c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Size 12.6MB
Sample260925-thbb4azgnb
SHA256 c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a
MD5 09dc72b07c9092d36d835cf852cd4361
SHA1 075b1a6c72fee97d84d765b233501382b52700a0
SHA512 bc09d35e68f749286b0aeed88f39785c52d60f91f6936c634fe2bc0358a055bb12c0414fdf024ed115e81a9df55eaee23b4877dbd610cc23859e80971f8516f6
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eV+:4JwMrcMGVF
TLSH
T174D633E9785E66ABC20D1C7A8E0A4D7239FC1BB19B544C97FFC67DB30810D521722E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	SecurityCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	SystemHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	WindowsInternal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	UserSession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	SystemTrayHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	SecurityCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	WindowsShell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	UpdateService.exe

Executes dropped EXE 17 IoCs

pid	Process
2372	SecurityCore.exe
1452	SecurityCore.exe
2608	SystemHost.exe
4636	SystemHost.exe
3932	WindowsInternal.exe
1600	WindowsInternal.exe
2800	SecurityCore.exe
4636	SecurityCore.exe
2576	WindowsShell.exe
4300	WindowsShell.exe
3204	UpdateService.exe
772	UpdateService.exe
3028	UserSession.exe
4736	UserSession.exe
3464	SystemTrayHelper.exe
1648	SystemTrayHelper.exe
2832	WindowsInternal.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\WindowsShell.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\SystemTrayHelper.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsInternal.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsInternal.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\UpdateService.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UserSession.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SecurityCore.exe\""	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	SecurityCore.exe

Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
146	raw.githubusercontent.com
163	raw.githubusercontent.com
171	raw.githubusercontent.com
39	raw.githubusercontent.com
95	raw.githubusercontent.com
107	raw.githubusercontent.com
122	raw.githubusercontent.com
132	raw.githubusercontent.com
137	raw.githubusercontent.com
152	raw.githubusercontent.com
33	raw.githubusercontent.com
59	raw.githubusercontent.com
71	raw.githubusercontent.com
119	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x00090000000244a6-29.dat	suspicious_telegram_bot
behavioral1/files/0x00080000000244bc-99.dat	suspicious_telegram_bot
behavioral1/files/0x00090000000244c8-135.dat	suspicious_telegram_bot
behavioral1/files/0x00090000000244bc-170.dat	suspicious_telegram_bot
behavioral1/files/0x00070000000244cd-206.dat	suspicious_telegram_bot
behavioral1/files/0x000400000001e6be-242.dat	suspicious_telegram_bot
behavioral1/files/0x00080000000244cd-276.dat	suspicious_telegram_bot
behavioral1/files/0x000500000001e6be-312.dat	suspicious_telegram_bot
behavioral1/files/0x00090000000244cd-348.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 34 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SecurityCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SystemHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SecurityCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UpdateService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UserSession.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SystemTrayHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsShell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4152	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
4152	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
4152	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
4152	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
4152	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
4152	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
4152	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
4152	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
2372	SecurityCore.exe
2372	SecurityCore.exe
2372	SecurityCore.exe
2372	SecurityCore.exe
2372	SecurityCore.exe
2372	SecurityCore.exe
2372	SecurityCore.exe
2372	SecurityCore.exe
2372	SecurityCore.exe
2372	SecurityCore.exe
4636	SystemHost.exe
4636	SystemHost.exe
4636	SystemHost.exe
4636	SystemHost.exe
2608	SystemHost.exe
2608	SystemHost.exe
2608	SystemHost.exe
2608	SystemHost.exe
2608	SystemHost.exe
2608	SystemHost.exe
2608	SystemHost.exe
2608	SystemHost.exe
1600	WindowsInternal.exe
1600	WindowsInternal.exe
3932	WindowsInternal.exe
3932	WindowsInternal.exe
1600	WindowsInternal.exe
1600	WindowsInternal.exe
3932	WindowsInternal.exe
3932	WindowsInternal.exe
3932	WindowsInternal.exe
3932	WindowsInternal.exe
3932	WindowsInternal.exe
3932	WindowsInternal.exe
2800	SecurityCore.exe
2800	SecurityCore.exe
2800	SecurityCore.exe
2800	SecurityCore.exe
4636	SecurityCore.exe
4636	SecurityCore.exe
4636	SecurityCore.exe
4636	SecurityCore.exe
4636	SecurityCore.exe
4636	SecurityCore.exe
4636	SecurityCore.exe
4636	SecurityCore.exe
2576	WindowsShell.exe
2576	WindowsShell.exe
2576	WindowsShell.exe
2576	WindowsShell.exe
4300	WindowsShell.exe
4300	WindowsShell.exe
4300	WindowsShell.exe
4300	WindowsShell.exe
4300	WindowsShell.exe
4300	WindowsShell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 1452	4152	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe	104
PID 2372 wrote to memory of 4636	2372	SecurityCore.exe	108
PID 2608 wrote to memory of 1600	2608	SystemHost.exe	117
PID 3932 wrote to memory of 2800	3932	WindowsInternal.exe	120
PID 4636 wrote to memory of 2576	4636	SecurityCore.exe	125
PID 4300 wrote to memory of 3204	4300	WindowsShell.exe	132
PID 772 wrote to memory of 3028	772	UpdateService.exe	137
PID 4736 wrote to memory of 3464	4736	UserSession.exe	142
PID 1648 wrote to memory of 2832	1648	SystemTrayHelper.exe	146

C:\Users\Admin\AppData\Local\Temp\c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
"C:\Users\Admin\AppData\Local\Temp\c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  PID:1452

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4636

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1600

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2800

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2576

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsShell.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3204

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\UpdateService.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3028

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3464

C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\SystemTrayHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 f7cb80d8e1e6b0ccfe0b9c679ba312d77f64f9502cff386933ba749d2dce13f5
MD5 b2451bef54b51146480cefc4cd76e63e
SHA1 c23e495150a7796292ecd495e2bf8c0d951792d5
SHA512 76ae8667711a688d7c3c52d3dd15ce6b99e5093645a6db2107e156f24e3d842fe471b645a4a38e83037750f54003a9bb3728454229e15aee57e893fef0b7b4e3
TLSH
T191E07D06077C40827767593499E144363460145F94685E1A291C4AC50E9225FD907101
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 b2f485b77661e0d38c0e523014d2065b69c2ad75c98279ceed44bdd21e69a68a
MD5 e8009ce7218dab8d719797b773540ee7
SHA1 7665e80943bec8f551e9366ed26a88a92bd5de5b
SHA512 d239e41d7404e5b5f4ae6699eb6963a37b825bf41dc6f7cbb66b37d97d059b50e504c7a013a66fa1edb3d98b1d078c59883c037fc83936b988268488e4a55370
TLSH
T15E41D7DA5F2834A0FF81CEA06879C6322E3CF2D18995519670F6C8B224857D01C0689C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 a68218899b1a409d5089df3894ec2bdd43f1b0947fb7898fcec41f15bcef9a8c
MD5 6f38a043dcc4b2214c6da350f88d8110
SHA1 02d6fd79fadf76013d173bc18f6cc4f3e0633fd5
SHA512 095abb2e0a9791447a6406f849b3df270c631361a965976d50058f9a7e665ea8746114086b3e77eac1acccff622875ff4e20fcb6bc2c69837d3bc7848ff1d579
TLSH
T1F6D02B1603BA5CF53E259C6096D0A074346354A733C75496501AC796651DE393A02144
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 0a49b3aa2c2ab428b1a1c4459ff106cb7acd87ccdb3ec3cc18f1765fe079f272
MD5 91618790c8b9fb88f4b1bf1f09223dea
SHA1 5b6cbf72b1345f9b16e0246e177230c7695e70a6
SHA512 c4d15b05dff4a87b1b80cff799e4fda51b65f7fa0c8c833f1cccaac7a5fb76e861e8270017556e6af666a175e80e4d4a11d91cc9dd211f3a258f6841dae144fa
SSDEEP 3072:cexbv7DO/fCoWUyRWWQeGbvHotivSqhLvbh6Odp:n5v7q/+DWpeGLgaFhLvtj
TLSH
T167042C646DBBB5A35E4ACE624C99BA9612F561DD2012772F7E307E105C03ABFCE17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 7dd1ff632ddd6df8ebdf2bea038f358372f4d43ed9624a86ca916a0cf1c90287
MD5 17910262c69f48b19ea6220188a16712
SHA1 2836896bb7a343f84082ce5c209fa62e836cc453
SHA512 7d287245f7703f88985fb33d287b96a99ed98c5062f79ebe07d33e83dc46ea407a9d23cedd0bfd58d36bd957391aa2510c85f295c631a384c893ee058976f522
TLSH
T1FB1121865FB460D096F35260C7F8C9327C7464CE3CEA38D55C838896346A72D2B0543F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 c5fb6b5c7cdf08b4570c8cd8cd28626915a695700d2cafbfeaaf3a73306a642e
MD5 30064da6596c0b6a74ffbcb81607f78f
SHA1 3c635ac013887b61cbf96a8fb2de82547897e86f
SHA512 99f2348ebcd04dec8c049db6e0ad2e504ab64bf06392e945033b0cdd5a9f91744d2119319dd90c9983b9ab523eb48eb375abad2762d049b8e676264d5415bc7b
TLSH
T1C541E9FB0B063994BE0ADF8969F6C93A1C39C0B891801881BE7BC8D2055EBD12D5799C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 0997ef3fc7d453ebb66b6c5bb11891442fdbb0de511ad50bf4e82a4879a5c1f0
MD5 19d4dc95701d9631908887abd8056884
SHA1 3bfb8e55b939cfd64d9fd8378b1e2b2ae176eda1
SHA512 6c41c075215a6f0e827d161631390596f08dcf54e57f5d162828b71b00a00eae0f4de9d9a4fcc819181eff39900bf4ee23f3e5c340608ee494b505e09cf31b9b
TLSH
T10FC08C1C1AA21A0AF2AC83BC02D179439B208121E2458F062BF13A08D996F162C38C3A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 39489de7aa17894edc34b3c66db0ba2258c7e6eca3c86efefa36d7fd51208b91
MD5 26eca2dbf6ff7282bcc485172fec71c6
SHA1 4879af250ea617c3e24edcdff8de750bc9f88c40
SHA512 ac23c0da9e9c47f0bb45cce911f53cf521f7904ca0a0077340536d24a86eca97edd8b40419d81503cc505bb55b15122eceeee9c16facfc525cee098474420c4f
TLSH
T15CF0273C2ABC907DE5B3DB788AE6B6569D18F116540401E81AD24A0A9A09E007C9103D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 85788b46cb7afef3a0a68051aa15c487ccffadd28e54ce3a958ef33063c44770
MD5 ca60ef9538ef018789c1a26b2d67f428
SHA1 af861a2d0b46b69363ec5153303c101099dac1b2
SHA512 89a4179190ee7ac8641f604f7198574de714a5645a8700200d5b4deb39672bb180616d5227b2b44e047ceeae5ab91d91a774153e3091684f84d3537af2a9734a
TLSH
T1B3F0611039FF803EF022993483D5E2B19A65F1123006257D27B713051E26F207C1260D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 29dccdd0388b4b4525cdecd5de38650ffa31104f6eb6fd316b70a86c3eaf5d47
MD5 bfc393f22b32558a04b21646bac1baf4
SHA1 0ea811efa139924222fb77f1aad470c4ce14e9d5
SHA512 320f6f169a9bf9d76d2eb9261abfb7b2df8d70064d8e1fd27bcde56979c3ff8519b907491bbac31a5fe24eae8dfe534c59f432b5b92e98ec7cac59efc8884a44
TLSH
T1B3F0232404BC0009F032E978C1D96C76BD34F01238068BB6078603075A11F400CD311E
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 6a13ac27efe0d1d55bb8c5074b3f893696e9f55dc3b6e98939ff0326f18a405c
MD5 ea81843666560f98e6002df6719a1d35
SHA1 bd7bf300690270f946dfd4388d39927696176a39
SHA512 cd16cbde5910b39dad0851247b856178c2c2308932a0d27004f76a4d5218c2480b9067334eb661d44eab5e05fdddb21cc16c5ebfba080c03e5d774a8c21d1496
TLSH
T1B9D022382F11033AF1B88278C8A186C287A22416F2FA17DD2FB4621C841EB130C23C1E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 126b5575a065969498172826652565644043e48538ce0fe558bc37b056637201
MD5 a497860fa648c091976a1847a79d90a5
SHA1 f84cc5ee46636ad2fc2d15fa717b409c95157817
SHA512 7a37bc4653de95b80b51845b6bba2f8bc144b663ef2567f0f715ba5e2a86389cd028e9c20e3fe7ea441b2736b3f51c781fc7dc5f5553811c19163d34769b4a15
TLSH
T191F0A33807E3016EE2717775C5F193D6AD65F2A73900DD6916D10709F617F426C1243A
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 aee9f777f8c4b7e730c0b4bf6b4e3f3e6f30009d4ca2138dc3fc1bccc7f9021a
MD5 c0ffe40b70fa59d4a68b0e259d15f08c
SHA1 b5501d68a579b0faa413fbeacef34ab461db6f24
SHA512 03ab30c2c7f8fddf1d1fd522d84288a46d7e95dff3b92d6482827204e8183d6de5411bf68f50de514335c84bc83c7367695c36f8be3b9e99e40d15dbd6cc9925
TLSH
T1DAF0AB3824E7021DF162DABC83C252D15623F13331042B657FB113053943E82A970D15
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 36f988744d63cf8e1b2605a58beab4890a8b9a5f3b5155882fd810305af22348
MD5 c46a9bf59e298b16c8a347889572d2ac
SHA1 f2f32df4f796ca74c6294b55ca604ef30588fa53
SHA512 60318c543c46ca6df31a3a5feb2c8993cbf97cf16430ede85324f55e4291f0e26a484728bf426f7bdf4641ac052a7f6940819802e4aba66ec15bdfe9161d6e06
TLSH
T1D4C08C1C0665060AF6A883B802C269838A218520F3819F0527B16A0CCD24F162874C29
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsShell.exe
Size 13.2MB
SHA256 5f8a467bf341364a897c0cbdc86c16898f13adc9c2d8a8531be94a6ae74292a8
MD5 b1272f26f757fb428ea3f4d4f1045d88
SHA1 eda2a6aa42b8481ae8ca419343e5a5e9a8d02824
SHA512 48bf4a60158dcd3c58981ea78c5e0d32398570aa035406664abca1272697d1e3bde559d1923d981c73d5df3e5e93d1e9e9d76b6bf1f7f9d28d5f460e45eb968b
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVx3Z:4JwMrcMGV8
TLSH
T170D633A9785E66ABD20D1C7A8D0A4D7239FC1BB19B548C97FFC67DB30800D521722E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe
Size 12.9MB
SHA256 06da36f907d63e3d9c5d375276f93b09af2694846959b8544e0a39937033e81d
MD5 68748e04820824e9485eb095326eb999
SHA1 b2f58e66feb2c9387670a26721481936b569cf99
SHA512 6cbcb30a3c9f3fcd99084029ff9d617bb596700a2c1e615a83621ee1cf17f28343a7d4bda062d02c863e44416df4fe6f7c1da9dc4704773c16ed81ba153fdb08
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVp:4JwMrcMGV2
TLSH
T171D633A9785E66ABD20D1C7A8D064D7239FC2BB19B548C97FFC67DB30800D521722E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsInternal.exe
Size 13.6MB
SHA256 90a03a34ff1ce9af53c8a5aa9ac7dead4ca04025c8911fd027770070b2fe542f
MD5 aeff5c4c8a55be3a7f42d62c7abe3ef2
SHA1 6235f098174c8757c32c8697fb795ce608c0c1d6
SHA512 892fd64995a3e1bf736d845658e466b7d73eab16b00f2e82adeea20775ec77c9bfea0c03714f3310cf68a8b0ffe2b521e00a8b17aa7abf717be222092fa624cc
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVx3Q:4JwMrcMGVt
TLSH
T1DBE633E9785E66BBD20D0C7A8D4A4D6239FC1BB19B548C97EFC67DB30800D521722E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
Size 13.5MB
SHA256 7ff30fc34b9ff1cd2faf4b000be406d0dbebc0fee06df72872bdeba041f046ca
MD5 36a4191365fb2f5a7fd96a2c74fb43b0
SHA1 3fdf272471052a7ac287ddb7154863be88d19592
SHA512 7d40f8df661e8bf66ad66e3f654db741c0f2df98fea4fa3ed8b427092b3ad13ad89ac40e4570246ef341cbdd87044a5e2e95408189b45b1ec772b559212981b4
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVx38:4JwMrcMGV7
TLSH
T1A0E633EA785E66BBD20D0C7A8D464D6239FC1BB19B548C97EFC67DB30800D521722E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
Size 12.7MB
SHA256 5ee8328a8b9ae908e8f73f65a8fe02385888d110eb2366a1e68b113b8b9fdf6e
MD5 b4bd02c20013c28c08fbc06183a78474
SHA1 e7e76b65e063fe830bbe114a9b35f51ce984acfb
SHA512 07d9654f2a2d47c24999768473aaffbe984491385e9ac01d0f783183e00bc6c7396956c770de8d0fd6a25054f4d02914cd094240923363111edfbf67cd5e63ad
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eV3:4JwMrcMGV2
TLSH
T1EDD633AA785E66ABD20D1C7A8D0A4D7239FC1BB19B544C97FFC67DB30800D521722E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\UpdateService.exe
Size 13.3MB
SHA256 9cd8348f6b94d1aa417407f8f7d82a18fd96db7234e23363ceb5edbc3642c0c9
MD5 509075b92a53f1650fe6cb39a22f0a9b
SHA1 2dd3cca25490d93845b2160bf514e249eecaf31f
SHA512 50f7cc83e85be35976c0761b67fef1f7893b1461a34cfc467284365fbd76a13fb3570ce354a719cbe1f202aba2a30a0f9963df1c513fccb50374f1cf58096e9e
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVx3e:4JwMrcMGVV
TLSH
T1DBE633A9785E66ABD20D1C7A8D0A4D7239FC1BB19B548C97FFC67DB30800D521722E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
Size 13.4MB
SHA256 acb52eb7f7b3ff7909d025e74ad01e88df7508ec792938ed6c953f89999f0037
MD5 a07e5108649819acc99c9e0b2fa6aec4
SHA1 30b8ac0d5ffde1af3530a0e2df430aca63e52674
SHA512 838800384118bb176bc9590567d1f43cbbb734831b483830d643eddc7b92cf0eb8322a50212c5bb38c9a9a4f200aa37ff7750070a2298922d3227713716b334c
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVx3C:4JwMrcMGVT
TLSH
T1B6E633EA785E66BBD20D1C7A8D064D6239FC1BB19B548C97EFC67DB30800D521722E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
Size 13.1MB
SHA256 062f493c18ac4b8494c29ffd0e5615a8a9d974c72a7a733216ce299980e950b8
MD5 aae5c83735924a0a9142cd5fd5bd91f8
SHA1 d7eb071d40c747e6460f033d2b4a3c999f461b4d
SHA512 d6ef9d3a70fe2b2c07a0fc5e0e9424d7e0c4ea7d1e53530500444bee715e0e95081a9c4a69788d5d962a4158e4bb7ec4f0956f9680a5f1609dcad3a8bf28cf28
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVxS:4JwMrcMGVB
TLSH
T1D7D633A9785E66ABD20D1C7A8D0A4D7239FC1BB19B548C97FFC67DB30800D521722E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
Size 12.8MB
SHA256 d1c30253a6713311fb88583ddfb8ff6790f4595f541188798b08f0b8dc3da54b
MD5 5d311fbc1830c26192890aae21854cb6
SHA1 e7c877c2e0dcf64b9b50a269fee2cd89ab88ec84
SHA512 d7e1a713f64a7ed961be8fe88282dbd471a01037a2d4a1cb27dcb990fd93c0e28be3f7ec8644b4699365f4389910f3acec4a6fd277cd36bd0d3c67fff5adc702
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eV3:4JwMrcMGVQ
TLSH
T118D633A9785E66ABD20D1C7A8D0A4D7235FC2BB19B548C97FFC67DB30800D521722E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download