73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
Size 15.0MB
Sample260930-r7ls1sae45
SHA256 73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd
MD5 26c2b36d273a5053b550c0f37877c446
SHA1 67d2e4d2a7f94c5d2a5de896ed262f52b1a25588
SHA512 80b8daffda99d43f969544c16919e7971f9fc9096fa98cc6731fe92b79e6a376b4b4c56c13a6e0148ff11763305dda5fdc6b6494ce0b58d0c0e7412a3b939498
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mp3N/0wAxl887h:4JwMrcMGFyo829/Tgv
TLSH
T1B8F633E9785E66AFD10D4C3ACD068D6339FC1BA1CB248DDBEFD5BDB21840C521722926
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
248	RuntimeBroker32.exe

Executes dropped EXE 17 IoCs

pid	Process
248	RuntimeBroker32.exe
3120	RuntimeBroker32.exe
6004	WindowsHost.exe
4116	WindowsHost.exe
2592	WindowsInternal.exe
1884	WindowsInternal.exe
2240	RuntimeBroker32.exe
4336	RuntimeBroker32.exe
1460	DesktopWindowManager.exe
840	DesktopWindowManager.exe
5560	SecurityCore.exe
5936	SecurityCore.exe
4948	UserSession.exe
2464	UserSession.exe
692	SystemTrayHelper.exe
2276	SystemTrayHelper.exe
3016	WindowsInternal.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\SecurityCore.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\UserSession.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\RuntimeBroker32.exe\""	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\WindowsHost.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\RuntimeBroker32.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemTrayHelper.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	SystemTrayHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
39	raw.githubusercontent.com
78	raw.githubusercontent.com
109	raw.githubusercontent.com
51	raw.githubusercontent.com
58	raw.githubusercontent.com
73	raw.githubusercontent.com
88	raw.githubusercontent.com
100	raw.githubusercontent.com
1	raw.githubusercontent.com
13	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c503-26.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c507-97.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c50a-101.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c50b-135.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c50a-169.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c50b-198.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c50a-232.dat	suspicious_telegram_bot
behavioral2/files/0x001100000001c50c-266.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c50a-300.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4968	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
4968	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
4968	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
4968	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
4968	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
4968	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
4968	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
4968	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
248	RuntimeBroker32.exe
248	RuntimeBroker32.exe
248	RuntimeBroker32.exe
248	RuntimeBroker32.exe
248	RuntimeBroker32.exe
248	RuntimeBroker32.exe
248	RuntimeBroker32.exe
248	RuntimeBroker32.exe
248	RuntimeBroker32.exe
248	RuntimeBroker32.exe
4116	WindowsHost.exe
4116	WindowsHost.exe
6004	WindowsHost.exe
6004	WindowsHost.exe
4116	WindowsHost.exe
4116	WindowsHost.exe
6004	WindowsHost.exe
6004	WindowsHost.exe
6004	WindowsHost.exe
6004	WindowsHost.exe
6004	WindowsHost.exe
6004	WindowsHost.exe
1884	WindowsInternal.exe
1884	WindowsInternal.exe
2592	WindowsInternal.exe
2592	WindowsInternal.exe
1884	WindowsInternal.exe
1884	WindowsInternal.exe
2592	WindowsInternal.exe
2592	WindowsInternal.exe
2592	WindowsInternal.exe
2592	WindowsInternal.exe
2592	WindowsInternal.exe
2592	WindowsInternal.exe
4336	RuntimeBroker32.exe
4336	RuntimeBroker32.exe
4336	RuntimeBroker32.exe
4336	RuntimeBroker32.exe
2240	RuntimeBroker32.exe
2240	RuntimeBroker32.exe
2240	RuntimeBroker32.exe
2240	RuntimeBroker32.exe
2240	RuntimeBroker32.exe
2240	RuntimeBroker32.exe
2240	RuntimeBroker32.exe
2240	RuntimeBroker32.exe
1460	DesktopWindowManager.exe
1460	DesktopWindowManager.exe
1460	DesktopWindowManager.exe
1460	DesktopWindowManager.exe
840	DesktopWindowManager.exe
840	DesktopWindowManager.exe
840	DesktopWindowManager.exe
840	DesktopWindowManager.exe
840	DesktopWindowManager.exe
840	DesktopWindowManager.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 3120	4968	73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe	91
PID 248 wrote to memory of 4116	248	RuntimeBroker32.exe	94
PID 6004 wrote to memory of 1884	6004	WindowsHost.exe	98
PID 2592 wrote to memory of 4336	2592	WindowsInternal.exe	101
PID 2240 wrote to memory of 1460	2240	RuntimeBroker32.exe	102
PID 840 wrote to memory of 5936	840	DesktopWindowManager.exe	107
PID 5560 wrote to memory of 4948	5560	SecurityCore.exe	108
PID 2464 wrote to memory of 2276	2464	UserSession.exe	113
PID 692 wrote to memory of 3016	692	SystemTrayHelper.exe	114

C:\Users\Admin\AppData\Local\Temp\73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe
"C:\Users\Admin\AppData\Local\Temp\73fea14fc3cd32759c0c75decde339e9d29455123d95ff85cf63b1775e6abdfd.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3120

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:248
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4116

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1884

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4336

C:\Users\Admin\AppData\Local\Temp\Diagnostics\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1460

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5936

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4948

C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2276

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:692
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
MD5 eb444c59d03b1567ebbb5e58480a6eef
SHA1 e638b0d4f8bc77cb263d4e561ca3cfd1e286432b
SHA512 43cc6537c3b42c6a520ad798c7d57f02e3a6770d08ee501ac16a6db81365e6c09ba75a15d2b614b2b19ab3d667c9753a671c6e77a54797011705393da73686f8
TLSH
T1D9E0721A362DC0DABF6A49394A6250BF78A1008F00CD855A342C87F84C8262F9F0BA08
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 714842d12308ec0508c43b1dd6552bf8dc987d1602cc840daa4b561e150e8e23
MD5 957a9a3e1f192456189b729d0a0c21da
SHA1 f554f0ffdc1ca76dfd72a7132d347dc9c75b46d2
SHA512 f8b3574ac040971d5a2d5d2c387141929030af00b823c800beb13fdbcbfc0332cc2f76887df9bc5b41c1b58c9ee161df6f26a5d657fbc7da010240bacab52b98
TLSH
T11E41F8DE271C3019BF868F803878C6322DB9F1D1858954A670FBC8F1B096BD02D2A48C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
MD5 32d66548cf2a8f1b6b0ab9d6c335806c
SHA1 69e42d1c9f5e7760749da4331591e196bba4b81d
SHA512 f8d7ae900b29dbddb66293c320367f3b4dc41ecd372baed0f690bd657d8d92c77f8dd5cb3a10b7d93e1b1d7ed2a90c12d3461dde8845e2c7eeef1ff2c3237842
TLSH
T1A3D02B1D15F56D137E27991487E8E56174651A2713D0485C14498677A8015E9194F704
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 183KB
SHA256 2168e10e619ee6e9c232b88753b33ebcbb2df57abd1b848210b82a590137acf4
MD5 3561c7a08e83b9954de93c99f92bba18
SHA1 6710e30265a3591fb2ccf1f715e35740834ca6c5
SHA512 1eb2a7ece4bb92e0a7546bc18e544c3d6b40e1baa0976848bd716ef4540c7b66dd9e1acf14e9b206b406a9e7c4853c5be80c8c8c2f684f850add909344efbe3d
SSDEEP 3072:XexbxtZL/ECmTwPA1W4wA3l1QticEFhEmelj6OdDy:O5xtp/CF1PwA7odYhEmuHg
TLSH
T169043B646DBBB5A35E4ACE620C99BA9612F561DD2012771FBE306E105D03ABFCF17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 e0e7336a1c7c64caa65ecd69b0c3a40929a71e78b54170a9296636677e6bd991
MD5 466320b68165b6147e7e6af998c3a6da
SHA1 f97bf2efdd7d50b871cdc5b0abba2adc09d3fc63
SHA512 5d4f0eddf2ca6c044fee918fa15085be24634dc8f2818130094f8eccc4ed9ab9637531f5c9f41f2a6224bcfbaa31b8b364458357e1bc27652eb732432e373fd4
TLSH
T1F611E5865FF4B0D09AE25660CAF4D5367CB564C619EA30C12CC1CA96249775D2F0643E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 132c75bfd291b9f783c174e8598359524c23f8e68b8fc9ad44071b2d508cf669
MD5 517f60de1d0eeb69c59d9d4cfb9b19fa
SHA1 dc99a3568164f6bc16f22cf2d39c110d0b8cedb6
SHA512 74da1d4c84cf95e51fce2bcc8233b74f468d263a7bc638c2025508d1efe2e76b1167b02237f2b3840486ab6a7ce2871813d45be6c85a7bc4351b4ba236b4e60f
TLSH
T1DB4118EB1B9B3A54BFC1DF4E59A9CE311E7D90E892800C027573C8C714ED7992A0A84C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 0a10aa9fe9fd16f6945e567aea29789d0ceb191b6500c15e43dd894e8cc1e9c4
MD5 cd54e79cb925b4b505c5152431161cc2
SHA1 c16a399b188ec9f6b1048abe94bcaee7fd9e67e0
SHA512 6cc04bee4e541de5f6bb5df7aa6ca14a2d06f12e1f725330aa0816831055e6eff8c50721a8f590c1436206cbc163f653c5b31f827f29e91e2f952be92f905340
TLSH
T1B9C08C2C1EA20A06F2A843BD82C23943AB219501E2818F051BF12A08C996B262C3CC2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 5999fc12fd10ab4327c4b65ddcfbb7b5a3b369e0795796d393fc1f1f02569700
MD5 1aba2e9645725efd2cee7aef1a62f188
SHA1 af5eebf0bd9463e32f971d865dd6b253f4d11480
SHA512 682ea99d0e7445d749211c9a633825ef1d448d642fe7bb225ee59001c24cf6ca7e038488dfae9fa73de081df8ff9ce4020cbc1e569efa2a3926f9e19c6321405
TLSH
T1D1F05C3C12FC804DE071DAB54EE5A2D56C14F523380485A90EE04648D901F005C9153D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 147014dc4cb367d127c23fe05ed076aa3e297deab4cdf6f26043d98ee7b8aeb4
MD5 eb4628e105f1a5a5bb55ed90941f6bc4
SHA1 8ce7ff3d79a1c08f73f864bb8294d0f85c668465
SHA512 c35c12ecbfc74a6f652ea51dc4b93a1320b7e4ed92b99adf24d3fb2a9f3fcbe18a5d2b9daf5c2d82135704d246b9059eda98f3d6483496e28b0060e4675d8e1d
TLSH
T1B2F068783AFED27FF03BDAB487C771705C6AA306641666B92AB027446F14F207C9121D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 c8217a415aa7358021c7597aecb0c18ab17ebe93423de3ce396cc623873ca59a
MD5 8426f9c94da4ac798b31ed53bd74a639
SHA1 738b7f634e1724c74581b6616d5601f398e7e9b6
SHA512 971cebd4169bc19073893fd6a6047805a77e12dffdb111834d680fc6b1edd1a4664778f71448c5f4660b41ae92f7d3aa0234bc89c2053ff688fcdb49b102ee59
TLSH
T195F0AB1028BC002DF8B3FAF9C2D221B6F939F119780583F60B9B12419B52A024D9212F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 c47765a6fcc96eaa0d4c364d78eeeb24033e9a9b31c39f864c65af63b1fc7e43
MD5 ee6971a3c61c8c5e2b1430e88b549f83
SHA1 8df5afbfcbd471a366ea7826749faabdc03f4a88
SHA512 246ace845cc04f5ccc607d124193cba611d6c47559a8779c520120d89c02a1c08bcee1d5a835c0bfb927ff9ba8c613d4e9144ba92da9edc3c6522df2a654b2ed
TLSH
T18AD022382F6242B1F26A06BF8AE20AC05BA27012B3836B0D4BB1234C8418F4F2C21C0D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 82dd014c8c6765a07d8df72ad34d291a5d5192bf87950df9fa26056b56962ba3
MD5 15c89c24fe2af00f1e9a77a4f4414dda
SHA1 b11120c83d53f99122b90a26926a35c2f78f266f
SHA512 e5d8753d62a1fdcd39d45ca8d43da0bfe6ef5065a40d0dc341a7223eac4a4c8983fcd6a239f0874fd0eb1cfc9dce7a631ff129e3de69e316aa8efa0910061891
TLSH
T14AF05C2412EA011CF77572B54FF592D66D19F3773040C85116E5170AED06F805E26535
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 0a8dc92779a77b277ab6cee3eeb262030433a89bb4bb0545fd61a0c12cb797e3
MD5 96f07d7783beaf26c1834104573d78b6
SHA1 cb2e4a78af93b9f10de610a951aeabb61e6b39ca
SHA512 207675e7ee7fc77e2c088fb80fb4d5cf0864da08d32f2cd05f3b3caa9a264c422232365f566e78df7d35d516f3535d7186cd7003bd826c380d61a0e8bb917eaf
TLSH
T18CF0AB7C25EB025EF201E9FC46C261D96A23F23A38482756BAB00205AE06E40BE31929
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 f95db92738c55f0f849493faeeea39d01e544f755c9978c7c21fd6c5e2067d7d
MD5 48448f5ff0d77e3f0bacf0f376282a7e
SHA1 e455aee169c1db1f72713ee3086287dabc1f613a
SHA512 e321481032d20cb8a09ffa667617944b9c3823ff3a35a93abf19cd82576ec8949c921afec7fae3e3528b1e19e1510784211ff6bf3d2b18524fe5795c3a04b352
TLSH
T143C08C2C46610A06F2A883BA02C329C38A618111F382AF1127B12A08CD24F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
Size 15.2MB
SHA256 ecd60ce9b2520837536d49512792e3fd7a59b4d22b87d3d62c3654ee64eea575
MD5 cd27e1b36618662a9362bf62b9edb519
SHA1 6874b4b43357054080923170521eb29fbb579662
SHA512 c6ffbbcad91193ad620babf11476cce69ca09267508226e49a841bb3d0171308fe74aa0c6e8e506a8412c2c3ada6da18e68fdc9774f253db40cd088ed5b836e0
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mp3N/0wAxl8871:4JwMrcMGFyo829/TgL
TLSH
T1AFF633E9785E66AFD10D4C3ACD068D7339EC1BE1CB248DDBEFD5BDA20940C521722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
Size 15.1MB
SHA256 f8a07bac1efb2e22e0ddc77253004f41e8d6b31dc9fc7ea4e237eced4fe87755
MD5 4a8cd9431a83a6fd16e5dbb38bf18def
SHA1 d0e667a926062b5922e939e6b94b4a4d671d39df
SHA512 20e1ff148dc7b302e99c5ce13f86eb1825d7e42124bcf1d1adceeda03bc77473522b8327a8fa3955e9f0ed28883b55abdefe72d1d558d022b0c89f540f89c468
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mp3N/0wAxl8874:4JwMrcMGFyo829/Tg2
TLSH
T131F633E9785E66AFD10D4C3ACD068D6339EC1BE1CB248DDBEFD5BDB20940C521722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SecurityCore.exe
Size 15.7MB
SHA256 2cae7b4110f0a677200432fdcf7ff48aee93ee5b9fb7b8652d4492c9e2b7db1d
MD5 34568d060fe0865417ad5676c3e7891d
SHA1 06de624b6aa49b371827425e45fc889e62cf8f1a
SHA512 a4c90999ee781f6625ec399baec28fd69cb95f891b4e8d8f33a0862f7da832043e156938a8d6c8268fccf461c0d28e260d1e4fdf878ea62968c29486b3c8206a
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mp3N/0wAxl887CZ:4JwMrcMGFyo829/Tgs
TLSH
T19AF633E9786E66BFD10D4C3ACD068D7339AC1BE1CB148DDBEFD5BDA60940C121722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\RuntimeBroker32.exe
Size 15.5MB
SHA256 9e4978ed255822737473aa515161556cc823702ee460e53813edbb6e624f82ff
MD5 96fb9a25af6a97e52d0e82a9a3609ce0
SHA1 4faf8739f5c9991a21ed78714f22d187d6e0f2ea
SHA512 efd8da666e9ac575023e142f4d5df56048172c973f0609d73588b3dfae4bd220ff02423395aee2c539d845cd1a861cf6557e8ba1e0b09cf00b2425ce2a9e9270
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mp3N/0wAxl887a:4JwMrcMGFyo829/Tgk
TLSH
T1A6F633E9785E66BBD10D4C3ACD068D7339EC1BE1CB248DDBEFD5BDA60940C121722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
Size 15.8MB
SHA256 7af12efa239e447596d2e7d901635c642937292fc5285618b6f672c661b3689c
MD5 4b2fd1be76e3c51354fbf37010225e3c
SHA1 ced97d04c128bbedb99108b89b19c52c803fd62b
SHA512 420b1c86cf994a10c5362262331d12064cd8118bbcb47f03154354b4689d7da6349a0d6b0e49ddbd8318792c5f8663cee807ef91743ffec4ed3b868d992c1e07
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mp3N/0wAxl887Cr:4JwMrcMGFyo829/TgU
TLSH
T143F633E9786E66BFD10D4C3ACD068D7339AC1BE1CB148DD7EFD5BDA60940C121B22926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
Size 15.9MB
SHA256 e762ede96d4003f6c8e6f1ed958fc8a612b3fe285485aceb05b8508967db3572
MD5 e4da2ec00f8e5179e55bd3168a263bce
SHA1 c83df8bbbf4a860c92312c4f0c5f7482eb84c576
SHA512 9a3c4a5ad57301f8be930aeb9480835244e1afa2ef1f8a7a49619b25efb782c03804a4731c0f1ae6347dd0fb6c218df6272742c2075e0ea64e9788e0bbe3ad03
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mp3N/0wAxl887C+:4JwMrcMGFyo829/TgF
TLSH
T133F633A9782E67AFD10D4C3ACD068D7339AC1BE1DB248DDBEFD5BDB60540C121722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 15.6MB
SHA256 f0c3507568a74d0947e54516f7965db3d938c7f65da2bc9aadda0e40ad89af0a
MD5 501e6eda87cb214818b6644e8cac459a
SHA1 c725e8bb3c0319a76c62432355d546dde107f466
SHA512 8fec692b9a1721bfcefb47d47e2f0d754ad05e0bedebcb2ad7f1bab148fbfb14be47ce5eff220c0478ff65683973b40869a05bca3c2472f2470540cb736aae97
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mp3N/0wAxl887C2:4JwMrcMGFyo829/TgF
TLSH
T10CF633E9785E66BFD10D4C3ACD068D7339AC1BE1CB248DDBEFD5BDA60940C121722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
Size 15.4MB
SHA256 b11bb8795aabfe2f5dc9c61ef5d73489896843ca384e569ef961b17235757282
MD5 b7eba837e2d58d9b9d47b960d3dd00e1
SHA1 74da1de4975cf2a489f6e767df039141245d03bb
SHA512 36617392fc4cc4954f5fe3f0179db6e274ac58d01f17da6d01bfe880432621761aa313973bfc77ebf3dead544bf4f93b3c1d8bc762d807a2b134a933d0a4b91c
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mp3N/0wAxl887z:4JwMrcMGFyo829/TgZ
TLSH
T1A6F633E9785E66BFC10D4C3ACD068D7339AC1BE1CB248DDBEFD5BDA60940C521722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
Size 16.0MB
SHA256 dc2bba6fb218698536617d1e013e507294f267ca2cac53f6b573f6a92005888f
MD5 bafd3d058680d4ed1ac818f355ed8860
SHA1 8c7519246844ecf66faa09a52da812cd6bc8f50b
SHA512 9a96915679eba461ffddc3695b75b388aab9d358b4305579a7f4b2bac37294e16a11663455ec7dbc1015feb2beee4401b573c369bc4674760b959a06f50f804f
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mp3N/0wAxl887C4f:4JwMrcMGFyo829/TgP
TLSH
T1660733A9782E67BFD10D4C3ACD068D7339AC1BA1D7248DDBEFD5BDB60940C121722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download