fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
Size 10.9MB
Sample260922-ql7ypafc39
SHA256 fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c
MD5 39aa02fccfa6fa51900418e8897b09b4
SHA1 8b3e3a8db6ce2ae3f21eb1da20397a8c80baa2cc
SHA512 e67b4a2d264fc29f08af232ab8ce88390083fc529fafe04f2f529920d746ab49529935158f2cf6710246439643227ff583576617bfa4c294dcbe949861dd4951
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpFK4MxW9QyrG/:TDpbgBr/4QAMQMrEGRONY/4VLM3qIbKl
TLSH
T128B633AA745F56ABD10E1C798E068D6236BC6BB1CB649DC7FFC57DB30840C631622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3780	DesktopWindowManager.exe

Executes dropped EXE 16 IoCs

pid	Process
3752	DesktopWindowManager.exe
3780	DesktopWindowManager.exe
472	WindowsInternal.exe
4392	WindowsInternal.exe
3192	CoreSystem.exe
4780	CoreSystem.exe
4424	BackgroundTask.exe
5852	BackgroundTask.exe
5160	WindowsHost.exe
2992	WindowsHost.exe
1364	CoreSystem.exe
2628	CoreSystem.exe
5068	SystemHost.exe
5688	SystemHost.exe
5776	InputService.exe
4152	InputService.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\DesktopWindowManager.exe\""	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsInternal.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\BackgroundTask.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsHost.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\CoreSystem.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\SystemHost.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\InputService.exe\""	SystemHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
54	raw.githubusercontent.com
64	raw.githubusercontent.com
67	raw.githubusercontent.com
76	raw.githubusercontent.com
87	raw.githubusercontent.com
1	raw.githubusercontent.com
32	raw.githubusercontent.com
42	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c5eb-12.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c5ed-77.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5ee-113.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c5fa-164.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5fb-208.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c5fe-243.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5ff-276.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c600-311.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2412	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
2412	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
2412	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
2412	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
2412	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
2412	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
2412	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
2412	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
3780	DesktopWindowManager.exe
3780	DesktopWindowManager.exe
3780	DesktopWindowManager.exe
3780	DesktopWindowManager.exe
3752	DesktopWindowManager.exe
3752	DesktopWindowManager.exe
3752	DesktopWindowManager.exe
3752	DesktopWindowManager.exe
3752	DesktopWindowManager.exe
3752	DesktopWindowManager.exe
3752	DesktopWindowManager.exe
3752	DesktopWindowManager.exe
472	WindowsInternal.exe
472	WindowsInternal.exe
4392	WindowsInternal.exe
4392	WindowsInternal.exe
4392	WindowsInternal.exe
4392	WindowsInternal.exe
472	WindowsInternal.exe
472	WindowsInternal.exe
472	WindowsInternal.exe
472	WindowsInternal.exe
472	WindowsInternal.exe
472	WindowsInternal.exe
3192	CoreSystem.exe
3192	CoreSystem.exe
4780	CoreSystem.exe
4780	CoreSystem.exe
3192	CoreSystem.exe
3192	CoreSystem.exe
4780	CoreSystem.exe
4780	CoreSystem.exe
4780	CoreSystem.exe
4780	CoreSystem.exe
4780	CoreSystem.exe
4780	CoreSystem.exe
4424	BackgroundTask.exe
4424	BackgroundTask.exe
4424	BackgroundTask.exe
4424	BackgroundTask.exe
5852	BackgroundTask.exe
5852	BackgroundTask.exe
5852	BackgroundTask.exe
5852	BackgroundTask.exe
5852	BackgroundTask.exe
5852	BackgroundTask.exe
5852	BackgroundTask.exe
5852	BackgroundTask.exe
5160	WindowsHost.exe
5160	WindowsHost.exe
5160	WindowsHost.exe
5160	WindowsHost.exe
2992	WindowsHost.exe
2992	WindowsHost.exe
2992	WindowsHost.exe
2992	WindowsHost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3780	2412	fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe	94
PID 3752 wrote to memory of 4392	3752	DesktopWindowManager.exe	97
PID 472 wrote to memory of 3192	472	WindowsInternal.exe	98
PID 4780 wrote to memory of 4424	4780	CoreSystem.exe	102
PID 5852 wrote to memory of 5160	5852	BackgroundTask.exe	104
PID 2992 wrote to memory of 1364	2992	WindowsHost.exe	107
PID 2628 wrote to memory of 5688	2628	CoreSystem.exe	112
PID 5068 wrote to memory of 5776	5068	SystemHost.exe	113

C:\Users\Admin\AppData\Local\Temp\fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe
"C:\Users\Admin\AppData\Local\Temp\fc6183bbbf2e71e3767a506f2fb0bd994a031dad09bd0e30e17d45fb3592593c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5572

C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Temp\\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4392

C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:472
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3192

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5160

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1364

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5688

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemHost.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5776

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 1422d2722bc0fb5571340098faac4c367b48224c45605ba3cd51b41d0642de52
MD5 b8c55abec5a8cf7f50eea4dd8f4f9d57
SHA1 47e610a5845b481d5ca4d92a79ed5ee768e258c6
SHA512 80ef6aa95ab325663abc4953cc7534c01b5332cc7b6803c1f2c6e3770f21715ffe408b27b4fe8b4d4a367768cf6a3016cd0071ec6eaf3ef338e79afb30954fb6
TLSH
T134E07D067BBC82A5BB538A290B6204BF7471314F01CA410D381889C40F83319890B058
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 3c37a5c742e0943081aedac0e2fd783f8c64d9bb014a4f71426445baa06e7aa9
MD5 403796c7f44397954064b5bb7996ab2b
SHA1 4a6be08ee0e9e32883f531e38b04574667178c57
SHA512 4887601284873bdbe3aafa467633f7b4aff4ee4315d287c1b0a4ae4641cd5522f2324a7bee63f878c2c9bf290e579b1d36127641f36bb68c933334f99b3b9b75
TLSH
T19ED02B060AFCC4253D21EE119AD949A43166B51B23D1952EB40C81558550E78AF0605C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 178KB
SHA256 3e1e55bb2721ef0e106954fac8d9be1fa56d0cca2abab2187ce074f93dddb5f5
MD5 f3803c0e4a1281e683974f233c3d4f1b
SHA1 70a2aebaa8de8f40230f102f452d9935b21e769c
SHA512 0962e8f724428a64469525cf358486cda78d3160446968d26b95cae80c43415939a98bc93787d7ecd620d00e4fc40a9e477b9fad73f287adf04a2836ea859e95
SSDEEP 3072:2/Kod74O/fCQnuWRWWQOV3vSEtiLF4hBSb+tndB:4td7D/hvWpOVqscKhBSUP
TLSH
T1FF042C646CBBB5A35E4ACE624C99BA9616F561DD2412772F7E307E005C03ABFCE17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67F6625BC22310D5C99DDE12020DBD90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90
Size 584B
SHA256 6d473796c6f906f567e4837a54161097d0bbc0f662ade87705e46237d7c1160c
MD5 dd53e71a76a3ff61d16963c00af0e241
SHA1 4b8da97d8448de02f98f1a09019544e43519554a
SHA512 97eb6cb088bf81a51ef00bfedc8baeafd8219b20fb9522b29ea857f3de2e65a29df887065456eacce77a4f5ebde8ceeedbddfcd16d21760b68c3de53dbb54b5b
TLSH
T1C1F047721A183118EED0FF6851ECE763AC343671A8C37A1165DFD4401811F50154148F
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 53046b0f8a889d4806471a9a576bf2e6cca7d2728fd6f5534003d102d49a7fb3
MD5 1f7d71d63424809efe1558fbba6a31b1
SHA1 84da54eefee78153a1b84f61666827bfa8654128
SHA512 0288d58cfb84de0a9b7d3b27e9113a5afb8dd7a7c71de6f9a4d988472dd0ad3a640167fc8e3ac824b9d97dac09854f1ec23f1a3fd087dcf3f1121ec6b88cca36
TLSH
T1E11121C65FF4A0909AF34660CAE4D23A7C7564C729EA60911C81C886209BB592B0543F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 b759543292168682c15dff946aeda8e9342621665382acf3799aea8e0f28e33c
MD5 7a07987dc4bcafc41e5c6cb17e979ef6
SHA1 03e31b6903506ebc7465cb41993739baed232ac4
SHA512 40ac71361fef4bd434644731e45d9b5ca9c763c9dc23aff61fe07f569255eb88c4e2c2f11988a27a03b4c777a619452f766d88466f1b5b6a6b1a4164b185911a
TLSH
T1424107EB0F09B864AF41CF8969F9C83A2D3980ED50840941F877C8D116BEB442F0A85C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 fded4053ce443978d45dff562f663c28fdd7d06d5a8d16bc9d74ab50c47a297d
MD5 28756095cdd9ee85a2d5c7232215388d
SHA1 78b5bde323027aa72e9baa7b31a2ab7edac6052a
SHA512 46732f54e4c5dfa8e6504c2c1cac97afb3d70794908d12cb7f9b7965cd2a59bf2e8e2b94b1c23df11d973d30a1c0b3936b3341483bf04916c918d8f1b3898110
TLSH
T1D6C08C1C5EA24A16F2A8437C02C13D139BA18201E6418F295AF12A08C9E6B162838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 a42412efc03d1158e29b70a993473e7728b9d87a27c3b64cb6409c744af4c8e8
MD5 853e1972a802c4b317a1f67e9b9ba981
SHA1 817d7b3162cbc09fc7d68a568baa2fa5d10151af
SHA512 61651fb3c765ae4fcfbb604afb8fb3e0bd6164743ea51afa9ab8b084533c380ec1670130287dc0df3a7047bb831f1358008abc8b4ab216d407d1723b25dd8add
TLSH
T10AF05C2C17F8457EE132DFB49AF5BBB2F865F126280451E95A92460D9B03F412C9147C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 6e68ddd9235fd6a6ae1e2aaaaa8db839f202e0e095248d1f39afbec991c93331
MD5 1db01061535e5e0a8e50b75b68578eba
SHA1 95d39a7e959512644d936eaf26423182c87d0da7
SHA512 c53193bcc3bfcb6cf0f54776baff8d518bf923e1dd1cb446e889c4cfd12dcdda93996007f250eaa8e8d685fca1c4ba3743c41193bea4b8cc53b2a351f5d51c80
TLSH
T1EBF0231059FC813DF472FC34C7E57577E925F11578054BBF0A96060565279134D5362F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 8b4ae1ed1361aca7ee1575fe7b2cbd8c125b98012ddef2abcdb010be803bab70
MD5 7e7ade84b47f3d00528a910dcb374218
SHA1 26f018b5c9005c63e3006da104937f23520a0492
SHA512 6291b03d943bdd5d0b8fb960e5dc09302a087f01962294ba1972fa952bfbbc06079a690b70b27af137de1886bad250a243bc19a8081bbf6e99d373440f73b7ff
TLSH
T1A8D0222C0B121306F0B8833F847007E63BE03483A9A10F3E6B7C120CA42EE022C2280D
MD5 SHA1 SHA512 TLSH

Submit Download

67F6625BC22310D5C99DDE12020DBD90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90
Size 230B
SHA256 3a4225a5e2729649104d8dd331257688b5ffa5d45d8fd4577665f139936f81d3
MD5 bdc9dbe535c5157884dc361a9eb0bd6b
SHA1 2be1278cc5c07b3e54bcd2baffdf22cdeeedb72c
SHA512 cf31e252ff4da1c9d472b7b99441c6b66d9badd6fdc610efb80d341721bbd5c5885545febe8c18cde88c3e284841057f1619ff979e42ca35840ecad58351978e
TLSH
T138D022682F60861BF001C13BC86006225E747020E101C389072000485CBBF462C31D02
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 6980b8f48a0843c27efecb7091e1626de08b3c1afdca182d046da06abdd52f85
MD5 2af92bb965ce5ee084b1c4de0494beba
SHA1 8495e6c0f4249807e0774345699efcc933c7f23f
SHA512 b138aa12aa68f627515217c10f430013420f72cf07c7ab41e9e4bab56d8762a7b9ebb33cccc3eb4b7dbfb7001e3d925c28fbacac124d6b70db67fda53d861f95
TLSH
T18FF0552512E6512EF23177F486F463E9AD2AF25A3400C5A82AA2160EEA53E419D1243E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 2074b7abe7d26c50d81c89c7dd8fd19494b2d78c5bfb395f27a5346b4bc88759
MD5 76de780c6ed60a8228a185db177939bf
SHA1 edc3f84ca36117c8c5c0dc0f8c38931db7568acd
SHA512 563eeacee1ae9cec44f7337166ab9396738d9fb297a6cfb6b6c8671b8a06e34188991d02964afd518a6de79a36d451e1502225e9bf165dba4f367ab5c3a89357
TLSH
T16DF0E53929E6017EF232DB7C02D452EA4563E23332582A6EAB6142095A45D406A61A1A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 02e66c58bb4a93ac8dd4eeef760916832739b1f164398f44bfcf1dd58dece1b6
MD5 75977f7e32a8af46ab04740fd0a51907
SHA1 bc7bbaa5ba58a1d2c9fd5776b55f226bb2972608
SHA512 4a49d28d766f80a12c327699becb2ce05e7829e6922791a44f25e97ad0ec77fe737ccfc15ed532d708f4f2eced25d46fabc7f81ab5b78d5a2c0eaebae93e4b61
TLSH
T195C08C2C46610606F2A883B802C2A9C38A208110F3819F1126B16A08CD75F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\CoreSystem.exe
Size 11.6MB
SHA256 6b3f7d8c15fa9949706c397a885980bd8c17b6935ee2cda8b17ebd7f675cda44
MD5 4f3a5b9040e974b776ac44892590359d
SHA1 6dd8a89a4484b2a8deb55c4d389cb71cf2d14d24
SHA512 9c828ca18e0ae5f9b77671c10904782f2bec580498424e7d97c2529f69c9263f8ba68ff30444054cfffab643767f39949ae5420f7d557d5356aa283f77e90366
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpFK4MxW9QyrGC:TDpbgBr/4QAMQMrEGRONY/4VLM3qIbKQ
TLSH
T171C633AA745F56ABD20E1C798E069D6236BC6BB1CB549DC3FFC57DB30840C631622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemHost.exe
Size 11.7MB
SHA256 fd08c2e9d72573eebd2dca528a6737b3b4e5c4d65edb2b9d2c157d6e7d9e07cc
MD5 e997e2b0c76e238301906e3c89a43450
SHA1 91fd1da8c7acd9602eef68e391447657c0627510
SHA512 526f19c00100c683068d927ffb558b32ec7c8152a954606fb50801af2cc90120a3a7a446713eab3d0370ea435769373561beaae31dd9218b0ce4e401f5aae816
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpFK4MxW9QyrGP:TDpbgBr/4QAMQMrEGRONY/4VLM3qIbKF
TLSH
T17BC633AA745F56ABD20E1C798E069D6236BC6BB1CB549DC3FFC57DB30840C631622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe
Size 11.0MB
SHA256 6a5f2c66c273d3fb895baa8701ba0e7f3e139b017d583bad74e352dd94ea9ede
MD5 e704d36a98e9a34c2f30b757ddf8130f
SHA1 6794ad0b33964cde9723b667dfbbfae1d18b59cf
SHA512 0997dc2edfa5a8c51f8640a9186ca8332672a36d8741b1476a823332346914108f3775723968c51d6701f6d8fb9ebeba1b5e6081afe9638e4f833531ee9bbef3
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpFK4MxW9QyrGU:TDpbgBr/4QAMQMrEGRONY/4VLM3qIbKq
TLSH
T19BC633AA746F56ABD20E1C798E068D6236BC2BB1CB549DC7FFC57DB34840C531622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
Size 11.3MB
SHA256 91097b4713aa9afd412c5efe660753abd8baff89ea5133927d0e0b590d788e8e
MD5 a6865b71afb9cb563486443a62de28c9
SHA1 dfb6d78caf63696eadf615b4ca3ddbea5bc826f6
SHA512 344e859899e346290b67c5cd475453e2f36973e314b39569ff6234136180ee23f788f78751110d535b95e6d566ad9eaa4f2019434d98c27c020374a352ceb6e3
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpFK4MxW9QyrGo:TDpbgBr/4QAMQMrEGRONY/4VLM3qIbKK
TLSH
T116C633AA745F56ABD10E1C798E069D6236BC2BB1CB549DD3FFC57EB20840C631623D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
Size 11.1MB
SHA256 62dce3ad66b67d79824134ea7167224fe9e47babe2019dbe66ec8dc8c18df4b5
MD5 16eac6a15d66e03f69f3deeb8f01861f
SHA1 c400980500bdb351df0e89f88dd01c48530b812d
SHA512 860c08d4205d821dd81f167f0c63ee215ba41b4d4942231fcfac32f4c0092fe49bec68397d7f4e81f6df0a1991e34694b2fbf57dab27f6cf6718b2840d71eb69
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpFK4MxW9QyrGV:TDpbgBr/4QAMQMrEGRONY/4VLM3qIbK7
TLSH
T19FC633AA745F56ABD10E1C798E069D6236BC2BB1CB549DD3FFC57EB20840C631623D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
Size 11.4MB
SHA256 e00cc36d7a063bbc6bebbd201e239ac40e386f72ddf47ad4b304ed7475995b97
MD5 f2f087ec8a930fdb953efa1be735934f
SHA1 322535039aa00cf6658eb7e269b7b73c8915d1e7
SHA512 4556e44c417af2c58b27e67f3215aefb92e9cdffcd9c82cd8f163078d867a4ce2c9800f68627a2173842e714066214911d44c2ba5120aa4517dc0fb5623ab3d3
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpFK4MxW9QyrGq:TDpbgBr/4QAMQMrEGRONY/4VLM3qIbKU
TLSH
T19AC633AA745F56ABD20E1C798E069D6236BC2BB1CB549DD3FFC57DB30840C631622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe
Size 11.8MB
SHA256 ac9e14248e55c8043d3a4f0437ff9acffdbd9b81221fab401ff3665d6659e1af
MD5 435e3431676c77bdd12f7204100f3934
SHA1 d858a5e24aed4420f0c40559912751d858377d94
SHA512 c5c08618cddd5b0f09dc0f2e6805b0cd8e7ce58c239c87f0c530cb78859c82400776b70881b0e87d0c3dad6eb60f74c9844815f22dddb8f8f595fcf808d05da4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpFK4MxW9QyrG5:TDpbgBr/4QAMQMrEGRONY/4VLM3qIbKr
TLSH
T165C633AA746F56BBD20E1C798E068D6236BC6BB1C7549DD3FFC57DB30840C621622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
Size 11.2MB
SHA256 051d2312e03a60b23b28c9d934d1fa0d7e40cc2f5704e2f49c1a6c9e8f9bb8dd
MD5 5bd6843d7baed648ddaf8e8e67311008
SHA1 2db824ea1d9dd467d508378df0ed5228edab5ac5
SHA512 524c729ad3f98f838604bd00b01c84821a103da0f58f0126be64ef451103c26062a3e1a7d01d02f12d276b138afcf538d8dcc318772526a2bccce99b6a35800f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpFK4MxW9QyrG+:TDpbgBr/4QAMQMrEGRONY/4VLM3qIbKQ
TLSH
T1CEC633AA745F56ABD10E1C798E069D6236BC2BB1CB549DD3FFC57EB20840C631623D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download