3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c

Analysis

max time kernel
147s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
Size 5.6MB
Sample260925-thnmeszgnf
SHA256 3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c
MD5 16e83881931ae307bb33be3e1febfab4
SHA1 2ff945cf82769579afd10b46773cfabb3650e98a
SHA512 58bc1a9494702173b6e97d10fac0cdca80a15a506380bcd36e124e2d26834c68a31cbd186925a25d87eb53939101297ce3e301fe0a520a1220406830ebdfd841
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3pHknQPo:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQw
TLSH
T12E5623E5785E6AABC10E1C7D8E168E3535AC5BB0C7505CA3EFD53EB60800D932A73972
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4844	DesktopWindowManager.exe
3352	DesktopWindowManager.exe
4076	WindowsInternal.exe
4632	WindowsInternal.exe
5944	InputService.exe
4204	InputService.exe
2536	UserSession.exe
6136	UserSession.exe
3328	SystemTrayHelper.exe
4400	SystemTrayHelper.exe
2972	CoreSystem.exe
2876	CoreSystem.exe
4900	RuntimeBroker32.exe
5208	RuntimeBroker32.exe
6040	WindowsHost.exe
4480	WindowsHost.exe
4868	SystemHost.exe
1080	SystemHost.exe
1684	WindowsShell.exe
676	WindowsShell.exe
2104	UpdateService.exe
2200	UpdateService.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\CoreSystem.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\RuntimeBroker32.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsHost.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsInternal.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\InputService.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UserSession.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SystemTrayHelper.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\SystemHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsShell.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UpdateService.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\DesktopWindowManager.exe\""	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe

Contacts third-party web service commonly abused for C2 1 TTPs 17 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
41	raw.githubusercontent.com
50	raw.githubusercontent.com
143	raw.githubusercontent.com
158	raw.githubusercontent.com
9	raw.githubusercontent.com
81	raw.githubusercontent.com
119	raw.githubusercontent.com
132	raw.githubusercontent.com
29	raw.githubusercontent.com
55	raw.githubusercontent.com
67	raw.githubusercontent.com
93	raw.githubusercontent.com
103	raw.githubusercontent.com
106	raw.githubusercontent.com
116	raw.githubusercontent.com
155	raw.githubusercontent.com
1	raw.githubusercontent.com

Detect suspicious telegram bot 12 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c49e-30.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4a8-79.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4ab-114.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4a8-148.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4ad-183.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4ae-218.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4ad-253.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c4ae-287.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c4ad-321.dat	suspicious_telegram_bot
behavioral2/files/0x001100000001c4af-355.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c4ad-389.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c4b0-418.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 46 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4100	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
4100	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
4100	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
4100	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
4100	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
4100	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
4100	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
4100	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
4844	DesktopWindowManager.exe
4844	DesktopWindowManager.exe
4844	DesktopWindowManager.exe
4844	DesktopWindowManager.exe
4844	DesktopWindowManager.exe
4844	DesktopWindowManager.exe
4844	DesktopWindowManager.exe
4844	DesktopWindowManager.exe
4844	DesktopWindowManager.exe
4844	DesktopWindowManager.exe
4632	WindowsInternal.exe
4632	WindowsInternal.exe
4076	WindowsInternal.exe
4076	WindowsInternal.exe
4632	WindowsInternal.exe
4632	WindowsInternal.exe
4076	WindowsInternal.exe
4076	WindowsInternal.exe
4076	WindowsInternal.exe
4076	WindowsInternal.exe
4076	WindowsInternal.exe
4076	WindowsInternal.exe
5944	InputService.exe
5944	InputService.exe
5944	InputService.exe
5944	InputService.exe
4204	InputService.exe
4204	InputService.exe
4204	InputService.exe
4204	InputService.exe
4204	InputService.exe
4204	InputService.exe
4204	InputService.exe
4204	InputService.exe
2536	UserSession.exe
2536	UserSession.exe
2536	UserSession.exe
2536	UserSession.exe
6136	UserSession.exe
6136	UserSession.exe
6136	UserSession.exe
6136	UserSession.exe
6136	UserSession.exe
6136	UserSession.exe
6136	UserSession.exe
6136	UserSession.exe
4400	SystemTrayHelper.exe
4400	SystemTrayHelper.exe
3328	SystemTrayHelper.exe
3328	SystemTrayHelper.exe
3328	SystemTrayHelper.exe
3328	SystemTrayHelper.exe
4400	SystemTrayHelper.exe
4400	SystemTrayHelper.exe
4400	SystemTrayHelper.exe
4400	SystemTrayHelper.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3352	4100	3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe	94
PID 4844 wrote to memory of 4632	4844	DesktopWindowManager.exe	97
PID 4076 wrote to memory of 5944	4076	WindowsInternal.exe	99
PID 4204 wrote to memory of 2536	4204	InputService.exe	102
PID 6136 wrote to memory of 3328	6136	UserSession.exe	105
PID 4400 wrote to memory of 2876	4400	SystemTrayHelper.exe	109
PID 2972 wrote to memory of 4900	2972	CoreSystem.exe	111
PID 5208 wrote to memory of 6040	5208	RuntimeBroker32.exe	114
PID 4480 wrote to memory of 4868	4480	WindowsHost.exe	117
PID 1080 wrote to memory of 1684	1080	SystemHost.exe	121
PID 676 wrote to memory of 2104	676	WindowsShell.exe	123

C:\Users\Admin\AppData\Local\Temp\3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe
"C:\Users\Admin\AppData\Local\Temp\3192481bb76998252987c43c4b0ab7f62e193bcc53dc49b5ca05d7e8d29b3d5c.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:720

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4632

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5944

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2536

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4900

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5208
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:6040

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4868

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1684

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:676
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2104

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2200
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  PID:5776

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 f7cb80d8e1e6b0ccfe0b9c679ba312d77f64f9502cff386933ba749d2dce13f5
MD5 b2451bef54b51146480cefc4cd76e63e
SHA1 c23e495150a7796292ecd495e2bf8c0d951792d5
SHA512 76ae8667711a688d7c3c52d3dd15ce6b99e5093645a6db2107e156f24e3d842fe471b645a4a38e83037750f54003a9bb3728454229e15aee57e893fef0b7b4e3
TLSH
T191E07D06077C40827767593499E144363460145F94685E1A291C4AC50E9225FD907101
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 b2f485b77661e0d38c0e523014d2065b69c2ad75c98279ceed44bdd21e69a68a
MD5 e8009ce7218dab8d719797b773540ee7
SHA1 7665e80943bec8f551e9366ed26a88a92bd5de5b
SHA512 d239e41d7404e5b5f4ae6699eb6963a37b825bf41dc6f7cbb66b37d97d059b50e504c7a013a66fa1edb3d98b1d078c59883c037fc83936b988268488e4a55370
TLSH
T15E41D7DA5F2834A0FF81CEA06879C6322E3CF2D18995519670F6C8B224857D01C0689C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 a68218899b1a409d5089df3894ec2bdd43f1b0947fb7898fcec41f15bcef9a8c
MD5 6f38a043dcc4b2214c6da350f88d8110
SHA1 02d6fd79fadf76013d173bc18f6cc4f3e0633fd5
SHA512 095abb2e0a9791447a6406f849b3df270c631361a965976d50058f9a7e665ea8746114086b3e77eac1acccff622875ff4e20fcb6bc2c69837d3bc7848ff1d579
TLSH
T1F6D02B1603BA5CF53E259C6096D0A074346354A733C75496501AC796651DE393A02144
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 0a49b3aa2c2ab428b1a1c4459ff106cb7acd87ccdb3ec3cc18f1765fe079f272
MD5 91618790c8b9fb88f4b1bf1f09223dea
SHA1 5b6cbf72b1345f9b16e0246e177230c7695e70a6
SHA512 c4d15b05dff4a87b1b80cff799e4fda51b65f7fa0c8c833f1cccaac7a5fb76e861e8270017556e6af666a175e80e4d4a11d91cc9dd211f3a258f6841dae144fa
SSDEEP 3072:cexbv7DO/fCoWUyRWWQeGbvHotivSqhLvbh6Odp:n5v7q/+DWpeGLgaFhLvtj
TLSH
T167042C646DBBB5A35E4ACE624C99BA9612F561DD2012772F7E307E105C03ABFCE17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 7dd1ff632ddd6df8ebdf2bea038f358372f4d43ed9624a86ca916a0cf1c90287
MD5 17910262c69f48b19ea6220188a16712
SHA1 2836896bb7a343f84082ce5c209fa62e836cc453
SHA512 7d287245f7703f88985fb33d287b96a99ed98c5062f79ebe07d33e83dc46ea407a9d23cedd0bfd58d36bd957391aa2510c85f295c631a384c893ee058976f522
TLSH
T1FB1121865FB460D096F35260C7F8C9327C7464CE3CEA38D55C838896346A72D2B0543F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 d9d92bb5e0f4a161494ae9e9a8002f2a5223422e25337b493879d69afc780188
MD5 728e32bc104abb055bbfa2e2aabfeb72
SHA1 0fca357807d792d3c40423fb12ecb53a6b013a70
SHA512 552716b4359da19f09d14952a4ab8ff303d7d30800abec132be9ec23a4a1eef0a8c54edde11208de26e4d7bbd6097aa5ed744812647544ad1244210b5a62dc96
TLSH
T19841C7E72B1975A47E419F8B2EF8C73A1E3890E562C40C82B5B7C892119FF90591244C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 f0c9ef5010463b49586c75638c1a9f1077262087d95bbedd9337babfaa2223ec
MD5 e8448166ab08b41b9984974f73f43cf0
SHA1 a1c4b863826930994a0505d6c5103eec082d1657
SHA512 3f065bf5c0c26be67d53397dd27225aafe3ec71080cbe4ca070f5a4d7619bbdabb69b83db4f766ce860d26c8dfba8812eb534c7c2ecbc05f3508e8f161a503c8
TLSH
T1E2C08C1C1AA64A06F2A8437C02C17D039B208112E3418F051BF12A18CA96F162838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 477f59b64b41a43bc46755d4fa7578c6626d325aec0a24dc3ec3a67c6d5fa32e
MD5 fc64d3bcac6f4e30ddc9753aee66ca54
SHA1 1a61ad9880581da1c7fa1aa8cb813822ea464d87
SHA512 575ffd67e9c4283bb34e0430d292888cb4c351b437b0e03f8b8ee4a2897756cdd7fb49ab84a84d7624999bd8a4e561c38b1c7d319dad32e966d08116ba542119
TLSH
T151F05C3C2AFC907DE5B3DB7C8BE6B6529D1DF112240401EC1ED24A0A9A09E007CD103C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 22e06dedc2a865bff70a543376b7446bfa487fe40c9262eb62116d0ebbd6b190
MD5 eaa5eb80e4dd41af7bf2049e1d6e3fbf
SHA1 4f79737302c6bb8175263f43e71bcffa2e2abb23
SHA512 92185a89ac29f5ea5e3e64c953161c451a55f44e26a49425f486c4c93f80b7856cfd0ffa188129e56bddd53c527d78d8e452fc2678e4365746ef2038cd98f416
TLSH
T12BF0611039FF813EF022993483D5E2B19665F1113007257D27B713051D16F206C1260D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 b1a04d4d28c5a8daf29364ad94d3e4729425dc775e20207fe800fa106441dfe5
MD5 bb702f7ea0e499ed6658ad1e63d033bf
SHA1 68a7a1a151a2a406918673a6eb6ee61cf2b2ac5b
SHA512 16bb50b45a654f1ab33f3a9d327e651f2761b9a6495f292c1a6a39436a7d314cc74303d56e30bb3265f2a662746b34d407b9ffe1d04806a1b554584c53f4d7e7
TLSH
T14DF0A32415BC4109F076E978C1D96D767D75F11678068BB607D702075A51F404D9311E
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 3f6772554618dc4bc3682d9e0e5eb661050ec57f230f0bf765db253d097068ad
MD5 cdd957a77a2e57a232fb321fe6c95854
SHA1 3db62907771a71a53bb34e74da74c14ef8e5fda8
SHA512 745b6f3eca0557d8b63228c731cb4f0b6e5977f2d22ef46a0734864b814a101c7e3ad65597d75c2ded9e14754a5ad06edd0711f119f44ddeecb0c54d25a55453
TLSH
T1BFD022382B160336F0A88678D8A086C287A22026F2F213DD0FF8A21C841EB130C23D1E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 d36ef441a73416e4411720663c3befbbc4c482575a6593ccf0bfcdefccb33bb0
MD5 4ec135ae02788ac482ee24f308eece7a
SHA1 01509cb13112c124fe38a7b170ca7549a551b9b1
SHA512 58159406cfeb13d5953b4006ebd7276e1cb01a4ccc8ccb30e7cf125d28ad794e595577e8b97ce61c5282d7cdca4c7656cd2108f6e1226d2a140248f3f5d6b66b
TLSH
T18CF05C2806A2016EE272777585E593D6AD65F2973500D86916D10709F617F426C1253A
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 3120972320bcc1131f3bf28b630732cc137b403782a2f57306bf95b4616e783b
MD5 74da19cd1ea11ec3de300edd5e94442a
SHA1 4620aaa45531d9c354449fd499ec8560000f9a9a
SHA512 f766ba9abb08e4e56052acb3923e3efda4aef0b74d6305fe79a00ade943a68d872737e3019f51252f7e3426a0b978af97ba1e7a74d7fca64b6e56422933a9c90
TLSH
T10CF0AB3C30BB009EF632D6BD03C121D74663E53722096E657AA343086E42E407DB0E29
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 7970ae58da3eb01698a9d61d62dd7ffa82fc70a22289bd26458d7771257d1711
MD5 38cebe421a8933dc8ccdbf9bab25233a
SHA1 767aaa282a3682d050ad42677b3896274584936f
SHA512 dc4decaf5149bfe544227182b80f018755216472ce9de9704eb35dc403ca7e9ab1ee8d9311f7663ffe47db63cd824e5bc853ea4aca566e22c566b1734f0062ab
TLSH
T16BC08C1C06660A06F6A883B802C26A838A60C220F381AF0927B52A08CD29F122834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe
Size 5.8MB
SHA256 30240c336aab41bb886d787e8d84634f6da88d99a09163d7113447e3f0fbfc0a
MD5 e716e110cb36519b11d57d4d252edec3
SHA1 6897eacf68d3eeae9082c3852a4bbab5a431ac3d
SHA512 519a2508790a2de1bb0333bf7fbd3128da9bd086984fee98d39cddafa2e27fcc526a400d52b45d1d14cb2fcec3b1021f125dd665fe3395bc2ab99615a66e9d7c
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3pHknQPge:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQN
TLSH
T1715623E6785E6AABC10E1C7D8E1A8E3535AC57B0C7505CA3EFD53EB60800D932763972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
Size 6.2MB
SHA256 6f0d5a0bbba34d88f7111a9f75d58ee8d5fc9cae5b55876e3e98b871a165fd02
MD5 64617eee72013c59c71900774b92ce79
SHA1 ba061d243ea674e83e0e185dbdfedb4717ea3a8a
SHA512 14b27d796ae7c0a378535f16c2e4ea26f9e5279283a94a284aab774590a5517d07b2deb79f6c830263ff171365ad343dffd2ac97e6611d9918aad4533541dcf7
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3pHknQPgxPUF7m:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQ9K
TLSH
T18C6623DA789E6AABC10D1C7D8E168E3535AC1BB1C7505CA3FFD53DB60910C932B62932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
Size 6.0MB
SHA256 fa88b505ae84b14d922de9f553f46f675e65e6114ab5fe236c6a7493e4a36c58
MD5 55eab6cd7826be6d1b4cc560a6d9b153
SHA1 c72151d9f0fea50c13ed427f13788ddddeb22d76
SHA512 3d8b71d21570b3078704392004626f8a69f17e8874812d2044cb287d0491cf79bd9236d8627476fe2ae4b4e56e6a0264287fa14b94dec3a25865782120addc05
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3pHknQPgxPUY:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQg
TLSH
T1525623DA785E6AABC10E1C7E8E168E3535AC57B1C7505CA3EFC53DB60910C932B23972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
Size 6.8MB
SHA256 ce00a34106f0a689f816e7e4feee344c8418da208af1d1e55b5b63a99285e655
MD5 3a0620e308cf9a9f7b72e16b4e4cdddb
SHA1 166a64dc937b2ce9bcb3c24f441e456f1c829620
SHA512 5c9dc900a38c5f140745c155e69081a1df10fcc179c964ba1108027b2b1bf99ef1f1ddf757f1944017bf535555dd6ee99dedc308964b2eb85b709941a4262af6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQ9VKO:TDpbgBr/4QAMQ/ZRumQ9VR
TLSH
T1A96623E6789E6AABC10D1C7D8E168D3535AC1BB1C7504CA3FFD53EB60910D932B62932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
Size 6.3MB
SHA256 1d6c319c782d4b9ed116001021ba448336103ec0504a3af9a1ccc5702c5dc1fe
MD5 93dc95e00aa4af5f865459a827947c83
SHA1 d58743b437ab6be52447a9b0a6abcb55219daba0
SHA512 d8cc10ab9523426a95c2f33b98483ea374d5e4dba3763145bc18de1bfca3c80e365019c0a82c0a200c47b235fcb3c6059f0caee4647f11a17ec554a61f73c1e2
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQ9Ve:TDpbgBr/4QAMQ/ZRumQ9Ve
TLSH
T1EA6623D9789E6AABC10D2C7D8E168E3535AC1BB1C7105CA3FFD52DB60910D932B72932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
Size 6.5MB
SHA256 ce3271e0fd83a5f22d10dcbc99e90e7f568563cfa2a9db575d71b53e6c32042d
MD5 06941490f18bedfc2e6757e752291cd0
SHA1 9744f964e810f86ef8c3d7d0790442e6e040ed8f
SHA512 4c0e237e2da3f126439c1f5d5d016a68d40d052fd6839bb415f958f480765f3ecf9336f13a4edfd0a5d16e6d68eda78958741b5d0f4978bbcbf6c42372a01926
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQ9Vf:TDpbgBr/4QAMQ/ZRumQ9Vf
TLSH
T13E6623E6789E6ABBC20D1C7D8E168D3535AC1BB0C7505CA3EFD52DB60910D932B72932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
Size 6.4MB
SHA256 8878adf3ac06546319e8671913d31ce32ebdf7cdaa4681204a376c091982a5b5
MD5 524fbceb6b180ae639fed523b731dbed
SHA1 e20389c044de274e0c8b49bad999f4916aae1b31
SHA512 be04f2144e8cc3e3e8b5a6bfaaf85c2cccb1b2328e2550f67464b3a2c149ddda6b45b13c17d3dba1bcc4b07d1622b15fe0f6bc1cb903106e2fa54510af53410c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQ9V8:TDpbgBr/4QAMQ/ZRumQ9V8
TLSH
T1506623DA789E6AABC10E1C7D8E168D3535AC1BB1C7505CA3EFD52DB60910C932B72932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemHost.exe
Size 6.6MB
SHA256 b5e11da0ba79c9ac0b69c8739ea7bb1cac940b8d8346351fa25a73060c891d6e
MD5 7fae311832f41dd2718004f637311594
SHA1 f272a3c8fdca4bb6e26ad83d90027df86b406f46
SHA512 0c9deefb4bc5084ff0ce517f9a02154e93b17ac86e99b95834a948bf6cee6ce9a804a6ce6104210a1214cd3c5f3751a3288c1e1e15954de1f6ba05e6e8b3124b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQ9VKP:TDpbgBr/4QAMQ/ZRumQ9Vy
TLSH
T1EB6623E6789E6ABBC10D1C7D8E168D3535AC1BB0C7505CA3EFD53EB60910D932B62932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
Size 6.9MB
SHA256 9bf0d81d7f4e490299c1880d78825d2c65910b9be0bc74264aa245aa73ecb771
MD5 3bf16a51baa10c4b1ccd9c943efde077
SHA1 0ca25e9af3cb8b2f49c325a831f9024f2a2b31ce
SHA512 0f74cf2f9f78decaf26ac513b874f392e1c21b67fab4cf31e7fac790f51bd3e205c51591e605a7edfb68a98afed51648ed54f78dc4249b8deb1f82c0a9835293
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQ9VKTBi:TDpbgBr/4QAMQ/ZRumQ9Vki
TLSH
T1C37623E6789E6ABBC10D1C798E168D3535AC1BB1C7504CA3FFD53EB60910D932B62932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
Size 6.1MB
SHA256 c0d212089e620b1d28e8d4fe23b5fe51a9a92ecdf3ce41619102f7e69552389d
MD5 c96ab36dd843839ca86e71567d18b99d
SHA1 95336f68142286a07268587da00b32be1548f693
SHA512 c5d43e7385f31655db06078e253c286811923fe072ee95289f88d7069b7e39e079f492d38f32df458c3ab77a74b61f54acf7a366e2e59822c7f534d0b2c19c4b
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3pHknQPgxPUk:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQs
TLSH
T1ED5623D6789E6AABC10D1C7E8E168E3535AC5BB1C7505CA3EFD53DB60910C932A33932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
Size 5.9MB
SHA256 3fefcb967f8316d61e0ccb849be6a217c067013c76877a05d1de5294714faf34
MD5 66c386e49ff768898efe51da24aa0da1
SHA1 f20f9fcf1e91b1302d3cd492809bf2d825aafe60
SHA512 21f56696c1694618021a31a9064a2f3b1faec3409e6b6aa57850a4ee800652a6d5927214713979ec76eced864a72a24093d804a28040456e0373cf230f525750
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3pHknQPgxP6:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQd
TLSH
T1225623EA785E6AABC10D1C7D8E168E3536AC57B1C7505CA3EFC53DB60900C932B63972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 7.0MB
SHA256 a32cf6a4387a2d08d44df8a3c0640fb151ca77ba457a228932fcb67a1f295fd8
MD5 ff84fe4c1965c724512a79278c89c2da
SHA1 4a7aa35a1af64de95fb14a71aa1cd24c9b012604
SHA512 a1ad4c29651d021577e78c4cb77c4a6add5de78d5792222f01cc43b4d0654f151521c7bf7b13af4cecf19aa0e85e0fabdba20118ff97fbe7c791e4b3e73ec1da
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuunQ9VKTBGQ:TDpbgBr/4QAMQ/ZRumQ9Vk5
TLSH
T1E47623E6789E6AABC10D1CB98E168D3535AC1BB1C7504CA3FFD53DB60910D932B72932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download