9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
Size 11.4MB
Sample260916-wnbadstdpe
SHA256 9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212
MD5 23ea8f5283717e928728b928b0331cd9
SHA1 eefea23fc02bdd04a09fb2ee8253b741982f710d
SHA512 dcfb148707c2a5c722d126d4980996e5042a6fe7c42d24af478625197090d4ff9231b51be646deeb0a57c6cb93066466f698711477f4641867241eb7cb4a00a1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muqo8+nU:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEk3
TLSH
T1C2C633DA785F5AABC21E5C798D16CE7279BC47B187688CD7FFC53EB60800C521622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	WindowsInternal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	WindowsShell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	WindowsShell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	UserSession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	WindowsHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	NetworkHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	RuntimeBroker32.exe

Deletes itself 1 IoCs

pid	Process
4476	WindowsInternal.exe

Executes dropped EXE 16 IoCs

pid	Process
4476	WindowsInternal.exe
2544	WindowsInternal.exe
4528	WindowsHost.exe
3396	WindowsHost.exe
3888	NetworkHelper.exe
5016	NetworkHelper.exe
2396	WindowsShell.exe
3364	WindowsShell.exe
4576	WindowsShell.exe
1740	WindowsShell.exe
4712	RuntimeBroker32.exe
636	RuntimeBroker32.exe
3376	UserSession.exe
2296	UserSession.exe
4376	RuntimeBroker32.exe
5096	RuntimeBroker32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\UserSession.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\RuntimeBroker32.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsInternal.exe\""	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsHost.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\NetworkHelper.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsShell.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\RuntimeBroker32.exe\""	WindowsShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
91	raw.githubusercontent.com
136	raw.githubusercontent.com
55	raw.githubusercontent.com
88	raw.githubusercontent.com
101	raw.githubusercontent.com
104	raw.githubusercontent.com
119	raw.githubusercontent.com
128	raw.githubusercontent.com
44	raw.githubusercontent.com
70	raw.githubusercontent.com
74	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x00070000000243cd-11.dat	suspicious_telegram_bot
behavioral1/files/0x00080000000243c7-83.dat	suspicious_telegram_bot
behavioral1/files/0x00070000000243de-134.dat	suspicious_telegram_bot
behavioral1/files/0x00080000000243df-175.dat	suspicious_telegram_bot
behavioral1/files/0x00080000000243e0-211.dat	suspicious_telegram_bot
behavioral1/files/0x00090000000243df-247.dat	suspicious_telegram_bot
behavioral1/files/0x00090000000243e0-281.dat	suspicious_telegram_bot
behavioral1/files/0x000a0000000243e1-312.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NetworkHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	RuntimeBroker32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UserSession.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c0000000100000004000000000800000f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5056	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
5056	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
5056	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
5056	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
5056	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
5056	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
5056	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
5056	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
4476	WindowsInternal.exe
4476	WindowsInternal.exe
4476	WindowsInternal.exe
4476	WindowsInternal.exe
4476	WindowsInternal.exe
4476	WindowsInternal.exe
4476	WindowsInternal.exe
4476	WindowsInternal.exe
4476	WindowsInternal.exe
4476	WindowsInternal.exe
4528	WindowsHost.exe
4528	WindowsHost.exe
4528	WindowsHost.exe
4528	WindowsHost.exe
3396	WindowsHost.exe
3396	WindowsHost.exe
3396	WindowsHost.exe
3396	WindowsHost.exe
3396	WindowsHost.exe
3396	WindowsHost.exe
3396	WindowsHost.exe
3396	WindowsHost.exe
3888	NetworkHelper.exe
3888	NetworkHelper.exe
3888	NetworkHelper.exe
3888	NetworkHelper.exe
5016	NetworkHelper.exe
5016	NetworkHelper.exe
5016	NetworkHelper.exe
5016	NetworkHelper.exe
5016	NetworkHelper.exe
5016	NetworkHelper.exe
5016	NetworkHelper.exe
5016	NetworkHelper.exe
2396	WindowsShell.exe
2396	WindowsShell.exe
2396	WindowsShell.exe
2396	WindowsShell.exe
3364	WindowsShell.exe
3364	WindowsShell.exe
3364	WindowsShell.exe
3364	WindowsShell.exe
3364	WindowsShell.exe
3364	WindowsShell.exe
3364	WindowsShell.exe
3364	WindowsShell.exe
4576	WindowsShell.exe
4576	WindowsShell.exe
4576	WindowsShell.exe
4576	WindowsShell.exe
1740	WindowsShell.exe
1740	WindowsShell.exe
1740	WindowsShell.exe
1740	WindowsShell.exe
1740	WindowsShell.exe
1740	WindowsShell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 2544	5056	9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe	93
PID 4476 wrote to memory of 4528	4476	WindowsInternal.exe	96
PID 3396 wrote to memory of 3888	3396	WindowsHost.exe	99
PID 5016 wrote to memory of 2396	5016	NetworkHelper.exe	102
PID 3364 wrote to memory of 4576	3364	WindowsShell.exe	105
PID 1740 wrote to memory of 4712	1740	WindowsShell.exe	108
PID 636 wrote to memory of 3376	636	RuntimeBroker32.exe	111
PID 2296 wrote to memory of 5096	2296	UserSession.exe	116

C:\Users\Admin\AppData\Local\Temp\9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe
"C:\Users\Admin\AppData\Local\Temp\9af3088e66991992b986548f325fe2548e92af7e898d83be6186d54cad45b212.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2544

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe"
1⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4528

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3888

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2396

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4576

C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\WindowsShell.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4712

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3376

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\UserSession.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5096

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 2f581ef61fd84cfd03b7259c38da8540ad444099f615f3100836b7a7ecf8d7dd
MD5 9e5c85523a2e99742fe6ba5a1ef01378
SHA1 b40170b2a56a74ba6579e1efbc594d7407cc77b3
SHA512 a7dd1e9d1db948395e7795e20b549412565e74c439d1956b0b403fc92cfb16ea6cc9d6384d5015c6ab1d3f2391b962f50d4f6c089f23a50636bec2df93c2b521
TLSH
T1A4E07D075B2C8989B619892107C6047F7831714F9CA2064F341D57C8CE4217F5E0B251
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 46c23c3315d8f9eb7169a788845d3b07063569e67821c61b0512a354d861c150
MD5 9d6c68669dfba72b907c7ed8f16c29c6
SHA1 e74fe3f27f39d595aaf7ab354ebdc932bb02fcab
SHA512 baef2d79bea01dc9214af5974451e56c61ee0a300b5fa13cd9540d907868130349bf183e671539f107210f4537a2146e7197d3aa1819d471fc5a24078e7fcb20
TLSH
T181D0C71723F9A8922B2B9D0045F082203012367B23A2A9F0204A952AE800E799A06B08
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 176KB
SHA256 c5db0a7e08c57ff6e483620335661519d0f73a82c477c0253091032670a2a65a
MD5 ce2ef07200f5df45b2dba68226a51423
SHA1 dffc6c1a648381eab319d8b80a265a4124ab94d1
SHA512 4bfa9af0134b8eb30a663b5e4e419bae2f442dac9e984bb2bd5688a9fa86fcf5c49625984b170f15a5eda991b443be867ae4124163110aecc3dff096da0f7aa1
SSDEEP 3072:rOe/Kom743/ECq09ff7IvjgvnFt0xVCb2:KAtm7A/htMvjobOgq
TLSH
T104041A646C7BB6A35D4BCE620C9DFA9616F561D92412772ABE347E005C03ABFCE17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67F6625BC22310D5C99DDE12020DBD90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90
Size 584B
SHA256 6d473796c6f906f567e4837a54161097d0bbc0f662ade87705e46237d7c1160c
MD5 dd53e71a76a3ff61d16963c00af0e241
SHA1 4b8da97d8448de02f98f1a09019544e43519554a
SHA512 97eb6cb088bf81a51ef00bfedc8baeafd8219b20fb9522b29ea857f3de2e65a29df887065456eacce77a4f5ebde8ceeedbddfcd16d21760b68c3de53dbb54b5b
TLSH
T1C1F047721A183118EED0FF6851ECE763AC343671A8C37A1165DFD4401811F50154148F
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 979B
SHA256 2be89f86a7c292a38c9e84d47be96caf58192b985969b44578d7fc62715658d0
MD5 af9e39b50201061de6d0bfbea9d95b79
SHA1 1a5acc98b38b351fd6ac67864bb7c99f63868fc4
SHA512 0ec5a0ef1026a4bf25a3a701dc3a26fecf911297ae5773a62c26a7aa6721a8f58c84a1bfd8acb5e45e04c3cd402c48d021bd84b544d1dec6675c4dfac9efcba5
TLSH
T1DD11E183AFE4A0909AF366B1DAF8C6357D7864C66CEA74D12C81C896205A71D6B0903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 16fbfa81942c164cd520bb40ddce4ae5eb957fdc89fdd209b9b77e779d0a3968
MD5 7f2be20532d2661e30ea02719a3a5086
SHA1 83fe5d5874b91f13261f949a906655e571015d7a
SHA512 9b1ddab9b5869ab636790211e4a49624006a879125244336d0fc4823b0e4e686599d123eeced6b41d41044806ea870afbce168fe86022fbde51119d3b2c7f36a
TLSH
T1A441E7E72F4674A8AE458FC9297DC57B2E38947691841D42B8B7C8C205DEFE1584B90C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 faf73f96ba6129f7bfde50e59b6de70838c156ad350a6783e085ec4c20a98be0
MD5 5bb6e4af44f7bd7282427ec7cda9734b
SHA1 88ec7617b1a8c5ebb50ce86d587e0e166a3536dc
SHA512 bfb6efbf2baa3c855d6047f94ee3cc853a1b184e7fd2876f4357a3991d070678f83d3822771f8e14849344b33ea1aa5c9580628046ccc22a96a48f38325ae4a4
TLSH
T1B1C08C1C1AA20A06F6A8437C52C139139B218102E6828F051AF16A08C997F262E78C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 799989187c9a56ff27871603a18a8a01af61c18ae3a5e9879cbec544bbd399b8
MD5 0b5d2351b36e60bb349f91231376d434
SHA1 de8f9f4f9cb6609c1e24e1d58c174332b5cc9c45
SHA512 27f110c9fa310034933ed565f5da3d7b1f6d126054803aed7d7c1ee372eb88585e0d0eee2a08e83da57a6a63360e69267165e09f00f4b41e5e997ed98ae2e175
TLSH
T11AF055384AFC816EE033DF7A4BD9A3E2AC19F122380841FE0A920B489B01E009CD2128
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 f7c9446a33325b73c718963f8d09a75cb14e0a7ef7a46a3de41ddd5ee8ef8303
MD5 1f6d1aa338bd7ea30f69d76ef1016ffb
SHA1 89d353d2f41e4d9554e300a32d5b7fcfd9202edf
SHA512 10725a66e3e6b4bee5975d20cf7af9f75070bf88fba5929b2695ca246bfeb548801217f3c050adeba9e012d475a644aba5b2c3bf6eb5e1b7cfdb4247f14eb401
TLSH
T12EF0AB1428FC403AF033DC7EC3E525FAE93AF00A7C0A8AFE069B05019608F011D92A2F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 a24fb4d3529f330e207ad151f3f7c144af1609028728a0b9f17c32e823976f3a
MD5 234c6991f87a1ed3ec9bf49e869d4b9a
SHA1 5ee5fdc31276d0d5688a78305feb1df9e1642b0e
SHA512 43f98420d5bf73a78162d177d26eeefbcf8f7d64842a55255dfbf3e180e96bc12da4c3d1dc9df2615f3d9d0603afdb4f5d57f869a85e75bb9d093c30b6419fdc
TLSH
T100D0231E1353C353F120C17C51F48552B7E02512E95157041FE6154C481CE41B611C0C
MD5 SHA1 SHA512 TLSH

Submit Download

67F6625BC22310D5C99DDE12020DBD90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90
Size 230B
SHA256 22b924bfc58172dc1966cfa15ed7e15c16a61a19b5565e34369498a1758a66af
MD5 d5cbf3779893d9ff7ddc45af8455acf1
SHA1 0f26a4306a365a5a5a1e6b66410cdf382bbe18a1
SHA512 1cc295c5eaaa7e6c78b406de9b5412ca7fb43d244f6fd26aeef615ab266d14222b31fec8633f3207ea2d66f3d2d7631b0cb994bae6cb55fb50ce2400c6c1e09a
TLSH
T17BD022582FB0961BF002D13FCC704A111F747010D101C3490B2004484CBBF062D31E02
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 12694183e39d99c60000c31ebb773f722e93cc64a0482f2ec3b9f9104d1534c3
MD5 914db674f45e5d99c26e143b1ed200fc
SHA1 58918742611268711753e530f92652be9021f61c
SHA512 396112971c4146d4ddfb2340690eceffd70ea3dda3b9eba781949ea86469cc2cb2117ed39ee8bba0f1e14009e26584ccfdbc7176e2af4031cf99b534bc524fd1
TLSH
T19AF0E52416E2443EEA716A7887E457EDAC0AF7673400D9A52BA2460AEE17E015E22939
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 4ab85a28fc0b399c4e0fc582d8be056885b76680e5685ab556767c3501ef2342
MD5 a3e6bccc78c7049292588c7ea681a748
SHA1 b6bebce415d06ec436e362902767cc87e93ed3b9
SHA512 b5b2958be9ead717a591e5aee874e045017ebbc7655e5b29978bf8a1adc3d539dc9dc5596b77270180cb91f6dcf09a613c43c2154d7cc624704a3d741048cb79
TLSH
T118F0AB3424BB125EF232D67803C520D9A263E13B320826E92AA3030A2E49A416560D2E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 a13e0e5d7ceaeaf9fcc8e7944c5fe7fe5f8a3a374d5c1b91cbf431c7adba8c02
MD5 f771f9de6cdc480e9e99d380025505d2
SHA1 049de846b8a171ae44e296412ecaf11a3900d610
SHA512 ce3e4973cb1d623a559186575dd314dbc4cb3e0ce6f5af25c9c7678345766fa35659b3b209e62c71f118b63728df5584d70f0816c1b5996dae8c42048c137b21
TLSH
T16FC08C1C07610607F6A883B802C229938B208210F7819F0526B12A08CDA5F1A2C74C29
MD5 SHA1 SHA512 TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
Size 11.7MB
SHA256 1277edf6da4a85640aa92b1a257e366fdca67c4d187e977388a1b54c8976d815
MD5 1d7e51accdcc98d35c2ca444968c29ae
SHA1 4ef918240609c570dc09928224e992faa95a3c21
SHA512 adddebdbfdd7f4e2235ea68117834e5dc12eedfe72ca3e3d2b17b153610fbf0a5175b344e97d573babb7f50fbab907c2f39ea0eba8d7809bb6391c71582c7860
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muqo8+nw:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEk5
TLSH
T164C633DA785F6AABC21E5C798E16CE7275BC47B1C76488C7FFC53EB60840C521622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
Size 12.3MB
SHA256 b3952fa7477e8b4817f8565ffb0bec8c5d555bc860778c278e3f37f7934c2135
MD5 813f60c12d2d59b5bdcf725a6a478d58
SHA1 a7e214d6384b94656b40d570440583200feb98de
SHA512 ad76821745787b67051136a7202a0feae9ac0c66bb2cd6d662d2ad82f1dacaaae0d76244785cdee5eb3489ef983407db0f067a1635681ecccf6d6618e9d3438c
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpoZlT9WL:4JwMrcMGL9g8RWL
TLSH
T163D633D6785F5AABC21E5C798E16CD7279BC47B5C76888C7FFC53E760800C521622E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsShell.exe
Size 12.0MB
SHA256 76a6807f4cf6a9f89ae28f6cfaf0f52f1d18681a9f7a480ddde9c18004578257
MD5 a9a679f45e60fc68b7f012778a2e11fe
SHA1 0fcc65bb589ff34fb304e6366e4b9f3b264b96f3
SHA512 ffb54683a829137d0beb4a2193fb97b4fd9478a9ae811bacae8e258ea62f21a0380c5eb272f74c861d1748f57c124755a56507782257fd289ee6ae3defb2fa0d
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muqo8+nA:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkl
TLSH
T18BC633DA785F6AABC21E5C798E16CD7275BC47B5C72888C7FFC53EB60810C521622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
Size 12.1MB
SHA256 5a86bf9f7d7ae70aae3d02c71d2e1615c9e08eadba5fca07c66480f6fb116102
MD5 5e1b6a7c7c6042f03f8ca3e65c3f933c
SHA1 ab2e06b576f9144ef9dd36a49408892fa5e7f24b
SHA512 92508295799339f0dc6d5413a9e9c90e9fde3cc0a7199f20a0b4a8049b2e0a40cda289e4cd864914d17296a57d4764d7bf2121477f1c04a35a76430300d0d7bb
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpoZlT9Wq:4JwMrcMGL9g8RWq
TLSH
T1D2D633D6785F5AAFC21A5C798E16CD7275BC57B1CB6888C7FFC63EB60800C521622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
Size 11.6MB
SHA256 baee6ca4499e93560e96b5ad746f11ddbff0d4dcd72813fa66f7baf8ef934aba
MD5 185d815121a56fbce6f764bb2b9b3ae6
SHA1 a7f0617cd7937d9e5d287876631583ce4cc73df3
SHA512 8c7061ddb798ce39b50a1edd12c64a144f865eda042f3cc8ee8000cc6dd82fbde739c6afe77eabd92e16179b2df48240c9cb86e66ab90ae2aa56e6540f888746
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muqo8+nc:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEk3
TLSH
T12BC633DA785F6AABC21E5C798E16CD7275BC57B1C76888C7FFC53EB60800C521622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\UserSession.exe
Size 12.2MB
SHA256 b6ac4b6a57ee0593af030deb1da5e95995a2e32a815ee6f1d5ca0a68244f3045
MD5 ca25bf15c3c4f5fc4f1f8527eaeeabd4
SHA1 0edd4fb1633338bf73073c55cdcf78a4aee2a77e
SHA512 d19825486d10b7dd921ded64118fa392da8d692fddce017ecb4994c10c758dab6a8f3e5577e52208203c536984259a9c42693fc05485027d20c7b2ad788e696c
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpoZlT9WL:4JwMrcMGL9g8RWL
TLSH
T197D633D6785F6AABC21A5C79CE16CD7275BC5BB1C76888C7FFC53E760800C521622E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsShell.exe
Size 11.9MB
SHA256 e7869baf274033bad9ebdca5c18cf130c836ac853786254171b3b9dbf7b44b5c
MD5 429bc293d3d18f352e9d874a44d51ab0
SHA1 aa03c6255af4f68d298a0e9942b3856223b098c4
SHA512 3247cf53d50066f5fa1e7bf7a1e004b59580768401cede84b4ed6154e07db4a28207010ed1ee7b108e789a3302ff944ce35a1e17bd34a4525a83ea44495a81aa
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muqo8+n+:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEk3
TLSH
T1E3C633DA785F6AABC21E5C798E16CD7275BC47B5C76888C7FFC53EB60800C521622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
Size 11.5MB
SHA256 05db23c945167ae3754eb25b94c58b81abd39bac04954599f1135e4707fd3f68
MD5 5c80484a8ad82ee6569bf3867d12927d
SHA1 708e02ebc3c671ebab2cb781ce9f2644fc7a19da
SHA512 a882ab831d5d059dfb4608b51d91d8b7ed7ae2c1e927a8e695eefd53b5705bf0a7b7c73f37ae416876fdb4b3d780d41d6cb1e826862531972ffdcf5863fa8b8d
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muqo8+nX:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkC
TLSH
T1D7C633DA785F6AABC21E5C798D16CE7275BC57B1C76848C7FFC63EB60800C521622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download