b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
Size 4.5MB
Sample260910-ycnsfsed88
SHA256 b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd
MD5 1b41b548c4ff400f36e5e15f59337163
SHA1 e49663ee10230eb2c49ded4e540a4c39c50b2962
SHA512 d4cf19306f6e9dc86eb6602797c00bb2127b3d23b5a460581e673e64a60a7e159ea87cbd6d5eaf24870465a2fd4eacd88a826c8b464b649c2035f08a0dbb120b
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEQ:+0s420/3uzufNDPQnSZGiQ
TLSH
T1C02623E4785E26EEC01A1CBA8E62CE6275EC577187501DA3FFD53EBA0454DD20722A33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	DesktopWindowManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	CoreSystem.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	CoreSystem.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	WindowsHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	WindowsInternal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	UpdateService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	NetworkHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	WindowsInternal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	NetworkHelper.exe

Deletes itself 1 IoCs

pid	Process
2556	NetworkHelper.exe

Executes dropped EXE 19 IoCs

pid	Process
2556	NetworkHelper.exe
1636	NetworkHelper.exe
1716	CoreSystem.exe
3192	CoreSystem.exe
4976	WindowsHost.exe
2716	WindowsHost.exe
4264	WindowsInternal.exe
5076	WindowsInternal.exe
2992	UpdateService.exe
4712	UpdateService.exe
836	DesktopWindowManager.exe
4736	DesktopWindowManager.exe
3828	NetworkHelper.exe
5072	NetworkHelper.exe
4268	WindowsInternal.exe
3996	WindowsInternal.exe
1372	CoreSystem.exe
212	CoreSystem.exe
1152	NetworkHelper.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\WindowsHost.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsInternal.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\DesktopWindowManager.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\CoreSystem.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\UpdateService.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsInternal.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\CoreSystem.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\NetworkHelper.exe\""	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe

Contacts third-party web service commonly abused for C2 1 TTPs 17 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
124	raw.githubusercontent.com
139	raw.githubusercontent.com
143	raw.githubusercontent.com
160	raw.githubusercontent.com
169	raw.githubusercontent.com
23	raw.githubusercontent.com
81	raw.githubusercontent.com
136	raw.githubusercontent.com
101	raw.githubusercontent.com
127	raw.githubusercontent.com
45	raw.githubusercontent.com
69	raw.githubusercontent.com
148	raw.githubusercontent.com
157	raw.githubusercontent.com
22	raw.githubusercontent.com
30	raw.githubusercontent.com
112	raw.githubusercontent.com

Detect suspicious telegram bot 10 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x0007000000024558-21.dat	suspicious_telegram_bot
behavioral1/files/0x000700000002455f-99.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024579-142.dat	suspicious_telegram_bot
behavioral1/files/0x0003000000000729-179.dat	suspicious_telegram_bot
behavioral1/files/0x000300000000072d-216.dat	suspicious_telegram_bot
behavioral1/files/0x0004000000000729-250.dat	suspicious_telegram_bot
behavioral1/files/0x000500000000072f-286.dat	suspicious_telegram_bot
behavioral1/files/0x0005000000000729-322.dat	suspicious_telegram_bot
behavioral1/files/0x000600000000072f-357.dat	suspicious_telegram_bot
behavioral1/files/0x0006000000000729-393.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NetworkHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UpdateService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	DesktopWindowManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NetworkHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	CoreSystem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	CoreSystem.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3444	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3444	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3444	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3444	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3444	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3444	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3444	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3444	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
1636	NetworkHelper.exe
1636	NetworkHelper.exe
2556	NetworkHelper.exe
2556	NetworkHelper.exe
2556	NetworkHelper.exe
2556	NetworkHelper.exe
2556	NetworkHelper.exe
2556	NetworkHelper.exe
2556	NetworkHelper.exe
2556	NetworkHelper.exe
2556	NetworkHelper.exe
2556	NetworkHelper.exe
1716	CoreSystem.exe
1716	CoreSystem.exe
1716	CoreSystem.exe
1716	CoreSystem.exe
3192	CoreSystem.exe
3192	CoreSystem.exe
3192	CoreSystem.exe
3192	CoreSystem.exe
3192	CoreSystem.exe
3192	CoreSystem.exe
3192	CoreSystem.exe
3192	CoreSystem.exe
4976	WindowsHost.exe
4976	WindowsHost.exe
4976	WindowsHost.exe
4976	WindowsHost.exe
4976	WindowsHost.exe
4976	WindowsHost.exe
4976	WindowsHost.exe
4976	WindowsHost.exe
4976	WindowsHost.exe
4976	WindowsHost.exe
4976	WindowsHost.exe
4976	WindowsHost.exe
2716	WindowsHost.exe
2716	WindowsHost.exe
2716	WindowsHost.exe
2716	WindowsHost.exe
2716	WindowsHost.exe
2716	WindowsHost.exe
2716	WindowsHost.exe
2716	WindowsHost.exe
4264	WindowsInternal.exe
4264	WindowsInternal.exe
4264	WindowsInternal.exe
4264	WindowsInternal.exe
5076	WindowsInternal.exe
5076	WindowsInternal.exe
5076	WindowsInternal.exe
5076	WindowsInternal.exe
5076	WindowsInternal.exe
5076	WindowsInternal.exe
5076	WindowsInternal.exe
5076	WindowsInternal.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 1636	3444	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe	86
PID 2556 wrote to memory of 1716	2556	NetworkHelper.exe	88
PID 3192 wrote to memory of 4976	3192	CoreSystem.exe	100
PID 2716 wrote to memory of 4264	2716	WindowsHost.exe	103
PID 5076 wrote to memory of 2992	5076	WindowsInternal.exe	106
PID 4712 wrote to memory of 836	4712	UpdateService.exe	109
PID 4736 wrote to memory of 3828	4736	DesktopWindowManager.exe	112
PID 5072 wrote to memory of 4268	5072	NetworkHelper.exe	115
PID 3996 wrote to memory of 1372	3996	WindowsInternal.exe	118
PID 212 wrote to memory of 1152	212	CoreSystem.exe	121

C:\Users\Admin\AppData\Local\Temp\b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
"C:\Users\Admin\AppData\Local\Temp\b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1636

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe"
1⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1716

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4976

C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\WindowsHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4264

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsInternal.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2992

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:836

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\DesktopWindowManager.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3828

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4268

C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsInternal.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1372

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:212
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 6ac45142693bd1c458512e3b8def1881e3fe3a81b85425044c0f460d67eac362
MD5 c10ea189c98d33ce0e871d19b27d2ee8
SHA1 b8e07c52568b0b8ac43d24df87ce133dedc95e96
SHA512 fa95426053eb82e9c3468f3bdf385197b306b22556ae80e4d255de3a1b6c7ded2b605a67dbac0f9295cd922e395aa2e0e0401d4057b15eaa1d26aec4d3524e3e
TLSH
T1B4E07D0E572CC3C3BD164C1026E5857A3AF270AF44D2150E643517C9CD42137C847049
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 407466a7bf7a775973c4c9f5277feec33d64debdc13b130e25446b9b5af3893d
MD5 415bc882f76a7b3e971dc0f091c9e07c
SHA1 37e4314fdbdd38a097d7371dbcd9f06f0becbbcf
SHA512 2ed928ae36c0e8cf7573c495786e80c6025f58a0972de548bc11eca029059e6c8bf7f7bf498e5cfbddaf40626fccbbd859d43a65e18b3a059b1ca0c59fa4a28e
TLSH
T16041A9DA2E187422AF814F805874CB353D7CF1D49988505974FA84E36495BA46D1A85D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 0e88a5f0db492c6d183a9c530238a34b60ddf8e643d59bb067a8bed73f3b04d7
MD5 ca45821f82f18cbccb347fd3d2edbdd0
SHA1 3c0bbcc22bc271a84cee8414221d42d021d221e3
SHA512 85a9f6c20f07e9bb0ba9aeaad0ed6dde142cc456dd82f56db61ea2b8b1f6ac821d6921fd59aef0530ac8cb3ac1ce2ba85a4108c3780fc861e81c4090bd7a1425
TLSH
T13ED0951715F6C9553B53DD044DD0D170B423AEB773D36C1AA48FD0D65800D2D3F0A215
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 177KB
SHA256 7d0f6df5f36e062a516cedcbfd4ef40616adcd767ec1d8b14ef85961122408d2
MD5 1a266210e74b768c7c5f1e87c3c04556
SHA1 947e95122d39b61d8fe7f803fd9c4114a1a41978
SHA512 bb11fb4b14ca0ced323712922f53d748347141fa1c80f76edd0417413b6deaa11bedd3e34722f29e10460e86a6db615830c8d5bfce0f088c3194ae9f805b0a97
SSDEEP 3072:MHlcm9KPx74X/pCh8ycyMGBeDvu6tizLF:u+AEx7I/fcrBeiqa5
TLSH
T105043C645C7BB6A35D4BCE524CAEF69612F591D92812732ABE347E005C13ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 d47f36305c57a449d1209353c65cf916990d10c10bbb8dce40387ad034ead9fe
MD5 da2321ede03f4a5aa95d46060ca64ab0
SHA1 426f6b6524e6e41e03b9d2897076c8d0a2fdfa43
SHA512 d30bc6ed1e2abf680fcd8a7902f8e931ba1b7c64f3d794e9ea55fdbad2282ee766386816ce8dd0cd5782526e61b61d5eb17817d8affbb31ba58a43724ef579dd
TLSH
T18B1125C35FB5E19045F65765C6E4D5313D78708638E938C15C939842245772C670943F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 05f55cd741ebf04fa6143cc1279f95b44c856f1efbd611312ea2cd1793a0b673
MD5 c2f9f75d444f05b448f600f9f498972f
SHA1 73efed1f442da35a14c31316406bbd1dbc14b9fe
SHA512 533226cb07ebc8d0f7ca310bd09c478deb65bc93d0dd6a1806c03d2a1bb475c31baffab1ca3a7980feb230b7d67a6905441efed6fb02e8d99439a878da91ddfc
TLSH
T15141E7EB6B1A3968BF469F866E79CD355C38D4B981800885B9A3C4DA10CE7C16E0698C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 11887b034239352ee33d2deef9a5fb4a01aae1f44e136e67e919e89b3bda2939
MD5 2936e423e4c689507cc3395a7e1c9d33
SHA1 187b0b165230975cf9171b2bf2e5a38f9fccb3f4
SHA512 92bd0c73a0d9d137eb542d3018b861beee3c87368e32395cc47e221aff208cda204557672b43d6af97ef36ffa7c4bc421a3c3729d2742f5498bcd41a9018ec1f
TLSH
T10DC08C1C2EA20A0AF2A8837D82C139039B208141E2458F251AF16A08CA96B262C38C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 d3027952ec6173db2a5b19fc332f86e6e3dbcac43b7effd9df15315a40df1172
MD5 6203cdc890756fcad72c382d87928450
SHA1 a8eb72c7035d3d863cf024f9a92630b4e91b2512
SHA512 6a97c57a83a5e326fa39756a0f4ea7a90e3eece0bd269df1c95105654bfa52269a54e84f9c6a705f370ed4eab02a35a517c57e1cde1555ed0e9d43bf56e1d99b
TLSH
T174F05C2C1AFC801DE436DBB98ED5E6E75C16F227280405E90A914B099A02F451C5053C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 1d507bb7cc1111e7f3c62c2a97400656151c18726f1c9894d94d8683eac1f06d
MD5 24f6ce8feb9aadeb823afd51c7b7cd3a
SHA1 9da29afc2f89837ce13df7c1cf74eb0173e43b80
SHA512 53e88a8177bac4f4a59dcb1c6b97e6d7966ba7b1fd54f1d123f846ef4f05d148765b11c320d7ff3883b2925f3c0e6825663bfba5122acdf07ad53d690af346e4
TLSH
T1B5F0682039FB903BF433AABB43C571B1096AE30674026BB62B7023042F24F206DC3511
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 4a49a41eaa1ed8866f7db4bba3d064ba79b6655a092a166ffe3c52ba8845ea2c
MD5 e51b1a005ee515d4746b30faebaa5f74
SHA1 13ac1a91e07c0811083f2b085224258b094c1136
SHA512 e34ff93b222ee68b7aece7069338ef0bd99dab8650e26b69dc3f6f5f343cd3d5d49932d5d15ed0b00559ecc27922984491ca1c6e8d4f764f187e7bc129274c0c
TLSH
T158F0E50C15B8800EE4B2E9B8D2D565F6AC35F2096805C6E707E6114A9E17E513E62ABA
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 d3d584cfb5b87e01a9efc4626c2b15771f146ef68e9f9f8bae07be01b07ca492
MD5 956ed0eabc65c492474eb4c8f541b16c
SHA1 7815406a0b6203053cf6ff64ac2668672a5fadd3
SHA512 6c760d8a54680b53c6e9171fba11fb17e58fc91fdb28bd7ab275dca56bc8755edaf64de74df44aff212fc3e6acb4b2e8154b21154a8e2402b41bc21aba50e20f
TLSH
T121D0223C3359431DF0B0823846A645C27FE21481B9C1972D0BB3230D442EC820DE1C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 65f58d09d8847299e4037aa29780b02961b88a24ec0028ec887f525f2b25a1a1
MD5 6031fb8a688a21069ad147ea6df02dc8
SHA1 08101985b0814ee41a3868b222f1d7c773902766
SHA512 117ea55bf3cf02f1780816df95bc8f4e4fb2d1d34eeccda5ecc32a2c21a058780b40c8a3882942e3f83c463ccfc5fb0b4f1c2a923425e821d3f6c1c280ef4e27
TLSH
T198F0A32416D7401EE231677549F553DFA826F3523409C56516E91709EF53F407D12534
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 f5c84bc04cad4e0b3edb3a83967c03fc6ac85fb173bd731d455cabf9e7a4431d
MD5 06f82a9958ff22b95296d26b566447da
SHA1 248ee451c2087a07bde768ae634fc29f0a691813
SHA512 b822c7bdbf1e87333357e65238edb833c91a2093e83868cdfcbcf25318c2a4d67d2c91ea1e66e2c2a9453b386ef08935dcf5a36e469c1ef80ac2dd42b995cbbc
TLSH
T1CAF02B3535F7115FF262DBB812E052D59A73F53731082EBC7BB046095D05F40BEA2A29
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 354bb84df7cb965c47c74abb55cf1f1e07de9668e3dd974659fbfc0b6bd834fc
MD5 7f44c93575c45534553ffa3896636b54
SHA1 3fc8c98392c39825e1a6c1aeee0120fe2c048895
SHA512 2d8205839aad654805203d88a54f00d3ba58e3c349137d508787b74a2d56096e14275230de0e2188739695059e2f211d344f50b7d6d306b4274d800e489dc2de
TLSH
T180C08C1C16610607F2A883BA02C239839A208110F3819F1126B12A58CE64F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
Size 4.7MB
SHA256 a26f5d23dc4857152846dbe542d93420e727695680dce6888639fff5d41d4897
MD5 e126130f55ef3b1cdf0c44e474b15281
SHA1 bba08ecb9371b363caceebec1767ceae273214ae
SHA512 cac9c3da2a3a584437721ef73f23e14096bf443b0691183d453c14a96933889c7d67cf28e662896b9fb9d9076c6306677c95c58d54b55998dcc6fc33c1e19b24
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEa9PaScs:+0s420/3uzufNDPQnSZGiRSP
TLSH
T1963623E4786E26EEC01A1CBA8E52CE6275EC577187501CA7FFD53EBA0454DD20722A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
Size 5.0MB
SHA256 d5a20aab075ca89d3aab41251f570a8bc8dc3993dbd2e3189b22fa74b508117a
MD5 0a5c97e3a83fa85b244ff8d33dada6a7
SHA1 d97bbe7d25dfe4d40c3846d0ad717c804c3490c6
SHA512 2ae02ee77c47c9e31f3b7a0d2c2c2296d85c8c18204300b0322e4c4a5ca662b5c6707c1c141cd7756d4cb8f7d963bf3cc09bc34c13e90bfb42f4264139169977
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEa9PaSc+e:+0s420/3uzufNDPQnSZGiRSC
TLSH
T1C33623E4781E26EEC01A1CBA8E66CE6275AC577197500DA3FFD53EBA0454DD30722A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe
Size 4.8MB
SHA256 968c05d7a4b573c594135643bbb3ed53c2c02fb31b621724b7e0772ebee76d52
MD5 029b096601d071fc19e87ed0538a9ae0
SHA1 31c0d9fad0a36aa135058ebec69bcbde230ca16e
SHA512 8fa547162c9545269e765f2f6bde32936828e7d01f43abfe10d584da7543c3cafaf8f5992d1e4c2f763ed345546d3c10c9c0f5c8c4897c0d0db5368833b71a46
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEa9PaScz:+0s420/3uzufNDPQnSZGiRSq
TLSH
T1D03623E4786E26EEC0191CBA8E62CE6275EC577187501CA7FFD53EBA0454DD20722A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
Size 5.4MB
SHA256 c32468a7fddd55d21db99b2003667afd845eaaa3fab3bc0ccf2bb7c5f675accd
MD5 e10e5bedc1a17d272be59884ec5bb757
SHA1 dfa81379a6e70e0f279ece508ab36af52614cfe2
SHA512 672756477be2cde9d00c3c3873348ee59e9b5fbd9f66574943dcae0c94fd20d05bcc6c345fa4d09baadf75cc25cce1e0d00ac83d5d2c74fb23b6cd6efad96453
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEa9PaSc+pmFvGr:+0s420/3uzufNDPQnSZGiRSN8vGr
TLSH
T1314623E87C1E26EEC01A1CBA8E628F6275AC577197505CA3FFD53EBA0454DD20712A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\DesktopWindowManager.exe
Size 5.2MB
SHA256 efcc4958cdc243fb4687036e9d0c9748d659a84cfdff3912e23b13f9a03fd22f
MD5 03253bd3a20b2c5f97bfdfc11993f61f
SHA1 4e71aee935aa579badba5cb46a6715ad86875b4a
SHA512 e557d11a1153affdd9475239beaff31b0236992351c45cca86d661bb43109cfd53d14db088e4cd779fcbb01c3b4e98dc7312a97ebfc395dca2a6edfba957b629
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEa9PaSc+pmFL:+0s420/3uzufNDPQnSZGiRSN8L
TLSH
T1D94623E4781E26EEC01A1CBA8E66CE6275EC577197500DA3FFD53EBA0454DD20722A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsInternal.exe
Size 4.9MB
SHA256 a74e353e1e5b1e72b3baf67660633b885a089c04de24bb8553b0a8575da7fd74
MD5 944afefac368f481bfad086561257b09
SHA1 78456b9804836c7ff5a2f8ead69dfead4041dcf2
SHA512 6a3b5dfeb0d9e0ec77a23a0020f723d915a9300f4715ffa3b4c07021261c38d52091fecc8cbf16f63ab3e9b1672fa384de2955ee6fcc17a6ba4c8f90a3803301
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEa9PaSc+1:+0s420/3uzufNDPQnSZGiRSZ
TLSH
T1603623E4792E66EEC01A1CBA8E52CE6275EC577187501CA7FFD53EBA0454DD20322A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
Size 5.5MB
SHA256 cf4a2223619643975b5871eb7c115d05086fb66e02be06236eb3982e2736a541
MD5 4a89bba287dd893cf1a0f2f55b014894
SHA1 1f1fcf6a2800718e78fe05953687ee8a0178d27a
SHA512 22f40a43c7537b512c6f4c57fb61149cfed5663344b0a9a74dd1fe323f9649c109272885cd4a9ccad67ab1a7330daceb0ccb71904ab9a90ac08892d745e860f4
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEa9PaSc+pmFvGLGoqZ8:+0s420/3uzufNDPQnSZGiRSN8vGLBy8
TLSH
T1D24623E87C1E26EEC01A1CBA8D628E62B5AC577197500DE7FFD53EBA0454DD20712A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe
Size 4.6MB
SHA256 1dff287c6b25d65861c1eae9da62517310fb74ee0b09ef5a7531e7421cafdd95
MD5 ea6d07913f0b8e4b0b663220cc259d90
SHA1 66d4721223f3d909468526122bfeae119239e5ef
SHA512 78e22cae1d09795b790ae01a5467533dc4870f6a87298ccd4d7781ed7b897fd72be7af8ce2cd09d6d0d809b441b820ba288b789fa2f4ea6cbc8ec42ce8031058
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEa9Pa6:+0s420/3uzufNDPQnSZGiR6
TLSH
T1802623E4785E36EEC01A1CBA8E62CE6275AC577187101DA7FFD53EBA0454DD20722A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
Size 5.3MB
SHA256 9a9dd62bc55ba440a794af374c1f8fc2d0ca9f4f727ef6ed51a89ad421d7ad2f
MD5 770c83d70b673d0d699208d0dd15eedc
SHA1 a2ce064012e4a314ad606fdd541753f3dcb65dda
SHA512 3c2c14978bd325a46ddd2fd35b4e81f151af7a75950d3489608a549da78e0393f7d4af506560bd893d26b43d16df9251bd743af4971065b03e75fbf2b529f5e5
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEa9PaSc+pmFI:+0s420/3uzufNDPQnSZGiRSN8I
TLSH
T1374623E4781E26EEC01A1CBA8E66CE6275EC577197500DA3FFD53EBA0854DD20712A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
Size 5.6MB
SHA256 104ef0e2e5976a942f767c578c1b7765ae5eafa26e7f4f61b8257934b29c28e0
MD5 9bf494af103384d0d1e157329eada6ca
SHA1 edd7465c4af6a6213373f6a5d488f982e8a41517
SHA512 521c6c2a418b7b6e14547c86e34c7a6848d8834f21a0cf9f5bad683f1c712d0c4a277b62d1eea0116b283d0b92855e9c12ccda5ccd4c9b7c5f8d04919cc5a556
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEa9PaSc+pmFvGLGoqZoE:+0s420/3uzufNDPQnSZGiRSN8vGLBy/
TLSH
T1225623E8781E26EEC01A1CBA8D628F6275AC577197504CE7FFD53EBA0454DD20722A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download