9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
Size 9.3MB
Sample261020-ryb78ass4n
SHA256 9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e
MD5 0d4a0f59f73a1bfd1fdb07fefb9d0df6
SHA1 1b30f9576957539a5438f95cd920bfdfa6ef1fa4
SHA512 53954e9d0c65907d55109a7c434a93ec31ae632ba4302fd42df830cc1ef63dbc7b80478d010516009c8fc892ec9c2e6e5040725b06de2c0069a0af2d4958354b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNmTazGj07RW:TDpbgBr/4QAMQMrEGRONY/4VLjlBmg7I
TLSH
T1D3A633DB785E6A7BC20D1C39CE06CD6239BC17B287644C96FFC57EB64850D921B22D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
6024	SystemHost.exe
4264	SystemHost.exe
4084	WindowsHost.exe
4756	WindowsHost.exe
2732	SystemTrayHelper.exe
5876	SystemTrayHelper.exe
4356	SecurityCore.exe
4204	SecurityCore.exe
4500	CoreSystem.exe
5152	CoreSystem.exe
1780	InputService.exe
1380	InputService.exe
3432	RuntimeBroker32.exe
4428	RuntimeBroker32.exe
1516	InputService.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemTrayHelper.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\SecurityCore.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\CoreSystem.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\InputService.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\RuntimeBroker32.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\InputService.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\SystemHost.exe\""	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsHost.exe\""	SystemHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
79	raw.githubusercontent.com
91	raw.githubusercontent.com
102	raw.githubusercontent.com
34	raw.githubusercontent.com
48	raw.githubusercontent.com
51	raw.githubusercontent.com
74	raw.githubusercontent.com
111	raw.githubusercontent.com
1	raw.githubusercontent.com
9	raw.githubusercontent.com
22	raw.githubusercontent.com
38	raw.githubusercontent.com
63	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c570-27.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c571-101.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c574-135.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c571-169.dat	suspicious_telegram_bot
behavioral2/files/0x0006000000000422-203.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016b0e-237.dat	suspicious_telegram_bot
behavioral2/files/0x0007000000000422-272.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016b0e-306.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 32 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5452	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
5452	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
5452	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
5452	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
5452	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
5452	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
5452	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
5452	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
6024	SystemHost.exe
6024	SystemHost.exe
6024	SystemHost.exe
6024	SystemHost.exe
6024	SystemHost.exe
6024	SystemHost.exe
6024	SystemHost.exe
6024	SystemHost.exe
6024	SystemHost.exe
6024	SystemHost.exe
4084	WindowsHost.exe
4084	WindowsHost.exe
4084	WindowsHost.exe
4084	WindowsHost.exe
4756	WindowsHost.exe
4756	WindowsHost.exe
4756	WindowsHost.exe
4756	WindowsHost.exe
4756	WindowsHost.exe
4756	WindowsHost.exe
4756	WindowsHost.exe
4756	WindowsHost.exe
5876	SystemTrayHelper.exe
5876	SystemTrayHelper.exe
2732	SystemTrayHelper.exe
2732	SystemTrayHelper.exe
5876	SystemTrayHelper.exe
5876	SystemTrayHelper.exe
2732	SystemTrayHelper.exe
2732	SystemTrayHelper.exe
2732	SystemTrayHelper.exe
2732	SystemTrayHelper.exe
2732	SystemTrayHelper.exe
2732	SystemTrayHelper.exe
4356	SecurityCore.exe
4356	SecurityCore.exe
4356	SecurityCore.exe
4356	SecurityCore.exe
4204	SecurityCore.exe
4204	SecurityCore.exe
4204	SecurityCore.exe
4204	SecurityCore.exe
4204	SecurityCore.exe
4204	SecurityCore.exe
4204	SecurityCore.exe
4204	SecurityCore.exe
4500	CoreSystem.exe
4500	CoreSystem.exe
4500	CoreSystem.exe
4500	CoreSystem.exe
5152	CoreSystem.exe
5152	CoreSystem.exe
5152	CoreSystem.exe
5152	CoreSystem.exe
5152	CoreSystem.exe
5152	CoreSystem.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 4264	5452	9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe	91
PID 6024 wrote to memory of 4084	6024	SystemHost.exe	92
PID 4756 wrote to memory of 5876	4756	WindowsHost.exe	98
PID 2732 wrote to memory of 4356	2732	SystemTrayHelper.exe	99
PID 4204 wrote to memory of 4500	4204	SecurityCore.exe	102
PID 5152 wrote to memory of 1780	5152	CoreSystem.exe	105
PID 1380 wrote to memory of 3432	1380	InputService.exe	108
PID 4428 wrote to memory of 1516	4428	RuntimeBroker32.exe	111

C:\Users\Admin\AppData\Local\Temp\9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe
"C:\Users\Admin\AppData\Local\Temp\9e474bc75f938acd129f8137506f859e6a53fb0fb0d860769ede1bb9c93afc3e.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4264

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4084

C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4356

C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Temp\\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4500

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1780

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3432

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Temp\\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 312B
SHA256 f81c4d14e873614514725d56abd8f0be34b6f5d4477cd74ca95c932b5983b14b
MD5 0227e28c5d089b59e4d0861b677bd89d
SHA1 7cb7b790d9d3c5abb7127e2c4e472490554db2f5
SHA512 53f9b98fe942c6cd7ced07851b93000da0f866d115b17752fb3fabc8da3ff5e238e07645bf902f960d7da00b809e0f5b63bbca0dd63c4c3ba2236eba97c42989
TLSH
T17AE0E716F70D58943B76CF5DCDA1196F7C73301950C44509282D54E44C031E64407498
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 a427cff2e04bea32de57cb5fcbeb083b67ccb128669555ca7d6ebc35abf1250b
MD5 518f32a81aa159b9268d426ab7fe3c36
SHA1 e5cc5bbab69fc41db1b9b5c5682ee38ab75eb1b2
SHA512 9b5aa8ba47f331c0f34b77eeb3e9f37c6f6d092e8cf6b3d4ea1dd6f9597e20eedc319e3844c28675e6083a0751f77644851663b01cea4d5d231483dd101e5538
TLSH
T15C41FAD9BB1C7524FF818E985478D6362D38F6D44441909E24FB88B1705BFD42D254CD
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 97e8275b1265f18faa1c822b003da554dc4f197c3ef7e8d7b4e6f954a57592f5
MD5 51247251ca18ff9d40f011c533b0831c
SHA1 df10b4463b52638d64f3a534e7206be9b92754d5
SHA512 123959014a85fbb83f01c1f726852ded60a542a1e45c0544d6dcd522c6daca513b378fd40f99cb6dde38e0d66b02238a8dd3e3d91a4b23731976d0a4914a7eda
TLSH
T120D02B16C2BD24923D63DCA1D981786570B39A7A63A6551A7498801A9806AEA1D09298
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 185KB
SHA256 e39a5ca26890a1c1fe8b408150d42a50e159afac29785710a12500faf2e3a71c
MD5 91f82b604e55b092ff5ec9d881abcca3
SHA1 3eedf347a9c57981f88287f21b181589f4256850
SHA512 56618a2e41e7b44895e6fa1c8ae356a7d93e88251e2fb7df0c3140efb3c4b217e24cdddea271fff7867fd749c6fe0545102a2960ea20b43d86ccb0d17c8a5f20
SSDEEP 3072:570/fXxqvtY8NGuPFNKXzTSEyM1HRKwL3dQg6qzdf:5ec++GuPFNMzTHvNhp
TLSH
T128044E186DBBB1619F4ACDA24C9AA95E03F571DF2312331B4EB76E901D43A9BCE0744C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 2c65fe8529a61d5cc1afdb06dfc967b9f37eeb990b48429ca01e53bb025e1730
MD5 6c5363f6a24862199d9e4fc7c51525bb
SHA1 706ca3488bc9e0a1a11065e0b33fa8fe6284a3d5
SHA512 01b431413358b6dee565915138564dea3fc892edb85590f919f4041ca99e422b143ff0847cf3d68ea7f4793200c4ef0b1aa460d741de4dd458d1b976ffae4ef9
TLSH
T1C111258B9EA4B0D15AE256E1C7A8D9327DB434C52DDA34C02CD1C4C720AA7593B0C03F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 8cac8dff170d4735f5da4f5866c6ccfe8f7bec99fa193d18d5eda0efec5aba25
MD5 f0d8d2bf662b7e794f2d323d6927175c
SHA1 a05108955d27ce9a9a4acacd78251060cc0f4b97
SHA512 06f924d3a31f97e9e9ca5672e63752ed83cdace2f29d913e1b00752fd94dd47196d9734c74bc55f04f9c7efaacdb633347c159d0960dc8333d5c80a0361bb668
TLSH
T17841F8FB064D3455BF4ACFCA6EADC9361D3C81A452C04582B8B7C592209EB827D5B18C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 32d3c94f963d4aa4b12ecbbcf065c4051f078748eb579e9bae99115e22829fcc
MD5 ce66818b8f4a90bfed0436d212212da5
SHA1 54396f54accdfda0cff8e2548f084884169d30cb
SHA512 659c1507115a0bfe6af8d149a37276ed284de88e4d0d328379f48e9c40f00e292ae4ec92c46bc5b1f73df015bf89e45ee595cc8b2c3d97e2184c2e87ed0ed063
TLSH
T19AC08C1C1AA20A0AF2A8437D02C139039B209101E2418F051BF22A08C996B163838C6A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 8032389d36a7af5a1656a3f5ab2a8163fc88b7a8ae2988cd84b0c2fe07f0184a
MD5 7ba6d8cabefcd69427546235f630029a
SHA1 db8e995f2e2c2fa5e0ee4f4585a5493a23c17970
SHA512 d8f171e945882c861e54f740b418667f5501a32933ea70ceedb8101deeacacbd6514ac0b8099939c298ff9b86192cc1d0bc710e6651210805a3da4b6d469fb68
TLSH
T16AF05C3C1AFC457DE0B2DE7C67D8B7D24D15F11A240806A816D74B0CDA41F002CD1438
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 3493de812d985369444ee6e406ebf33fd7f36a84e2eb59d37703a251ec48c108
MD5 40fc639bd818cc6f751f33559f7fd8dd
SHA1 3809586de5cef5a1e8b8c1ad40058788569f1619
SHA512 62b177e3eae136b454fbe621ed345be6304de7af6c33bf1b9e70a4e35536cdaa5ebfcb6106e9fc4e18de4a71da8f51a51d577057498fa9cd888e1bde89b75a51
TLSH
T1A1F0682439FB843AF032EA3807CB70F1CEABF61A304916FB167253086A15E542C0221E
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 0c4131b2a4d52145524a04c723a916374710fe444df729f224bb75ff9d3f342a
MD5 ddc0f82014759ded4b6b053080f40870
SHA1 881b3dc5f883f7b0e15dd87c018461cc7d8c2c16
SHA512 d6ece0271c446ea6e9b08e79aeb9ac737315f89eff103319c7c10f4569b7eabda7df1800117fdf19d0ff8e5daca07d16eed8e00a2ef3d2659b4d84bb9af3d215
TLSH
T1BBF0AB181578006FF4F2F879C2E422BAFA25F016740A9AFA86D71B06AA01A002C51A7E
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 cf1ace8011cd528a9f9d4dcea3878b325d36c33dfedf0c0510a7ac53633adbb9
MD5 41fa39ef11f4a96a050bc9efc872b6a8
SHA1 52e2d417246dffaf625a861f525098a891c91062
SHA512 9fe7a6d455b0a9271089e13e585a90ede77044b8f29bdd45eb9c47f0c44aed599749c445a48d897eddc7a8d5a4f58102915d104ae544e3f8385e0b8242cc65c0
TLSH
T118D022911BA00632F034F23E99B209809F60E010E6C0AF8A0BA7020E893DF029D13C0D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 06bd061a6f93c60e8d797e11bf3a9408af467ee9fa71dce961166300f881396d
MD5 d02b870a2eb84f8202393e7b198f59fa
SHA1 cc46da205d9ccd1ffd900817a99d409f5f1eead8
SHA512 2908ba33e2fde7438514e7c6730a13c4933291a6d330c7c3308b60804f63d945258cd42c91558c025bfeee4975f100b705d592c400337c067a98d4d3c64e8cb1
TLSH
T189F0A32425F1501DF23317784EF8939B7D15B6973404C8782595030EE507E015D1263C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 274be99a56a05e8400631c794eecfe4303178902bbe7f671e8d7763842b38e4f
MD5 6b8704f94b92f16611e07bf444eb02fe
SHA1 e3bd7999c882d1301c8cabdec10396e18f01d405
SHA512 4ef2ffc727d93b026e483a9aaf09e7ee72b68fe0f1eae06a7bb653c56b2bf2fed8d0458db832c8bcea63302cfe27e42a93d1625c0c977ff2469b0c83245dcba3
TLSH
T101F0233825DB011EF173D57C01C151D79967E1372109576A6963430D5D87DC17DE0915
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 78a7ddd86731ce6516c133494b92e0c5405c6aa2d3a2205d276fcefcd7818787
MD5 83722866911593c10d928a633c3663a7
SHA1 bb7a2a82eb1c9506e12a385e000f0e3b76aa036f
SHA512 ffdbc7c3e5faf55e371d47619cee8730ee2b876f169451c0048e79990bf5822a4b484eb6d717f8ff1885f8db795428942e179ce6e51a3919964a4f527298cd59
TLSH
T1AEC08C1C0A610A1AF6A883B912C239839A208110F381AF052AB22A4CCD64F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
Size 9.5MB
SHA256 8aaf3d8c039d9b85a83894127f523c1bdd15599c1aacdfd32e91a710ed88e31a
MD5 ce0661d46b8aee21ad0a6afa8da7818c
SHA1 43d5fb2b19ff5f7b8df7d8742554e65b5b98bdd0
SHA512 4776701181170f33e459e90ea3fd12dc7e6202eca39951b0b5441206095d96127fb67f2242b6d3b4be6be4fb9cd08282389920eff26ff4603f1667ece7804255
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNmTazGj07R5:TDpbgBr/4QAMQMrEGRONY/4VLjlBmg7z
TLSH
T186A633DB785E6A7BC20D1C39CE06CD6239BC17B287644C96FFC57EB64810D921B22D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
Size 10.1MB
SHA256 ae15e5f0a04d443d8917fa46d4b7c22b112e80f6343240c36d90b96801d083ed
MD5 f415d34a1117c7fe98ebfe535f6dd73c
SHA1 8a28ba8a93008efb387421d9e42fefa2cb067df0
SHA512 850d490ad8c0eec60bdd62139966c29fe256e0a6736cabe796b85da82d0e84064f3d758fc367fa78991029b8cf68fcb4152b4b9f421d6dcd2f16cedc637b17d1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNmTazGj07R8S:TDpbgBr/4QAMQMrEGRONY/4VLjlBmg7L
TLSH
T1E3B633DA745E6ABBD20D1C39CE06CD6239BC17B2C7644C96FFC57EB64810C522B22D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
Size 9.8MB
SHA256 bf114abb6d28c265b8668e415db1a8140ac8940add799026ee3b932fd13b8b12
MD5 5ca1226e6b3f1a9538ac6480aeef5ce1
SHA1 28ac81bf11ffbf01b634c0af38b5bc98a2161980
SHA512 d94c7a657091c6b96cbbed409707f95b2f923c044eba297824fe7a264fc54c4c3b7a0bd045a103d1c80125d9bc8cd660b92a68e4a5d3761799c77a8f7fd2458c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNmTazGj07R8:TDpbgBr/4QAMQMrEGRONY/4VLjlBmg7m
TLSH
T1A2A633DB745E6A7BD20D1C39CE06CD6239BC1BB287644C96FFC57EB64810C921B22D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
Size 9.6MB
SHA256 3fa506a17971043836ae5bda945abfbc1e6ab5e6ac16796c62469684f4d92b78
MD5 bf7122065c6c763d86412f7c527d04ea
SHA1 c44137467596aee111800cc77fe1afe43710d604
SHA512 a4ae28f2e316f5ea91387cf70efd6fc09acd27112d802be6544233e0ca63fcca3fbd4e4a00a2998ef2c079316a56fe50cf0081a7813d065c92c7ff6ea2f823be
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNmTazGj07Rb:TDpbgBr/4QAMQMrEGRONY/4VLjlBmg7t
TLSH
T13FA633DB785E6A7BC20D1C39CE06CD6239BC17B28B644C96FFC57EB64810D921722D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe
Size 10.0MB
SHA256 631ccedc6a05875b4992171a3af69eb59453b424c57df5c0472958936b8b9b49
MD5 d80d351b22af10f8ccc102cf65fd0f62
SHA1 1ce487c3d385d33b4e392a76d92d181d84a86fc8
SHA512 16b3b5c70d9779fffbc57f99c67226658e12b19d3c8cf839ee44ff387be6759415e3a4d818571e518b4b341a5648302d664b67d4d47b14e0b725b01d559a5fe5
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNmTazGj07R8E:TDpbgBr/4QAMQMrEGRONY/4VLjlBmg71
TLSH
T10DB633DA745E6ABBD20D1C398E06CD6339BC17B2C7645C96FFC57DB64810C922B22D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe
Size 10.2MB
SHA256 8260b9ed24f45cef80e7912e5ebc4bdf740df86906e765527050d85ba799bffd
MD5 1728ccf4fde761e2f217c67ce8a63e10
SHA1 fd07f1af30602df6dbe067bb7016406dadd60ab1
SHA512 67ef78142dfc952c21e364b1bb59a1eb30e5e012ea831f7bfc1922d1cf53655b2b1af87a932ff2b3e1fb371dcf7e8905a8fe707dff41a074db14c8bd6389cee1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNmTazGj07R84G:TDpbgBr/4QAMQMrEGRONY/4VLjlBmg72
TLSH
T1FCB633DA785E6A7BD10D1C39CE06CD6239BC17B2C7645C96FFC57EB64810C922B22D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\CoreSystem.exe
Size 9.9MB
SHA256 e83abf62d9e68c6618bfc38cd20699a04c2f7da2b0597caf3704eb4eabc83e7f
MD5 809e3df024892c3f5a4ce42bf6d2ec47
SHA1 12d78361e2428b5d41679e0c0aa1f900dcd40a44
SHA512 634956d0e9c9c258437b1f9137a500d03ebcd056b6e4d3a51f504304750c9e3fd3b29774e0f3c5aee064bf62a317f2e25735c5d8260a3a794466691cb17c289a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNmTazGj07Rd:TDpbgBr/4QAMQMrEGRONY/4VLjlBmg7P
TLSH
T1D8A633DB745E6ABBD20D1C398E06CD6239BC17B2C7645C96FFC57EB64810C921B22D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
Size 9.7MB
SHA256 97c6b140a3e6c00c827091c398f692004c55a9b3953740700e2477c2023fc664
MD5 aef190502b1da4831547f3a1f8c345d7
SHA1 28dddb599b4803f565e78e8d0eef7610dcd4191b
SHA512 f798081b7f80439e4deae19b78aeb9c89314867693ea6e2bfbd9ed1fdffcd600e340f1d95c6cce6ee119c9a3962283dafc0a1d9c22bb16e646f007cfc77b76fe
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNmTazGj07RE:TDpbgBr/4QAMQMrEGRONY/4VLjlBmg7m
TLSH
T1E4A633DB785E6A7BD20D1C39CE06CD6239BC17B287644C96FFC57EB64810C921B22D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download