f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
Size 6.5MB
Sample261012-sdxtvsfy8n
SHA256 f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a
MD5 19c3fb2f504f42324c1d00470ef67e40
SHA1 d04902899440f9cde858c96084db866c2c42c63b
SHA512 1dd6b7edb7f4ee8b0b4f6f1d8fc5bf113cedb1d725fa2abf1b605c72196be50f77aac56bf0ddac0e99540b3daa8e461a9aec791741addd67bd2650c64b1d304c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCXSMdm:TDpbgBr/4QAMQaTCvkA3Y8Nm
TLSH
T1CF6633E6785E5ABBC10E1C7E8D178D6235AC1BB1CBA05CD3EFD13EB60851D921632932
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	WindowsInternal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	SecurityCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	SystemTrayHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	DesktopWindowManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	DesktopWindowManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	CoreSystem.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	WindowsHost.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3108	WindowsInternal.exe

Executes dropped EXE 15 IoCs

pid	Process
4560	WindowsInternal.exe
3108	WindowsInternal.exe
5016	SystemTrayHelper.exe
3500	SystemTrayHelper.exe
3608	DesktopWindowManager.exe
5096	DesktopWindowManager.exe
2248	DesktopWindowManager.exe
2200	DesktopWindowManager.exe
408	CoreSystem.exe
5084	CoreSystem.exe
1204	WindowsHost.exe
2188	WindowsHost.exe
2860	SecurityCore.exe
312	SecurityCore.exe
2520	DesktopWindowManager.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\CoreSystem.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsHost.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SecurityCore.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemTrayHelper.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	SystemTrayHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
85	raw.githubusercontent.com
136	raw.githubusercontent.com
82	raw.githubusercontent.com
121	raw.githubusercontent.com
125	raw.githubusercontent.com
141	raw.githubusercontent.com
152	raw.githubusercontent.com
18	raw.githubusercontent.com
55	raw.githubusercontent.com
60	raw.githubusercontent.com
102	raw.githubusercontent.com
103	raw.githubusercontent.com
163	raw.githubusercontent.com
19	raw.githubusercontent.com
106	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x00080000000243ac-29.dat	suspicious_telegram_bot
behavioral1/files/0x00070000000243b8-83.dat	suspicious_telegram_bot
behavioral1/files/0x00080000000243c0-139.dat	suspicious_telegram_bot
behavioral1/files/0x00090000000243ca-175.dat	suspicious_telegram_bot
behavioral1/files/0x00090000000243cb-210.dat	suspicious_telegram_bot
behavioral1/files/0x0003000000000731-247.dat	suspicious_telegram_bot
behavioral1/files/0x000b0000000243ca-281.dat	suspicious_telegram_bot
behavioral1/files/0x0004000000000731-317.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 32 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SystemTrayHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	DesktopWindowManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	CoreSystem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SecurityCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	DesktopWindowManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3448	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
3448	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
3448	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
3448	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
3448	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
3448	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
3448	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
3448	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
3108	WindowsInternal.exe
3108	WindowsInternal.exe
3108	WindowsInternal.exe
3108	WindowsInternal.exe
4560	WindowsInternal.exe
4560	WindowsInternal.exe
4560	WindowsInternal.exe
4560	WindowsInternal.exe
4560	WindowsInternal.exe
4560	WindowsInternal.exe
4560	WindowsInternal.exe
4560	WindowsInternal.exe
5016	SystemTrayHelper.exe
5016	SystemTrayHelper.exe
5016	SystemTrayHelper.exe
5016	SystemTrayHelper.exe
5016	SystemTrayHelper.exe
5016	SystemTrayHelper.exe
5016	SystemTrayHelper.exe
5016	SystemTrayHelper.exe
3608	DesktopWindowManager.exe
3608	DesktopWindowManager.exe
3608	DesktopWindowManager.exe
3608	DesktopWindowManager.exe
5096	DesktopWindowManager.exe
5096	DesktopWindowManager.exe
5096	DesktopWindowManager.exe
5096	DesktopWindowManager.exe
5096	DesktopWindowManager.exe
5096	DesktopWindowManager.exe
5096	DesktopWindowManager.exe
5096	DesktopWindowManager.exe
2248	DesktopWindowManager.exe
2248	DesktopWindowManager.exe
2248	DesktopWindowManager.exe
2248	DesktopWindowManager.exe
2200	DesktopWindowManager.exe
2200	DesktopWindowManager.exe
2200	DesktopWindowManager.exe
2200	DesktopWindowManager.exe
2200	DesktopWindowManager.exe
2200	DesktopWindowManager.exe
2200	DesktopWindowManager.exe
2200	DesktopWindowManager.exe
408	CoreSystem.exe
408	CoreSystem.exe
408	CoreSystem.exe
408	CoreSystem.exe
5084	CoreSystem.exe
5084	CoreSystem.exe
5084	CoreSystem.exe
5084	CoreSystem.exe
5084	CoreSystem.exe
5084	CoreSystem.exe
5084	CoreSystem.exe
5084	CoreSystem.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3108	3448	f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe	98
PID 4560 wrote to memory of 3500	4560	WindowsInternal.exe	102
PID 5016 wrote to memory of 3608	5016	SystemTrayHelper.exe	105
PID 5096 wrote to memory of 2248	5096	DesktopWindowManager.exe	113
PID 2200 wrote to memory of 408	2200	DesktopWindowManager.exe	116
PID 5084 wrote to memory of 1204	5084	CoreSystem.exe	119
PID 2188 wrote to memory of 2860	2188	WindowsHost.exe	124
PID 312 wrote to memory of 2520	312	SecurityCore.exe	126

C:\Users\Admin\AppData\Local\Temp\f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe
"C:\Users\Admin\AppData\Local\Temp\f816ce836662399f5426b924e7802b82bc9bba66082e63e7273cd1bb7909b20a.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3108

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3500

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3608

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2248

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:408

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1204

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2860

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:312
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 6b815011c150cc87bf82cd8921c4cab58c8ee0341c1a78a48b9b67fa7a3754e8
MD5 34da0d404b796df75e60601acc06ae12
SHA1 47e22b08f2d02095731e882625549f5e8eda5f91
SHA512 65504505ef8976d2037b3eb64a52bc24b9100b4a1254adf140b6f45d32a5f24c118763339e630dac5d234cfc1459c18d17bca84fb12ffb910fa9f2b52f1e096e
TLSH
T1B0E07D23F20C50907F324E7D4623A02B3813204814C69105292C8BC20D036E68A03504
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 a137c87e05159088c59471c7a403068f2273fa908d7c297ee8d311b3736c159a
MD5 3922a3c8a84ba5d5027b2e834aa1c26f
SHA1 322ff9d4a5bfd5477e3b4918a98456f19cfa7ccc
SHA512 375fe3c5f0520d7484e034f281a8dc2138cd2e807df5ad8223320ab9e6395da10e4f30005334d7963f1349a244c96a19a027729a633b164a77afbb6aa5677742
TLSH
T17F41B7D9AF0C3024FF868E844938DF327E7CF1E5A495605534F644B264A9BD51D1A88C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 49c88ce337728b0d9e1cfb31e7632547d904dec233c3dcd6e160b9da69ee7d53
MD5 be1ffdfb21fa8a54b61d1500c07f251b
SHA1 50fbb71c8bd85e7c47b12c6288c15eeab10e0dae
SHA512 6290e37783e3edeee5d37907fe91079214d280d7a6731beebe9997d95fcb47b0c614aed9bdbef74d605a6f11934069dbebc7dac356b688c23707b4133686ce35
TLSH
T185D02B06C8EA78433F2398244DC6AA5570A3681922D35D28764E851A2C614F70F0A15C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 185KB
SHA256 b462769aa54cef10a7bb9eae73889b190194734754750afb4958144f9b8e571b
MD5 7481e0eec551e59b2a70ca3f77d83d3f
SHA1 9341301cbcdcc750ffaf4010fc8027a96ebe5620
SHA512 d55c0e25bc8d19da18ccd6d872bbe6cc69d7f5e0294c2f5b66baa507618abc80b273ed86c526cda00ff604f15e1849732b625a83e9a4d13d92da05626baef6cf
SSDEEP 3072:V/1Cl9+XOvJtlpDGlC23zjwVqf0/DP6gne5qlyT1:V/wnvBpD/2PGqf07d+1
TLSH
T1A0042D146DBBB5639E4ACE620C9ABA5602F171DF2112731B7EB46E901D43ABFCE17C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 975B
SHA256 9588ef7646a6cf09decf879536489ce9a4f33ce6091955c40fe47b4331b5ca01
MD5 b36e41947b341b1403320e932f700c42
SHA1 a1bf70049b85910754ef945341ff356709dac152
SHA512 4679b94bd85ca8e0f63bb81745de49f18d6a19c216cb440f9ad43bf9e87212d594b0c2f8e7b40f770695be86a7fb92abddcfdf11bbe85fbd03d2f306e7f4fdb6
TLSH
T137112183AFE870509AE696B0CBE8D53D3CF4348228EA34D11C91C896245AB5A2B0803E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 21a3150a5b53cd8f4722505be245f21174df59b9933401fb086744809373f105
MD5 f6e2deba8cf53cda716a5b1e5f8f65c4
SHA1 94a083201701aa2bf2281c89f56b90486c5bbb6a
SHA512 a3807a8e23ac108e395814b9a00000223d46196465d400a0ed09b577b3e62e247556b0670f48134c7fe771aafb3bd589197fe89c5ae7e6ae112264db42aeabe8
TLSH
T1D841FAEB1B0A38787F469FDB6C79C4371E3462E4A0C44842B6F7C8D614EE7915D1954C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 36274b35d5225c103a6a2bf8c7873ada0137aaf2012a412c0046ed8e3aec7b05
MD5 92f774d54e2700192817ad87a94b48a4
SHA1 355463f9aca873b4dc1cd8589a7c5dfe84213fee
SHA512 850ce61b7f937996a465ed5f48e3f483ddac1fedd056cb6baa6feb5d55a924bc0b4ca5dcf6910e25a62dc22b25aae61e07ed4f21b8abec76617daa51593da4bb
TLSH
T122C08C1C5AA21A1AF2A8837C02C179079B209502E2458F151AF12A08C996B162838C2E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 1d14bd87d28ab5315fd7de098a15f0dffcb6f66ab756831b5de016b424b220ab
MD5 2de67e926a5c2523ec639e3cc96131b7
SHA1 00cff5960dce17a09c82e30b11bde4b5b3112df8
SHA512 5690ff96ec7ee17045e034bfa9e03a147d28838d0e5b4124a3b83ecb63f6a4c5b67143480e9a626c0872b59ce106a47dcd4593087cedca844c463686d95f0fde
TLSH
T1D5F05C2C1BFC847EE133DEB8D7D5A3529906F127240445D906D24B485A03B426C5153D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 a3246ceba6ff7a684c2898ff706814fbe69ef7573c269a35da5d44c9021ba538
MD5 9818708d2a5877de45a9f64e501bdc2b
SHA1 a3a292e79b242a7725aca955a7739ce60e448798
SHA512 49c80c204622a26fd5a98e06e4c4de511995e960ff9fc5f496efd437c2b2364f2e0545f882690f373539024c9098e0749f4e99f88b7c42f32cc18e2c45ac1210
TLSH
T1F9F068683DFE503BF033E97C43CA32B45966F20A300176B52AB157082A26F112C41619
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 68420844b7f8f7779dd8594cc99c14664b346e5198ce9f0db127c06726814f4c
MD5 2618bbac52bcb8f6d1905396b5043a66
SHA1 7903057921d2a59611ae97280bf21894a154c403
SHA512 c447f5acf6721be383c89a8cc27662aad2f505e03347dd388a89c0936e80351ec3eb27c9027b1f1cd04e1b8d591a56c1146b6e5dc73565cced8542be0967a716
TLSH
T13CF05C1420F8410AF0B3E878C2E022FBFA35F105780582AA169626075606E110D9562F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 3f1dac801f90e735ae54ca8ccacf9fc3d059dde4262db86c554caa41fe780946
MD5 9927772ecbedb3fd17df256428f2c482
SHA1 5bcc0546cd69cbb4db72add481f5f9f5aca69231
SHA512 339dd52b9481d2439ad251e886dafd9f5fc72b2aeaa7ccb420126c9ab3dfafce0331a46d6f9cb5611d6b48139a962d814fa6280c0b14b7e17bf90a11558baddd
TLSH
T13CD022346BE40222F074073988B3628ACB203162E0D34F8E0BB1209F0C38B020FA390D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 f9dac64d450ff5b2181bca34733cd0f85b455bbbceabb16b6dfc317462f10b8e
MD5 da9664f4ed8ad2043cc34d24b5f4aba3
SHA1 a0cef3379e2303fdadbd3c8c7f6f14d60c02888b
SHA512 303cfd70cc4cae7b6802c10896b51c2a17f986d4efcbc7a6971df2d0640b5035753aa6e3ae4d2e86ae71f1ecdd89d638c5b17b2d4a73eb5ac79b6bd5ca107761
TLSH
T18AF0552426A2013EE232227809F8D3EEDA0AF2177404C5A926AA130AEA5AF811C1143D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 87618accf686ad658e76d577498ee8fca9c8428929bcee543d85c165a7514c4b
MD5 fbdaa78083e7ef173b2fec40afb72a3b
SHA1 2ed5d977f39e18dfdc55266b9cf03865d0638fca
SHA512 505f47c8c4233a32e1b693ec3c620d158a3c9df32b796e9ad61d08666aced63de94c3f7e18af02177885ba0316b1898bd1885ce03b8c29c6789af07dc8d9b33f
TLSH
T173F0AB3820B7011FF233D7FC43C642CB953BE13731042BA02BE143089E8AD42B960912
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 e0f303bd4094ba8f57ff932a2ab48858a20225aed1b046e391bcaead61974d43
MD5 82f44d211fd21d5d7d4fe5a36fc6d660
SHA1 6cf53a597efd19c83d31f377aa1d30fda8053f6b
SHA512 41f0c5a6de8f0f45c4bc3e74612f96c39d6036c530aeb3640a8b0b6c9f8a288edff785b67b15669aca2b77ada2eadc12ea12434c9382ba7fd40baa90c2e9e9d6
TLSH
T158C08C1C9B610606F2A883B902D229878B209511F3819F0126B16A08CD24F122834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe
Size 6.9MB
SHA256 0f3e593349f0aa42282efbe954ddef7f1a519b98c58efd88eef5b2642b0d1bbf
MD5 4b1d5fca9f02a24793fb0c2a500168ec
SHA1 5f6cd3aded06f5c927d04899700d5f608b11c678
SHA512 788d42ca2c952732011cc17a1fca0bf59ffa3680d2d2c3e8b3faa8f80174e9b8f73215524f95f21e270b5dbb1e5cac9f113952a3e1352e54d53fc5ab9cb0274c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCXSMdQH:TDpbgBr/4QAMQaTCvkA3Y8N6
TLSH
T12F7633E63C5E5ABBC10E1C7E8D579D6235AC1BB1C7A04CD3EFD13EB70850D921A62922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
Size 7.2MB
SHA256 d3094330780c0f8fa7c05e6311184baf0327fb0708022310293ef827769c1e9a
MD5 58c96bd049aa23fd17b8af1d3ec82dd5
SHA1 d099ef70d71941d5471d651ac895fb406e202530
SHA512 bede21fc28e98cef7a9f253bbfbe9ce2a8516596aef073c5425661cb7471d50da918ae3828f60fa63bf4a8db4e06cb720d354b37351a7f93855c9e56ab941d15
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCXSMdQor:TDpbgBr/4QAMQaTCvkA3Y8NLr
TLSH
T1F67633E63C5E6ABBC10E1C7E8E178D2131AC1B71C7A49CD3EFD13EB74850D925662922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SecurityCore.exe
Size 7.3MB
SHA256 959825b8ced23532289aa72326528f7f2272011174989c6d184c9bf6dc85a1fd
MD5 a3f6811e58237d3bc59738d4841e94b6
SHA1 65ab5c44b7ad781b96942589af3bfe33e2441ed2
SHA512 c68d748403d5dd8d116261fedbdcebc9fbe9252a007d62249d7aa6515cbd1de3ff2c2b7872206638082d4740aea305fe2568eb7e981f844f7fa0c9e4c90e1f23
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCXSMdQohM:TDpbgBr/4QAMQaTCvkA3Y8NLhM
TLSH
T1537633E6385E6ABBC11E1C3E8D178D2131AC1BB1C7A49CD3EFD13EB74850D925662932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
Size 6.7MB
SHA256 e0294d01ac12aad324025afcb80bbc88e7377552a5b2813599c1f0efe7854b7a
MD5 775430665b9a8c482d5ed2c31d62d340
SHA1 46eedeb5976b4fa24e625f886fcfcdefff6e4b17
SHA512 1d94f4f65a4f6a3f4836c966440eb56ecabe174932889961fb5268a661ead812b411c116dc3454aad4d41a80008728cb76b74f8e7937c22534579d2fd7698153
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCXSMdQm:TDpbgBr/4QAMQaTCvkA3Y8N3
TLSH
T1476633E67C5E5ABBC10E1C7E8D579D6231AC0BB1C7A04CD3EFD13EB60851D921A62932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
Size 7.0MB
SHA256 30019f7807d5bd2496d296536f778d3851c2c34f503d2adc8c4298f1459f08fe
MD5 3edf690d1f0b3546e822917ce65963dc
SHA1 2f653cfdae29dbf558f3df5b28c3af72de063b62
SHA512 c3623c2c1527c6e3d8b6756cc9ed0beaddaec18da3904c495089bda63f5a942b63c07e180be31be2c50dbdf3d009336f941819110bbcd82ac330de038960dbc4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCXSMdQ8:TDpbgBr/4QAMQaTCvkA3Y8Nh
TLSH
T1D27633E67C5E2ABBC10E1C3E8D579D2135AC1BB1C7A48CD2EFD13EB70850D925672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 7.4MB
SHA256 763666318e399425130d1c5114957f1961379ee0f341a5d606b2c8a0ce23ff81
MD5 ad60ddf91a6b9ab39dcdaf63e49cd732
SHA1 463c969ae665cf9ff927f7bbdd120bf88ca2e60f
SHA512 5f261e76f30a3f0b6440e0e2396bfea3762d59348dc433212ca2aff7a238db3b88fa4c0df6389475d2f53f95f9866d1832f1b71e56157ba7d07becf87cc1b3e8
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCXSMdQohy4:TDpbgBr/4QAMQaTCvkA3Y8NLhJ
TLSH
T1D37633E63C5E6ABBC10E1C7E8D1B8D2131AC1B71C7A49CD2EFD13EB74850D925662932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 6.8MB
SHA256 7547db56109229fd31c9adc226ca869a283efc56302ac0658a7e637d60eed9ea
MD5 c81ee0ee0885d8568a69f9d5b61a68af
SHA1 34039a9fe0ed13059ab739c9d1a3bfefc8bc80f2
SHA512 39bc406df08f32868480c94d1429857e9a7c9bfb2c6e3b4f49cef321fb10df46a7f44dc45402edd6a1b48289f08edf8bd7776b0eff4b5081a551052486569e32
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCXSMdQy:TDpbgBr/4QAMQaTCvkA3Y8Nl
TLSH
T1FE7633E67C5E5ABBC10E1C7E8D579D6230AC1BB1C7A08CD3EFD13EB70851D921662922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
Size 6.6MB
SHA256 d46d87f61e308b5083f781aa8e543af78cf3920da9100b3af703fd9066be8eac
MD5 1d1f8f6a7a4a7d457645d0afb62f7733
SHA1 b2b359fb83cad6203043c1a7de952e941da22c74
SHA512 b881ca3fd72413e18429f7b70d3bf726e10eebe7c29310cb8acad1a66e060374cbb1cefe502dc82f4b387dafee5687604a39a8dbd884416265ff9652b91d4081
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCXSMdU:TDpbgBr/4QAMQaTCvkA3Y8NU
TLSH
T1B96633E67C5E5ABBC10E1C7E8D178D6235AC1BB1CB604CD3EFD13EB60851D921A62932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download