459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede

Analysis

max time kernel
147s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
Size 8.2MB
Sample261027-vfw2fsts5q
SHA256 459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede
MD5 1adb44bc47d482c0589b2b905b03ffce
SHA1 7c02affbe77b9ecb28cec562fc293d5819dfe770
SHA512 9381cdc581a8b6ee1c4e6575ea31ca8ce1f700935a06132c3d997957cebe377b4bdc1d5d0481562bee0649997990d0aab19f49de607f673e129e945bbfcd9853
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t1L:TDpbgBr/4QAMQMrEGRONY/4VuL
TLSH
T16C9633EA785E6A6BC20E1C3A8E058D6735BC5BF1C7244DC7FFC97DB64841C921632922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
712	InputService.exe

Executes dropped EXE 22 IoCs

pid	Process
712	InputService.exe
5056	InputService.exe
5440	RuntimeBroker32.exe
4536	RuntimeBroker32.exe
4072	RuntimeBroker32.exe
4952	RuntimeBroker32.exe
1148	InputService.exe
5740	InputService.exe
1952	NetworkHelper.exe
5200	NetworkHelper.exe
5692	WindowsHost.exe
3176	WindowsHost.exe
4584	UserSession.exe
2028	UserSession.exe
4408	UserSession.exe
2900	UserSession.exe
1632	SystemTrayHelper.exe
828	SystemTrayHelper.exe
1440	WindowsShell.exe
5372	WindowsShell.exe
3156	UserSession.exe
1572	UserSession.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\InputService.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\NetworkHelper.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\UserSession.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemTrayHelper.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\InputService.exe\""	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\WindowsHost.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsShell.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\RuntimeBroker32.exe\""	InputService.exe

Contacts third-party web service commonly abused for C2 1 TTPs 16 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
86	raw.githubusercontent.com
108	raw.githubusercontent.com
131	raw.githubusercontent.com
34	raw.githubusercontent.com
44	raw.githubusercontent.com
74	raw.githubusercontent.com
97	raw.githubusercontent.com
47	raw.githubusercontent.com
59	raw.githubusercontent.com
142	raw.githubusercontent.com
1	raw.githubusercontent.com
9	raw.githubusercontent.com
71	raw.githubusercontent.com
118	raw.githubusercontent.com
146	raw.githubusercontent.com

Detect suspicious telegram bot 12 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c624-27.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c625-48.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c628-112.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c625-117.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c628-154.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016ad4-188.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016ad6-223.dat	suspicious_telegram_bot
behavioral2/files/0x000200000001af51-257.dat	suspicious_telegram_bot
behavioral2/files/0x0006000000016ad6-261.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001af51-295.dat	suspicious_telegram_bot
behavioral2/files/0x000500000001af52-330.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001af51-364.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 46 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5400	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
5400	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
5400	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
5400	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
5400	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
5400	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
5400	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
5400	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
5056	InputService.exe
712	InputService.exe
712	InputService.exe
5056	InputService.exe
712	InputService.exe
712	InputService.exe
712	InputService.exe
712	InputService.exe
712	InputService.exe
712	InputService.exe
712	InputService.exe
712	InputService.exe
4536	RuntimeBroker32.exe
4536	RuntimeBroker32.exe
5440	RuntimeBroker32.exe
5440	RuntimeBroker32.exe
5440	RuntimeBroker32.exe
5440	RuntimeBroker32.exe
4536	RuntimeBroker32.exe
4536	RuntimeBroker32.exe
4536	RuntimeBroker32.exe
4536	RuntimeBroker32.exe
4536	RuntimeBroker32.exe
4536	RuntimeBroker32.exe
4952	RuntimeBroker32.exe
4952	RuntimeBroker32.exe
4072	RuntimeBroker32.exe
4072	RuntimeBroker32.exe
4072	RuntimeBroker32.exe
4072	RuntimeBroker32.exe
4952	RuntimeBroker32.exe
4952	RuntimeBroker32.exe
4952	RuntimeBroker32.exe
4952	RuntimeBroker32.exe
4952	RuntimeBroker32.exe
4952	RuntimeBroker32.exe
1148	InputService.exe
1148	InputService.exe
5740	InputService.exe
5740	InputService.exe
5740	InputService.exe
5740	InputService.exe
1148	InputService.exe
1148	InputService.exe
1148	InputService.exe
1148	InputService.exe
1148	InputService.exe
1148	InputService.exe
1952	NetworkHelper.exe
1952	NetworkHelper.exe
1952	NetworkHelper.exe
1952	NetworkHelper.exe
5200	NetworkHelper.exe
5200	NetworkHelper.exe
5200	NetworkHelper.exe
5200	NetworkHelper.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 5056	5400	459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe	91
PID 712 wrote to memory of 5440	712	InputService.exe	92
PID 4536 wrote to memory of 4072	4536	RuntimeBroker32.exe	96
PID 4952 wrote to memory of 5740	4952	RuntimeBroker32.exe	101
PID 1148 wrote to memory of 1952	1148	InputService.exe	102
PID 5200 wrote to memory of 5692	5200	NetworkHelper.exe	105
PID 3176 wrote to memory of 2028	3176	WindowsHost.exe	109
PID 4584 wrote to memory of 4408	4584	UserSession.exe	111
PID 2900 wrote to memory of 828	2900	UserSession.exe	116
PID 1632 wrote to memory of 5372	1632	SystemTrayHelper.exe	119
PID 1440 wrote to memory of 3156	1440	WindowsShell.exe	120

C:\Users\Admin\AppData\Local\Temp\459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe
"C:\Users\Admin\AppData\Local\Temp\459a9d8e5075e6da46fc104c4ca7bcd8e313232234c101d411b517dcf82d3ede.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5056

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:712
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5440

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4072

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5740

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1952

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5692

C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UserSession.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2028

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UserSession.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4408

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:828

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5372

C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3156

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1572
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe" --monitor
  2⤵
  PID:5436

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe"
1⤵
PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 fc74daf542642cc7fbd3da172569a24d6044b1aced251daf43eeb132bba6941b
MD5 ba06585434062dacc3a5f731f0bdfb5c
SHA1 0a88d58b9a8fe0d0f8d9a02c8294a6cf4e06a178
SHA512 5ae20cf5c98d1599ee1e63383bb58c2fcf0b68f9c8b32db7ba88eca4a4d764fe86b01cdc20910adb2ee4ae2887d9318cb70c0c66b67f5c6f8e02178ac7ae2641
TLSH
T19AE07D19E60D25A13E120F714171452BB401108D848EA60DB91C09D10C47326D907508
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 3180524812ab237ad27611c53c5607d396767eb8dab1b495aa108ad0718713f6
MD5 1cb6ab2ec4f2493cd42f4d805ae8edfb
SHA1 5ad1376bf30c15ce11941a60cc438beb08b16298
SHA512 d4dc95503d44168359b6ae615f96a5d850ca97f8303026ef6ed683ef4e4afa3510839fef5ffae14b40cbb18527655d6117714b19ecf4b395bf5910dbea559ac7
TLSH
T14541D5DD5F5C7425BF81CF481978CE222E38F2D0A588A096B0FB84B2A4A5BD01D0AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 278B
SHA256 aa127391105344e3fdc5bb79aa83e5fe84fbe3fbdab295c0a15844df595163e3
MD5 07ee69dc747b4e11ce7d8cb7c16175d2
SHA1 7b541c98dacacd622306b3c9823d314023c14657
SHA512 5e84548c6b41c0cbcfb85f39c81f32b41bc5ab5534107f77da39df5633ef41890d4e09b07416ecb3ff50bfb90f7e08a9abb69866a98b24a43b06ff353f02309e
TLSH
T1D2D09513ECF75D223F35CD3454D05A15724364A793D6D658F5C1C5D454459791F03248
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 196KB
SHA256 d2f716de09681bae28e405822a4d24d201da0a3c91d93dfbad78a76f568b237d
MD5 750928eee653410f84132920af60d313
SHA1 a575b2d320cdc6c0f6e1fd8b87f3ae71c692ffa4
SHA512 3cd35cdbd61134b401cbdc916ab6b321ca04a624ba1ef349caa7546cab67b694ebda4b5f3221e1906e113dd21a2abd6717453be6c3ebc294bc69d3902bf8f9c4
SSDEEP 3072:vX9EdoYXQvuuLSQvzchlQcYm+RnWZPhmRf32G7z6aW5bOtC4:PKNgvuuLSwchwoPhmNzgq
TLSH
T132142E286DBBB1619E4ACDA24CD6AA5E03F171DF1312631B4EF76ED01D43A9B8E0344C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 207179faf26a6ebc403dd83b5738f28021908c4e215860249e4a8ed2966da9aa
MD5 76221549338e81ec75836e5f1d55ae5b
SHA1 5f33b2c044b9616580782fb6cde56a6b9f79c16e
SHA512 844c4e04a1cf0beea2965792660147b999db61014605004e0ed34e3fb3eaf78ef96550e9a54bca0f273e503a4996a0e15c3da0cece6de562508dd194f65a605d
TLSH
T14E1121879FE8B0818DE757A1C7E4DA267CB5B4812DEA38D11C91C592245B76E2B0803F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 c5ac918c372b67eb99ee96edb955ceab9f55e4254ce1c89fc9f9baf577ee94f3
MD5 73a161d83f99a6e44eca54f799741cfc
SHA1 c7534e297fdd0e5ecc934fb82c1b92861865ea64
SHA512 9496db7843ea0844f3c1e954bb252c3872103d2dffe393b267ae698225e2b7bb425f90a000f0a885036caac132348a24e2966e6a29c89c1f89a91a77a18bcedc
TLSH
T13641E7EB574A74A4BE49CF966DBCCA361D3C81A1D2804841BAF6C4D210DFBC1291584C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 ac23ad5905d6b6635b9938e4ac27cdb3ad68c99065c7abe88aa790a7a3965c5e
MD5 068c9ef98451a7b94d1761eafc7d84ae
SHA1 09f0c56d7429c5ba912c802e51c9c9e848aa607e
SHA512 fbd9d2c72dad0edebfdb06cab40a5dda12ddfb0f49570a7e740ced912007850cbf88624eaa5fde2848594e1dd09f113a752646edf35a99cb60c697d2240e1f7f
TLSH
T144C08C1C1EAA0A06F6E8437C16D13D039B208141E6428F051AF52A08C99AB162938C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 ab1338e2ba2bc1221c26f77f7a2d64d3435fe9a65c8682cada18bc86ccb38b4c
MD5 a58962c041eaac82ff3a178233748828
SHA1 ec24bb6a43df9a176a750b73b8fc5c161c29a7ce
SHA512 5e8b9406fe190ee9a9708491cc306cbb3ae23f2fa98091f237302a6f222ecc53858e67ee863f95103d4a2915759933f685c03fb88678136a1bb08c8aa7c06f57
TLSH
T180F0E53C4AFC44BDE036DA79DEDAF6A76D15F236240846AD0B964B08AA03F426D51524
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 790baeb8b3c5b690de75aa0aa050287bb8c95d15d3c901299cc64d0900c5b91a
MD5 8a689d5bef9430871e44d0ce00984a2e
SHA1 90554b69afa5f554e04c3a33d10233f8702bc140
SHA512 62c3f9a8d39628c2eb4d2bb9e6f4d283fc82d3b437a90d80c8839226fd84281fe0fa875fa6812228e29389ebc63df37932c65d4b2e16fe516d459b1d362b4fa1
TLSH
T193F02B1436FE517AF126593853D121B55A29F202B00196793AB103149E16E616D5250D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 05733d6feb9c822accc9eceec007ad2330fb78ebe4f31526a108adcc26fe91e8
MD5 64c2fd488231055c02fcaac1f0c98b47
SHA1 7ca9d9eeb5ef7837ec1ec2d387467a3d73283694
SHA512 a9cab6731d554bd6606925028e71186a692778789b40aade1421b91e45f81ced90a2fdd0ad70e0d733cc0443a77be082b158bfd1a00209afa16f532c3b410a25
TLSH
T1CBF05C186138406AF0B2DA34C2C131B5AC75E0163409A6A605D6010A5A16F013D6152E
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 619eff2673de2965818708418868f31993cb732a469820443757609a169c189b
MD5 8ee0b394af05c3537905fc782d1eb742
SHA1 07b230e9dcf0c798ad984ff18b4a193ea7b595df
SHA512 2eceb0538bd30e914a6ad5370c8dbc7814affc702b86756ceedeea0970e4fee5d0f2c746078c712653f3ed35624ced467c055b8800cabe6c8eea364ec5fd259f
TLSH
T147D0221893E4032AF128873A41B00E46E658B216A0F28F8D0BF25208C82DF920860D1C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 24ab4bb55dc5b2c8d15d62b15d26292aceeb63bc7dedccce789fe472d5e3bd93
MD5 bc49f811bcec6fca886ce2f668fc6a45
SHA1 bb55e7c1ff072667709982868bf9f671f7639380
SHA512 1b38bb859600e2dcdc33fb9141e800c61d705fbb92febc3cade67b383413183e134ae3688fa8887d395280f8527fd4cfd888d23662c7b1f8ba0941d2d6379334
TLSH
T191F05C3C1AE6566DE23227740AF492967C04B2573401E4641AD1020AF707E401D22538
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 f179f7531c80473cec5a64fb66f248d36ab640bc1694a498b9eb68c1e28a4d89
MD5 55ddfc80ca4a63aae04c4e1b44691457
SHA1 f9542a74ff8b157ace2f46c22436136f7fac4e4c
SHA512 820e5076fc52c8d99bb230d2e5eecb1bfc8c7fbae487eb85dead023f40deb5184c2df09e8e32aa14255ec3b0d3a20a11e010cf1b477a4c70c12561dc8837f9e5
TLSH
T13CF05C3829EB001EF111DA7C43D001909622F23232081ADD26F001455906D11EA60D16
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 e1823d0c30b844722337157d0a622c6b90d6aeb3b230eabcd31b6659d052b5ec
MD5 ac6afab6e83a6d7ee9527a5fb2342a1b
SHA1 007d2751b1c40b1a13c404fa9c95cd23db646834
SHA512 f407e2d3c7c66f195c2183ab049291d8ec4dd17bd8dd51d82b6506d5f8c1b4e062e7fd4bd418ddabd9b7438d5f3d42af04be2d351f427630a8043a3e310598ad
TLSH
T177C08C1C0A650607F2A883B812C22D838A208110F3829F0227B12A08CE24F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UserSession.exe
Size 9.1MB
SHA256 683c458fff63283fbaf926abfa871eec30f287615a7198e52fb5c0b879e43b30
MD5 1d27647628c40466f0a7f97afb7d9836
SHA1 b755aab055fe2bb34017ae0f009a6965a35287ef
SHA512 3cf3f1ed09bead8472dc7f249c1d45eb6cc9b585fa35a8f5884b65e56184578279d892376f0e97956e6cb2707a02c7f782e016e7ff75ea8cb897a88c4da63817
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t106Nxa:TDpbgBr/4QAMQMrEGRONY/4Vu0Cxa
TLSH
T1F5A633E6B85E566BD20E1C3E8E468D6235BC5BF1C7284CC7FFC97DB64840C921672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
Size 8.7MB
SHA256 30d13b6d2dd31e6d6a3f9267d2dbcee4770d569da9d90a9fa1587ba04a9379a3
MD5 21317c8154699debfc1238264b5da4ee
SHA1 71c920383a53c3ec89aca1ba882ad6b40471e2c9
SHA512 306a900ffa87c84f83b840bc2ce200b267e52bd8d052910e3bb51d1fe87357050a813964585eb1ffa018b3603af1243fd9127722fd6b9f3fc6a1708db97153c8
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t10T:TDpbgBr/4QAMQMrEGRONY/4Vu0T
TLSH
T1719633EA785E666BD20E1C3A8E468D6335BC57F1C7248CC7FFC97DB64841C921632922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\RuntimeBroker32.exe
Size 8.4MB
SHA256 032b29a8cf386992bfe4c13ee4fd5b27a0388bdb632814b0b7a5f3ea2f24e823
MD5 20a2d8d50fbff3a3f686486c13badb46
SHA1 4b33cb3feb4ca4881501bdac8e32cfebd8f2f5c6
SHA512 4462d75f7ac9d4dd13477d38812a65b296eb7dccdb1a070234461e42a3349c700dfef921c912232f72b6c1e8eaf5c460c124aa856fc0ba7528795a3c3a2fdfea
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t1a:TDpbgBr/4QAMQMrEGRONY/4Vua
TLSH
T1B99633EA785E6A6BC20E1C3A8E458D6635BC57F1C7248CC7FFC97DB64841C921632923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UserSession.exe
Size 9.0MB
SHA256 757c61b0e7bc694db47e47b6076f30c73caaa392fe394cea64a8ca6fe877ae48
MD5 38722a8315141b429016a1a39eebd7d2
SHA1 eecb084753dcd91ce7885e987372d6fdcbb1aa83
SHA512 a815cb9fe9323b5b743d77ca8dcab1ec6eb470a54032d062ee0bf55518878a1ee07a771f2b8072d7ed88707bc46bfb4e28821fcc28f631656dcda99b3293bdc8
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t106NN:TDpbgBr/4QAMQMrEGRONY/4Vu0CN
TLSH
T1C19633E6B85E566BD20E1C3A8E468D6235BC57F1C7288CC7FFC97DB64840C921672923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe
Size 8.9MB
SHA256 cb1ec5922943eebd566e416a3ce2adeab4db81e31b9f46b6112eff691221e86d
MD5 6a8dca1da507d03b414b02cdfeb5f5d6
SHA1 96d98a2424a9e335a81f5b09a1a281feb8b0619e
SHA512 3cf72cdb5cb8acab19b6909bbfa547787b3b6d1a3bad11166dc555dd6f828da9153fa876ee53bc5230b3c17e120938d8f574b450ab06956861802960772ca4d1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t106v:TDpbgBr/4QAMQMrEGRONY/4Vu0+
TLSH
T1129633EA785E566BD20E1C3A8E468D6335BC57F1C7288CC7FFC97DB64840C921672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
Size 9.3MB
SHA256 3318442f11522c9a7e09857368844ce8ce43ccc2146702abcce94d4683cff1c9
MD5 ba3ee66a79edb3f7b53d738519ec14ef
SHA1 8ab8f279d9612b4071b174e35c77830f2c912e72
SHA512 c2f2f6251e938fb1c693eb62f44561fda3dc5ec00e63924265c660937f75e9a93c7cd9ac38722926956ed9f5b2cdbd85749574598d70ab2916bf5b8c368bbda0
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t106NxrBgG0:TDpbgBr/4QAMQMrEGRONY/4Vu0Cx9gG0
TLSH
T16AA633E6B85E666BD20E1C3E8E458D6235BC5BF1C7284CD7FFC97DB64840C921632922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\InputService.exe
Size 8.3MB
SHA256 d722d3dd9858aa8644e3d7b66f1b79d831f9600e4cfb636635b23e8cf94fa0d0
MD5 144f5ced793c21b6cee32d0db75c9ec0
SHA1 2489e61a33785fe7dc6ac5a5ac9133c7856e29dd
SHA512 9efb31c07db2df33a489577d5126cc8706a9d405d489807a5caee7e106a4fabe5a50c04470b4852f44443e40669f03b0a6a11b8c888876d27e9b2b403f3702f8
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t1H:TDpbgBr/4QAMQMrEGRONY/4VuH
TLSH
T1C79633EA785E666BC20E1C3A8E458D6735BC5BF1C7248CC7FFC97DB64841C921632922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe
Size 8.8MB
SHA256 c227adbccfb3d0db0f552d4e2ebc3afd27bb64ce91058cd3cd5c0352b28da0d7
MD5 4abe3b0dcec9966c025f3d1ad334fb2b
SHA1 87f9aeb6d569bb6b287d9678ea8c1f469dc97485
SHA512 2ee3cd81b767ab4bb3097e31170c5d4c76dc55c610d333d07691133c918aac6bdfa8ebafd9b0529c450809bcffb196c1312d21dcb0e938b027acb9c19a13cff0
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t10B:TDpbgBr/4QAMQMrEGRONY/4Vu0B
TLSH
T18E9633EA785E666BD20E1C3A8E458D6335BC57F1C7288DC7FFC97DB64840C921632922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
Size 8.5MB
SHA256 5a58076302c0a3987fb5ec6dc3203ffd6df929ef82d0b8f92d54983138fb88cf
MD5 08cfe07f244263c483788411e7490d04
SHA1 006b6fa8ba9d2968a1e09b268c08f128b745b9e9
SHA512 745062500a98e69e8094520abbda00eaca96f83c768d90a543ed45ce95627e546fc60714f01ad5cf462351eda850d056be56822c589b7219a4aec23ad7d7834d
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t10C:TDpbgBr/4QAMQMrEGRONY/4Vu0C
TLSH
T1779633EA785E6A6BD20E1C3A8E458D6235BC57F1C7248CC7FFC97DB64841C921632923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
Size 9.2MB
SHA256 e4434261a73f75058dcca1a018c0ed1db5eba35e59d567d18c3d4e2073ba4680
MD5 ecc7da229b9592ece3ea30fa17035940
SHA1 4953d44afb7043699aee470a5cac00d19b25d2c5
SHA512 ae5474ec83b5778668e02c86fdb0886ec89a26355f3f198ed215ea34fbd8e1c006bec25e4d56319d7e9492c165ee3f7bc7dc237baf8c0d66619c2263ed390cd7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t106NxrBa:TDpbgBr/4QAMQMrEGRONY/4Vu0Cx9a
TLSH
T16CA633E7B85E566BD20E1C3A8E468D6235BC5BF1C7284CC7FFC97DB64840C921672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
Size 9.6MB
SHA256 2196510ca665407d264542e27d8dfbb336aaa0bd53557432d55e42117590b895
MD5 127a91e23c1ce34fe5074394ae896481
SHA1 63f147539c627f7d1688c7a67946474a89266614
SHA512 00a0a5104fd9d84b720580e7c32e70114cbd9d6edeb193695c77ecb7462ac6f73b85a77e06976269c7fce5bac86ddbb80bcf3f77b535d4479bfcdc75f68a2482
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t106NxrBgGfA:TDpbgBr/4QAMQMrEGRONY/4Vu0Cx9gG4
TLSH
T13AA633E6B85E567BD20E1C3A8E458D6335BC6BF1C7284CC7FFC97DB64840C921662922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
Size 9.4MB
SHA256 f0aa0c500f10a8f66ba0a4ac24a3e36c9670c2863c9df541a54b0ac55a8f4d2f
MD5 6d0d1812a8b44c9e271fc06700ee561d
SHA1 63a328855440f8b490fa24551ce24317043cb165
SHA512 98287791e93780172c81320da061dbfafa8f0c0daff0ef24a44ecccd4443d3f70d21d669e7b01195aa3b9d4234791401f78367e84fd2c603c3b52f8ff8ecd144
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy3t106NxrBgGf/:TDpbgBr/4QAMQMrEGRONY/4Vu0Cx9gG3
TLSH
T169A633EAB85E566BD20E1C3A8E458D6335BC5BF1C7284CC7FFC97DB64840C921672922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download