a33f2fa0e62029
MD5 e456c7d395e759b0e3b4f8991d88a63e
SHA1 b86e4c1dce38410ad4d78e904dddd443621e43ad
SHA512 04878feaa11581702f889112ad1207713e300eddaa96b08be851dba139a64a468d595409147cc531acec8e3abd0ace2c96e169b98ca451c8d23f7ae8a0b1c3dd
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ7b0X7LT:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrT
TLSH
T1B7B633E67D5E267BC10E1C798D06CD22396C5BB1C7549CA7EFC53EB20C10C936A22E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
Size 10.4MB
SHA256 2ae90e97b385a74a40e20626ec8bb8ae53194c373386567908afa0e85121e311
MD5 3958be8439fc31b5e60e637c89b6794c
SHA1 effaefdd152619a8c2ecd71c29d907fbed16f299
SHA512 bb6e9bd96dbeef1d9a752cb6fc5464c6728ae0cc348182413f0849400620521c6cfcf5c2d7449292c827590c7981da42f45e6b11228d78a4ad93f9eddb065bef
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ7b0X7Lr:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrr
TLSH
T114B633E67D5E2677C10E1C798D06CD22396C5BB1CB548CA7EFD53EB20C10C936A22E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Temp\UserSession.exe
Size 10.5MB
SHA256 a9db1461b820f6db2c9dc42e55094d451247721eb8c66892c376946b6b29e153
MD5 c652639502d03a546320e10119002994
SHA1 eb950da1c266b8a548c2dee969d30e77ea55362e
SHA512 e7509f57b0b1d23e747e86df489a2c774aa73c90672f3834c9fde7bbe5fc3ab4924bbd75a04ac49af72b9adc414e6fa6fbacadb6033b8f0cf68538e7df054ea8
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ7b0X7LK:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrK
TLSH
T1D8B633E67D5E2677C10E1C798D06CD22396C5BB1CB549CA7EFC53EB20C10C936A22E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe
Size 9.9MB
SHA256 7cf3a7e2e49777ee7069d7452c9db30c9a16b7d416d2767cfeae3a9f9f5c18ec
MD5 c795f18e29e659920ee06d0c418dceaf
SHA1 75428ab1737d177d605a0821f409b04c2f12f507
SHA512 df4dc41077fd526e430aa36d1abf0d4e3b6d5193c69c7c2caef5582f23146577523392d0f2c9bda5e75e0c85d76ab7750e37c1785882c196952033a0004c0e78
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ7b0u:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyre
TLSH
T184A633E67D5E2677C10E1C798D16CD223A6C5BB1C7549CA3EFC53EB20C10C936A22E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
Size 10.2MB
SHA256 1580c7c2699ad4f2053b934ee0e87b6575a785909402c388ff2f25a7e208cd40
MD5 fb5b29e0be49e78749ac24c3d3c822b1
SHA1 53ba29613999b451da3848f382cd094fa76252a5
SHA512 0352610ed1c06538d77a0a162d8c94d4541823119055309115414d267729af9d8ce65cc814f390374f3ab86245d8b2db3c106ba89ddd2504c602a8f7f37a82db
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ7b0X7Lx:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrx
TLSH
T1EFB633E67D5E267BC10E1C798D06CD22396C5BB1C7549CA7EFC53EB20C10C936A22E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
Size 10.0MB
SHA256 b32e7a33598dc3b0ffaa16bc3dabcb7f0332465b171b8231c723db828927034c
MD5 1bc0f604a822d7e897100eca5dd598f9
SHA1 f8808610386e867dd636e3e48504aafe488af058
SHA512 ff966bebedb53da809812238ddd94a0f2334b11e9473fa1ee70e963685d367144f84d21f1c16a44c0fcc905fb4e44d42c9cd5a2f7b5a4b0beabc23063817f45d
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ7b0XR:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrR
TLSH
T180B633E67D5E2677C20E1C798D16CD123A6C5BB1C7549CA3EFC53EB20C10C936A22E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download