ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
Size 8.4MB
Sample260819-s2az1adm21
SHA256 ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36
MD5 ed9f2b6e1f7f321f8fed490c403f668b
SHA1 24b3515297273cc94a97a69b7ae1d2879096ffb1
SHA512 b176ce7aff3b3b405f3a3812bf5caa76f0f015ea5805e91802ce9aab163f4ef4d3269c2bd2895924cccb491448a19a151cffbfc838c2ef80a13764f226f7253f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9Iu7:TDpbgBr/4QAMQMrEGRHsww7Q8RZ7
TLSH
T17B9633E6785E6ABBC10D1C798D16CD223A6C5BB1CB545CE3EFD53DB60850C532B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4824	DesktopWindowManager.exe

Executes dropped EXE 10 IoCs

pid	Process
5016	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
1440	RuntimeBroker32.exe
4468	RuntimeBroker32.exe
3884	DesktopWindowManager.exe
864	DesktopWindowManager.exe
3260	WindowsInternal.exe
5232	WindowsInternal.exe
2580	WindowsInternal.exe
2868	WindowsInternal.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\DesktopWindowManager.exe\""	ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\DesktopWindowManager.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\WindowsInternal.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsInternal.exe\""	WindowsInternal.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
69	raw.githubusercontent.com
12	raw.githubusercontent.com
30	raw.githubusercontent.com
36	raw.githubusercontent.com
63	raw.githubusercontent.com

Detect suspicious telegram bot 5 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x001000000001c42d-10.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c430-19.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c439-91.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001a2e4-137.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001a2e6-172.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1396	ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
1396	ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
1396	ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
1396	ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
1396	ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
1396	ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
1396	ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
1396	ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
4824	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
4824	DesktopWindowManager.exe
5016	DesktopWindowManager.exe
5016	DesktopWindowManager.exe
5016	DesktopWindowManager.exe
5016	DesktopWindowManager.exe
5016	DesktopWindowManager.exe
5016	DesktopWindowManager.exe
5016	DesktopWindowManager.exe
5016	DesktopWindowManager.exe
1440	RuntimeBroker32.exe
1440	RuntimeBroker32.exe
4468	RuntimeBroker32.exe
4468	RuntimeBroker32.exe
4468	RuntimeBroker32.exe
4468	RuntimeBroker32.exe
1440	RuntimeBroker32.exe
1440	RuntimeBroker32.exe
1440	RuntimeBroker32.exe
1440	RuntimeBroker32.exe
1440	RuntimeBroker32.exe
1440	RuntimeBroker32.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
3884	DesktopWindowManager.exe
3884	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
864	DesktopWindowManager.exe
3884	DesktopWindowManager.exe
3884	DesktopWindowManager.exe
3884	DesktopWindowManager.exe
3884	DesktopWindowManager.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4824	1396	ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe	91
PID 5016 wrote to memory of 4468	5016	DesktopWindowManager.exe	95
PID 1440 wrote to memory of 864	1440	RuntimeBroker32.exe	98
PID 3884 wrote to memory of 3260	3884	DesktopWindowManager.exe	99
PID 5232 wrote to memory of 2580	5232	WindowsInternal.exe	102

C:\Users\Admin\AppData\Local\Temp\ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe
"C:\Users\Admin\AppData\Local\Temp\ecddfb535afad555f6a898ef052f15c1d8096fd1e506e638c5744f6cdf87bf36.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4824

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4468

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:864

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3260

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2580

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 281B
SHA256 9342b56792fbd95afc46c0c706076ca878d09131366179fd6ffadf18bdbc1e81
MD5 2b0c840d73c0899c377df15488a33a79
SHA1 b6911787173bc43babf1a0ae784370f31740cfb9
SHA512 68bd1cfb1db1c9ec6a70227a192290072ef0f4e22e9a972310b4038000a189534cb6043353288599b52c6a2c31ed7b1e01ed49d3215115081c52c554361ead57
TLSH
T15BD0EBC603FFA9E26D73EF7044E295213002B45236B0A920684CC02A0820D286F11000
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 28ea4fc3b213e110883392bef66a06b08403d03a948fb5afc950afd6bfce8b78
MD5 3dd0ee334f9db9b799eeedf61ea32cf4
SHA1 b30a9cb7e59316d87650a4a74abf3b889ae1e164
SHA512 8ea3c974c6b2b505098cd9bec068907b066783210d888fc0368f7b7ed4006d8baca1e515d37483e2e6f00fcceb7c355c30521ecda80e38147876c72aba7f7810
TLSH
T1E0E07D1A576C42EABA32CC1C869A1066BC49D14D44A74386740866D1086523BC40F11A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 8c4695f752bf084010c49d0ed36b97126598a2bebbf94e17dde463f83ecf02dc
MD5 14c66de9a7ae38080211961f49745d4d
SHA1 7c96dcedeae71305e6471c5f0054a7f186835029
SHA512 f603ad765c357ebd320604bab5bae7395d289cc6cc0b85d0abfa60943c9445589a8762cb9ef1c843da9546b86772256d9914b6e27bb24c44a9882de571b0e1f9
TLSH
T10141B5EA2B297570FF82CE8899B5DA362D3CF194A5C5745E35F688E33081F906D1688C
MD5 SHA1 SHA512 TLSH

Submit Download

6EBD0D78D799E307DA6AD4F19004AA0E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6EBD0D78D799E307DA6AD4F19004AA0E
Size 1KB
SHA256 0aeb02259965a1caea9f183ed09e30c3054901a51fc3af687e4718e4fd7a1904
MD5 5ec070b973580ba6c514832be30c66c4
SHA1 fb95a785e7aa6f500c9175909f29ce509ecd863e
SHA512 a598e26c92f5d2209067a91c15c61aa1f43d6fa584b5fb8e872c9adbb0b2e57a4db25b999b5e401121c68e1185061b39119fdbbdf00dc421f27ba700ff8e7ff5
TLSH
T1F521E1F91D85656626C4BFB0DADBAC5B9D79456413D0C4EF01519AC90473BC1DDD10C8
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 7a484b164322ad9b84df778cff481f2782b7384dda0682e26cd5ce8855adcfe3
MD5 a2dabe6d378561dcc5d6d0fc622642d1
SHA1 a5e4992380866565bea027241cab5b9451d25ea1
SHA512 31bf6a631606147caa74557158c77a4c06a7554e547016b0a67ff10f522c956dc71f057616ce8672d75900e35bf172eaf269e90dd9dde7db3bfe94fee048372d
TLSH
T16D11E5C25EE8A09199E29670C7E4C5727C7570856DFA75D01891C8D2209A71D6F1903F
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 d19d87a5a4c83a60271a9f9666ea4bdb1ac2aeffdb786a250763a94620a0af45
MD5 b47843bd7fb5a877da3a63004d3afeda
SHA1 f5a846becfd8e93330e8494a4aa27d080fee2f5e
SHA512 62d1ea80daa8e1a0f8cbf8dccdfcc6669719cf1ba4977a2ae362fb3c218846031c37969fe72ad24a8c24f99bd6e0ed4c6bb5da70de698030b54ee0dbdebd2088
TLSH
T115F0AB30347C4014E073A879CBDAB0AABC29F21A7C05ABFB17670709BA46D410CA253D
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 7d7cd500f2c7a2b076b7bfe645f761b5d374610561c721673c33c9ffb77b94e2
MD5 9a2ffa47a13221792578400c006b7883
SHA1 cecd5feface0193b8e0864e4812774b4c66836ea
SHA512 0daf9c68234a389eefdc2f6e7dd1def542da1c945b5134c49c04eb48b0285d9a28cb95f5af89ab29351aa0753277fc5d4e56ccafbafdec0e3918d04f537c5e1a
TLSH
T128F0273C3AFC416EE133DE799AD8A2B59814F212340441DA1A9107886B02E025C82428
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 51748fb1529d2f5459ea0ea4a474f5014174893ab22723e4d82c2f251f5cee35
MD5 bbc6296e2ccd07f10a3bb60e87f47c57
SHA1 56c83d15759a26c38571459e6f574e3f61c9c3d9
SHA512 5cfb223944e7a9d02c6bebd3b9475c0664be25149ac708466fd620fb0baa9da9ddda4ae98fa2658989ad108a27da407d4ec2db797652bea647e53f29aff68e15
TLSH
T1EFF02B243AFA413EF177AA3547D675716825F225A60111B8156113042F05EA02C9261E
MD5 SHA1 SHA512 TLSH

Submit Download

6EBD0D78D799E307DA6AD4F19004AA0E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6EBD0D78D799E307DA6AD4F19004AA0E
Size 238B
SHA256 f5a1c8b0d941cb88a0161db58778ef52e0edc5307f2da1a34e679dae3775df49
MD5 a22c535c3f7b53de83ea3dd2e5e5e763
SHA1 db5e6b4f4c4c10f7836935b76543f5cb296690b2
SHA512 5be20694bca01fe773f250ea2c86eba79cbf1a85b4b5f33cf7ea3df324d6a0c33878437715ab310972153f79ff2f47ed8b07ebc977a93ee2fe086fde41242dee
TLSH
T19BD0229027E90010F1138A3AABF1C487F720F4087802CB461BB14288AD2CB410634E0D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 4cc54ad94429ea796f335fa7c3197c55af16d7f949ea4400b0679c26e129826b
MD5 6860984104c92f67f4af8e7199384c91
SHA1 313ca787f98d2bc9c5ab5e71929662a38d8da56c
SHA512 0b82f39f7e75d9325875243481c03269a083c63e5043fc437dc98d1eb859205f9df9893396e22b14ca05c87ac8e22ff9c05291d0877d9915f5b4c09697795407
TLSH
T148F05C281BE2402EE2326B7649F593E9EA0BB2123405C09D15D74609EA43E403D1153C
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
Size 8.9MB
SHA256 3a3c6c4d7d2a37532ccafe7f22481ab7fedd48ae7d97407d72c47658fcece97a
MD5 ae8310dad1646f188daac11598c68a91
SHA1 e07aff191d0d5131732ce72f1964f0b7f8a0e7d9
SHA512 c91ce9692538266e5fc8be4fdd6c49834f321582d70a22e93cee3e8afe3c325e3c781dacd0a51dcc83a120f4804a4a8ceb5ff519bd1cd43019ac70db63b453f0
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9Iu05Qd:TDpbgBr/4QAMQMrEGRHsww7Q8RZ05Qd
TLSH
T1729633E6785E6ABBC10D1C79CD16CD12396C5BB1CB545CA7EFD53EB20850C932B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
Size 8.8MB
SHA256 daa41be8fcc81d4fde5533faab684c85a6641a277723b4f5c8cef025fbb184a9
MD5 870a94d9aaf64f501a9f0c866fb26c1a
SHA1 2c8202e9420a2adb87e05c95ec38b930b46362a1
SHA512 c2cf15d9f1aa2ce0213413a4969ce784f133f709bb2d276e4d2b762734999336a8f50164a8e13938f71c3b6bd33fac666822f7bc5c492354785bfd4d5659ceea
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9Iu05z:TDpbgBr/4QAMQMrEGRHsww7Q8RZ05z
TLSH
T14D9633E6785E6ABBC10D1C79CD16CD1239AC5BB1CB545CA3EFD53DB60850C932B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
Size 9.0MB
SHA256 bd76cd134564f83a2c3da66bf0e4f60e0e6c891911491fa95fbc4e4f5ecdcc1b
MD5 c479fee907ed1ff50c0ef4801de52382
SHA1 b725302678cf9ca430db2b9b4c9d8f32f7bd34bc
SHA512 da95e7e3016991eeb81aa1f0a31b90e7937065bafe144150c76f860ab961cc2f899679393131191fec646e2a0458d06dd0f454606bc8d8d41266ab41962a4647
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9Iu05Qa/:TDpbgBr/4QAMQMrEGRHsww7Q8RZ05Qa/
TLSH
T14C9633E6785E6ABBC10D1C79CD16CD12396C5BB1CB545CA7EFD53EB20850C932B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
Size 8.5MB
SHA256 f96668ea1751b6f4450623b1853cecd652397091aa062d5e8b7bce2934fc016b
MD5 9cec2af57281ba9291071dc803718ac0
SHA1 552d68e98fb2420963fabad33737879abbbf5d6b
SHA512 c07810a4fb6631b1e0a9a8d01caf2b31907202eba1844c550103aec631d2c2b495413939878eacd349c1862b794c0288784d193303dbc84b399c3a4f1ff2d3fc
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9Iuw:TDpbgBr/4QAMQMrEGRHsww7Q8RZw
TLSH
T1E19633E6785E6ABBC10D1C79CD16CD1239AC5BB1CB545CA3EFD53EB60850C532B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
Size 8.7MB
SHA256 14a51480c69bfd7d88102e257b3a10aa0d40903618fdca77710bfbe355fa0190
MD5 d86fa728b0d4f971a15848315b50ef42
SHA1 64879cd31ea83baad713a0ba0d58cda7bbccdd47
SHA512 5bfaad733ae673a0df79a34725de7abc159d58e64a12326aae24f3954f88fd9986f492d6b4b29e1f4c11efa46c4e069ce2bf2ca5a33ff4ca1824ae613191aab3
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9Iu0O:TDpbgBr/4QAMQMrEGRHsww7Q8RZ0O
TLSH
T1699633E7785E6ABBC10D1C798D16CD123AAC5BB1CB545CA3EFD53DB60850C532B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download