c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Size 12.6MB
Sample260925-thbb4azgnb
SHA256 c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a
MD5 09dc72b07c9092d36d835cf852cd4361
SHA1 075b1a6c72fee97d84d765b233501382b52700a0
SHA512 bc09d35e68f749286b0aeed88f39785c52d60f91f6936c634fe2bc0358a055bb12c0414fdf024ed115e81a9df55eaee23b4877dbd610cc23859e80971f8516f6
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eV+:4JwMrcMGVF
TLSH
T174D633E9785E66ABC20D1C7A8E0A4D7239FC1BB19B544C97FFC67DB30810D521722E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3944	CoreSystem.exe

Executes dropped EXE 22 IoCs

pid	Process
3944	CoreSystem.exe
5488	CoreSystem.exe
5220	SystemTrayHelper.exe
680	SystemTrayHelper.exe
5044	ServiceHost.exe
3468	ServiceHost.exe
3272	DesktopWindowManager.exe
4572	DesktopWindowManager.exe
960	WindowsShell.exe
2504	WindowsShell.exe
4712	CoreSystem.exe
2100	CoreSystem.exe
1160	DesktopWindowManager.exe
3472	DesktopWindowManager.exe
5920	InputService.exe
3952	InputService.exe
780	InputService.exe
1796	InputService.exe
3300	SystemTrayHelper.exe
1424	SystemTrayHelper.exe
4968	SystemHost.exe
5128	SystemHost.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\DesktopWindowManager.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsShell.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\CoreSystem.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\InputService.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\SystemTrayHelper.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemTrayHelper.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemTrayHelper.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\ServiceHost.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\DesktopWindowManager.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\SystemHost.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\CoreSystem.exe\""	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemTrayHelper.exe\""	CoreSystem.exe

Contacts third-party web service commonly abused for C2 1 TTPs 20 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
101	raw.githubusercontent.com
118	raw.githubusercontent.com
48	raw.githubusercontent.com
60	raw.githubusercontent.com
72	raw.githubusercontent.com
77	raw.githubusercontent.com
115	raw.githubusercontent.com
128	raw.githubusercontent.com
40	raw.githubusercontent.com
45	raw.githubusercontent.com
105	raw.githubusercontent.com
26	raw.githubusercontent.com
36	raw.githubusercontent.com
86	raw.githubusercontent.com
91	raw.githubusercontent.com
131	raw.githubusercontent.com
141	raw.githubusercontent.com
152	raw.githubusercontent.com
1	raw.githubusercontent.com
13	raw.githubusercontent.com

Detect suspicious telegram bot 11 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c625-28.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c626-104.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c629-138.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c62b-166.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c629-201.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c62c-235.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c629-268.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c62d-303.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c62e-336.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c62d-369.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c62e-405.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 46 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
400	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
400	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
400	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
400	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
400	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
400	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
400	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
400	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
3944	CoreSystem.exe
3944	CoreSystem.exe
3944	CoreSystem.exe
3944	CoreSystem.exe
3944	CoreSystem.exe
3944	CoreSystem.exe
3944	CoreSystem.exe
3944	CoreSystem.exe
3944	CoreSystem.exe
3944	CoreSystem.exe
5220	SystemTrayHelper.exe
5220	SystemTrayHelper.exe
5220	SystemTrayHelper.exe
5220	SystemTrayHelper.exe
680	SystemTrayHelper.exe
680	SystemTrayHelper.exe
680	SystemTrayHelper.exe
680	SystemTrayHelper.exe
680	SystemTrayHelper.exe
680	SystemTrayHelper.exe
680	SystemTrayHelper.exe
680	SystemTrayHelper.exe
5044	ServiceHost.exe
5044	ServiceHost.exe
3468	ServiceHost.exe
3468	ServiceHost.exe
3468	ServiceHost.exe
3468	ServiceHost.exe
5044	ServiceHost.exe
5044	ServiceHost.exe
5044	ServiceHost.exe
5044	ServiceHost.exe
5044	ServiceHost.exe
5044	ServiceHost.exe
3272	DesktopWindowManager.exe
3272	DesktopWindowManager.exe
3272	DesktopWindowManager.exe
3272	DesktopWindowManager.exe
3272	DesktopWindowManager.exe
3272	DesktopWindowManager.exe
3272	DesktopWindowManager.exe
3272	DesktopWindowManager.exe
960	WindowsShell.exe
960	WindowsShell.exe
960	WindowsShell.exe
960	WindowsShell.exe
2504	WindowsShell.exe
2504	WindowsShell.exe
2504	WindowsShell.exe
2504	WindowsShell.exe
2504	WindowsShell.exe
2504	WindowsShell.exe
2504	WindowsShell.exe
2504	WindowsShell.exe
4712	CoreSystem.exe
4712	CoreSystem.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 5488	400	c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe	93
PID 3944 wrote to memory of 5220	3944	CoreSystem.exe	94
PID 680 wrote to memory of 3468	680	SystemTrayHelper.exe	99
PID 5044 wrote to memory of 4572	5044	ServiceHost.exe	103
PID 3272 wrote to memory of 960	3272	DesktopWindowManager.exe	104
PID 2504 wrote to memory of 4712	2504	WindowsShell.exe	107
PID 2100 wrote to memory of 3472	2100	CoreSystem.exe	112
PID 1160 wrote to memory of 5920	1160	DesktopWindowManager.exe	113
PID 3952 wrote to memory of 1796	3952	InputService.exe	118
PID 780 wrote to memory of 1424	780	InputService.exe	121
PID 3300 wrote to memory of 4968	3300	SystemTrayHelper.exe	122

C:\Users\Admin\AppData\Local\Temp\c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe
"C:\Users\Admin\AppData\Local\Temp\c9cf468991f49c44124687af9e9481deb728c0ef2d989d6d16581c61af414d6a.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5488

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5220

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:680
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3468

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4572

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:960

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4712

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3472

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5920

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\InputService.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1796

C:\Users\Admin\AppData\Local\Temp\Diagnostics\InputService.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1424

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Local\Temp\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4968

C:\Users\Admin\AppData\Local\Temp\SystemHost.exe
"C:\Users\Admin\AppData\Local\Temp\\SystemHost.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 f7cb80d8e1e6b0ccfe0b9c679ba312d77f64f9502cff386933ba749d2dce13f5
MD5 b2451bef54b51146480cefc4cd76e63e
SHA1 c23e495150a7796292ecd495e2bf8c0d951792d5
SHA512 76ae8667711a688d7c3c52d3dd15ce6b99e5093645a6db2107e156f24e3d842fe471b645a4a38e83037750f54003a9bb3728454229e15aee57e893fef0b7b4e3
TLSH
T191E07D06077C40827767593499E144363460145F94685E1A291C4AC50E9225FD907101
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 b2f485b77661e0d38c0e523014d2065b69c2ad75c98279ceed44bdd21e69a68a
MD5 e8009ce7218dab8d719797b773540ee7
SHA1 7665e80943bec8f551e9366ed26a88a92bd5de5b
SHA512 d239e41d7404e5b5f4ae6699eb6963a37b825bf41dc6f7cbb66b37d97d059b50e504c7a013a66fa1edb3d98b1d078c59883c037fc83936b988268488e4a55370
TLSH
T15E41D7DA5F2834A0FF81CEA06879C6322E3CF2D18995519670F6C8B224857D01C0689C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 a68218899b1a409d5089df3894ec2bdd43f1b0947fb7898fcec41f15bcef9a8c
MD5 6f38a043dcc4b2214c6da350f88d8110
SHA1 02d6fd79fadf76013d173bc18f6cc4f3e0633fd5
SHA512 095abb2e0a9791447a6406f849b3df270c631361a965976d50058f9a7e665ea8746114086b3e77eac1acccff622875ff4e20fcb6bc2c69837d3bc7848ff1d579
TLSH
T1F6D02B1603BA5CF53E259C6096D0A074346354A733C75496501AC796651DE393A02144
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 0a49b3aa2c2ab428b1a1c4459ff106cb7acd87ccdb3ec3cc18f1765fe079f272
MD5 91618790c8b9fb88f4b1bf1f09223dea
SHA1 5b6cbf72b1345f9b16e0246e177230c7695e70a6
SHA512 c4d15b05dff4a87b1b80cff799e4fda51b65f7fa0c8c833f1cccaac7a5fb76e861e8270017556e6af666a175e80e4d4a11d91cc9dd211f3a258f6841dae144fa
SSDEEP 3072:cexbv7DO/fCoWUyRWWQeGbvHotivSqhLvbh6Odp:n5v7q/+DWpeGLgaFhLvtj
TLSH
T167042C646DBBB5A35E4ACE624C99BA9612F561DD2012772F7E307E105C03ABFCE17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 7dd1ff632ddd6df8ebdf2bea038f358372f4d43ed9624a86ca916a0cf1c90287
MD5 17910262c69f48b19ea6220188a16712
SHA1 2836896bb7a343f84082ce5c209fa62e836cc453
SHA512 7d287245f7703f88985fb33d287b96a99ed98c5062f79ebe07d33e83dc46ea407a9d23cedd0bfd58d36bd957391aa2510c85f295c631a384c893ee058976f522
TLSH
T1FB1121865FB460D096F35260C7F8C9327C7464CE3CEA38D55C838896346A72D2B0543F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 c5fb6b5c7cdf08b4570c8cd8cd28626915a695700d2cafbfeaaf3a73306a642e
MD5 30064da6596c0b6a74ffbcb81607f78f
SHA1 3c635ac013887b61cbf96a8fb2de82547897e86f
SHA512 99f2348ebcd04dec8c049db6e0ad2e504ab64bf06392e945033b0cdd5a9f91744d2119319dd90c9983b9ab523eb48eb375abad2762d049b8e676264d5415bc7b
TLSH
T1C541E9FB0B063994BE0ADF8969F6C93A1C39C0B891801881BE7BC8D2055EBD12D5799C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 2459b3257a8475603f0ee8435b3859540caa4c99d4bc8d3d44694378fe9b45f3
MD5 10a34d36c5c2a70cd14c64d068ad9228
SHA1 f6c58194b6c380ea2b784f3cd1f78fbf7fdacedf
SHA512 a2b29bb4c54563bed8589e3c66d57a3e71713db8b1d9806c9472d02ae3dff14fb6e51fb86e0baa03087a0260834d947793c16d6fab2670b25cc79c5c50b8b02a
TLSH
T12BC08C1C2AA25A06F2A843BC42C179439B208561E2418F061BF12A09C9A6F162838C2E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 540dca496fa019470da9ff3bb67328c17c2fd71f149dbd0a1187c04c8dd506a7
MD5 6747f3ff60abb1856faa6364b5fa2615
SHA1 e67c481ada9e3e18bd13fa35776ef2a7f5e1890d
SHA512 1ffd31477847318ce0bc5016ba817b3bf4d7841cd1836fb60c58b1db90f6730102ed028d1d350ceab77abcd8d765e793bc57d5c09bed55451297e9623d12b41f
TLSH
T11DF0273C2ABC907DE5B3DB7CCAE6B6629D18F112140401E81AD24A0A9A09E007C9103C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 d33d49dc45c12c1b12e0282cd7df3a95ea69a064fc70533c279761652cab2d18
MD5 a87ed0d88d27060c4dae506b245927e8
SHA1 c0d074fc9fcc46cc050a78304d95128e7b09cf33
SHA512 bc725c4db5da9a0dd847a14c20c7e66165ee2ab20ff8b3bd18dbddcfa8ea920ceaac013c22bcb210484c1231f044f9c0dc766acad686da14a673cf5458c52a71
TLSH
T14CF061103DFF843EF022993483D5E2B19665F1113046257D27B753051D16F216C1260D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 508f84601ba1b71fc465996acb64d004a83c6fef008d1ed058a74e2149f48527
MD5 4b065559131dd690cb693bba0674a68a
SHA1 1e0039c8c46b7015761878305dc12aea5043bd42
SHA512 f5f976a791d8ba7668c8ce14af98f188f0c3d40f0c031647e1af7638c2de5ed97b67da4581bd2adbe6b8b064e6fc024005a55235bfa1f34014b6a4e3f2fb22a4
TLSH
T1A9F0232404BC0009F032E978C2D96C727C74F01238068BF6038603076A11F400D9321E
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 dd4063bf36589b419999df6b47e647a7e6e7a3bbf6bbb00ff80931ab5242bdd9
MD5 b0061358db179b4149287a57fc62ce74
SHA1 23621f73035ad9ac07a950d08a28c7e9b542ce21
SHA512 a465e1a499269ab145b69be7cd150b32465ca15e5f7d3067fd4c9fdd8f59927840bc2146a81e9707008f470c6212c88c2c99cdbdcf3672f07dc531836a97349f
TLSH
T1A4D023341B110336F0A44278C49045C387621015F2F213DD0F74520C841EB130C13C1D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 af7a46f36de6c9f602d20573d29da5463d6b4f460d7fb6acfcbb992e7763d48b
MD5 71ede430cdd517dcfbdcc84d0d72b5a2
SHA1 d87138bdedb1400f0ed560ccd9f37eac43ac66cb
SHA512 d931eb62501f4459fd5ed8da36c45f03ea7d0be65b6a10abd407a915e327a343411e2b0d4162396d07d71eb91804f7fdbc59515a36ab8a615c146320dde61979
TLSH
T181F0A33816E2016EE2717B74C5F193D6AD65F2D73500DC6917E1070AF617F427C1243A
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 84008a4ae08e7afec6a69143e66755eb5cecac7234c1b1c73eb6bb58874bc92f
MD5 cddc59e448ab3f86afcf7c8526f334a4
SHA1 ae103562a0f522f804692af9d8a1414a106ba4e9
SHA512 f26da7f9bb2f4281c2be94456ba1a7882483c579d4f8d36b63553e2c339962d76df2b638714e63e8079b63a790bfebf46431f97c1da1dfd04ade8ff2fafdeb01
TLSH
T172F0AB3824E7021DF162DABC83C152D19633F23331082B697F7113053943E82A970D25
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 7b81f8de59fcf6e9a0cd0ce20dd43828ec4b4b584d65711f20e8dab23f32c31b
MD5 1569b8824a0c4b4e04a9509dfeebe246
SHA1 58ee787314b902e8acca86acb4c7b24ace37ddd9
SHA512 ba6824cbb096a6ee9d6da542ac92e8fa832b38b33079571da68ebc19b61c1ecfda0a51bf606e0cbcb7c84aad2b3392f04bad77cb7bbff44b2a50f57ffa492d9d
TLSH
T13AC02B2C07650607F2E883BD02C27E838B608230F3819F0127B27A0CCD34F122C34CA9
MD5 SHA1 SHA512 TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
Size 13.1MB
SHA256 96d1e55b61faf1fa8e9c8537c1fb2815f38291c1b926902cbd4e9d45701e21d0
MD5 3cde3704b3cf574c218cc67203018d4e
SHA1 5f746b6e878387139d6872502d21d7b5dc3758e6
SHA512 f6bc09a6f8d13afead3af56c783c0697ebb7a4eea94ad03128eb0d079b75f8023b81df697f52596da3d9e10b3610cc596e8ed1c9371de4ea0b4912362e3f3f05
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVpSy:4JwMrcMGVgJ
TLSH
T168D633E9385E66ABD20D1C7A8E068D7635FC1BB19B548C97FFC67DB30800D521722A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\CoreSystem.exe
Size 13.3MB
SHA256 b52197338afac3899832f31aab9c84b93e1d119f2886ce78ea6f11efd9f1ed3a
MD5 d3b0d8c318278a51f7bac2a3714827cf
SHA1 5010a48caf66c6b11c21eb556f719a3b2f4dded9
SHA512 314e0ed3d96bf41f0be2600a547c7c64be1f221eebffc1c3d90570a3f54c6591da05f545b45416aa45ee0ae32c89c6aedde833846f1ec8ccc02e7dbb7c196708
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVpSG:4JwMrcMGVg7
TLSH
T11CE633E9385E66ABD20D1C7A8E068D7635FC1BB19B548C97FFC67DB30810C521722A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
Size 13.7MB
SHA256 423bd76216071b4e720e56dae0c8151eb4f811002223f5566b37ccc72e63908b
MD5 be1628c212ecbda6864e337599138e3d
SHA1 ff2411720f12498e2cd4a683d6984bacaeb97d7a
SHA512 86b9527257ae56cd42d659e68ca3ad85531beed0ec553f9a2eab7b1a7ae26a5859f6332d137484b3fc0623e60fd3bc7ef8423c9a6da22bda602a5ea27d74a246
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVpS8:4JwMrcMGVgT
TLSH
T17BE633E9785E66ABC10D1C7A8D068E7235FC2BB19B548C97FFC67DB30850C521722A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\InputService.exe
Size 13.6MB
SHA256 5a68e9da7c8588a7681121cf89a9e0114c5e97c997b3d95ee0ef545303dd8b4b
MD5 c314d01fbbc4500e507b4a78dbdb6543
SHA1 5e5786804f57fc2cf8a4fe4ac933c9579207dcb7
SHA512 cd645d5b0f691fc97169b479f8fd3a466e55e80f8bd8b5591ac20e15104825dc86f374f306ecf245afd3c59aa10837633cb217070299f8f3cc1f15b994baa549
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVpSa:4JwMrcMGVg7
TLSH
T107E633E9785E66ABD10D1C7A8D068E7235FC2BB19B548C97FFC67DB30810C521722A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Temp\SystemHost.exe
Size 13.8MB
SHA256 98dc477e58ca4ebf3eb84837913fc5bc40e5eb9af19fb7d33f2d73e866e46ad6
MD5 e26bc458e33b27493abd60d0fdbc610f
SHA1 e0dc1211f2d94854dd22cc587d923567787728e7
SHA512 984090ce3c6d53aaeaff7d5fa8cff0da6a426223b7f4e96eff79b1b1c6630ccd36d97e1b4bfd889c1f2787330d013f2d541aade151a088f435b73a5885462e6f
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVpS9:4JwMrcMGVgm
TLSH
T130E633E9785E66ABC10D1C7A8E068E7235FC1BB19B548C97FFD67DB30840C521722A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe
Size 13.5MB
SHA256 ac8fddc1cd76faf1723294f5508a738bcad1cfb8e0473e73985a4f72153bf42e
MD5 a0d6e6d55ce4b808a704824ba678da88
SHA1 4dd09bb373e6408af9758f2686269abf3e3b5278
SHA512 bd598d1722531fb4079b9f30f1002bd0368bc4f002173681a0dd9356fe9fe8d50060e795df88938b7921de86983ef2fd3a94c0ada1d7d9deb1c1411ce0363204
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVpS+:4JwMrcMGVgN
TLSH
T1F5E633E9785E66ABD20D1C7A8D068E7635FC1BB19B548C97FFC67DB30800C521722A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
Size 12.7MB
SHA256 46bcb9c12cfe6951a140cefe64f7b10d8004e9d7a7aca3397c74deb31b00c90a
MD5 b07288900aa42bd9c508bfeee875bf17
SHA1 50edec1ab8190ee04896fb5f3b9f79b13cfef9d9
SHA512 e63632f1489079eb39f6c1eae325f3083eb35436669b918f0d76d341bf297b51e90e08f4e233381c03cd8b980543a39c09076668c72650d6deeb7caa664e48ec
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVt:4JwMrcMGVg
TLSH
T1D1D633E9785E66ABC20D1C7A8D0A4D7639FC1BB19B548C97FFC67DB30800D521722E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
Size 13.4MB
SHA256 73313bd72056ed63157031f8a3cadd00b9d6a26cba768fca76dc79a68dd62edc
MD5 f70112f479bb56142d821f8abb4eb7fb
SHA1 39abee46835d2d5f6103355cd18fff66788c572d
SHA512 7accd053838fbe6ee06fbc1c55bff95fa282679f11761e1c60fc9c9f2ec50f5623fa58422cacdb6244cd469f04f8bc8c172469da9f2f68768f271ac21a49a9f2
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVpSb:4JwMrcMGVgo
TLSH
T189E633E9785E66ABC20D1C7A8D068E7635FC1BB19B548C97FFC67DB30810C521722A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe
Size 12.9MB
SHA256 aaa285d44bbd2dab92c06f770c1b713c02838a8c4993827c3ebdb08f09543c87
MD5 5e201acc2526278595730eb04bff3355
SHA1 c717652f7ba8f69cc6b7458d5c9b519a0c5c762a
SHA512 05c1552b90c3f048f3fe1b4dda783d99506dbe4dd9abf23ff53ac53761ac926b727485abc3a1420fd13086d3172ba247b49e400928eab8725574c5dfa4bff2ef
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVpSv:4JwMrcMGVgA
TLSH
T1B2D633E9785E66ABD20D1C7A8E068D7235FC1BB19B548C97FFC67DB30800D521722E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
Size 13.2MB
SHA256 5206fef529706b8038db9ec45f3dea3f239027df561dfbef67306004372bc6ef
MD5 5a4dada7e50472f9d778329cf5363416
SHA1 2bfa73f1396cd82180d143bebe77433b6526cd84
SHA512 80586f2e56a9a2f1adddf7fa49d8e465fe0c1e4134ea4bdea1ede7112212d8f1f89841fa1dafd80ee74f0c6b2221b08cb469a6912919f0ebf79b74f4d8029964
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVpS1:4JwMrcMGVge
TLSH
T115D633E9385E66ABC20D1C7A8E068D7635FC1BB19B548C97FFC67DB30810D521722A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe
Size 12.8MB
SHA256 36a0e422a890e173320f280bc9ee37ac4f2fefa5e2f93d4f54c7fad49ae713cb
MD5 870de51e29de8632fd01820481649854
SHA1 74ffec23dd0b243e883f9daa794db1cc60a12529
SHA512 ce8745c435e11fd5d1e89b44685c9a73a0460bcc79e2c30983c6ae6bb4e60ab2d9f5232ae14f24d29897ba3c5f9380ac71ed4e3c241468b266d1123d34eba81e
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW5NTm+eVpSy:4JwMrcMGVgf
TLSH
T1BED633E9785E66ABC20D1C7A8E068D7635BC1BB19B548C97FFC67DB30800D521722E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download