6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
Size 9.1MB
Sample260825-vbv9cswdnd
SHA256 6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547
MD5 3c0fe12d86216bc8dbbdcea04c85d13b
SHA1 b8c070aa475594a976f71c47a0d2164d5052607f
SHA512 46e7a123f4194db15a737c1b154fc626ac0a674d1e650795b01ccc9212ba7652aa7b8fc55c26e3875adc4258b264d6c7f2e15ae327bc2519ca096b10c9678a99
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jT7:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2r
TLSH
T108A633EA785F6BABC10D1C7ACE068D6235BC5BF18B644C93FFC63DB60850D521722926
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2996	RuntimeBroker32.exe

Executes dropped EXE 20 IoCs

pid	Process
2996	RuntimeBroker32.exe
5736	RuntimeBroker32.exe
1812	ServiceHost.exe
5416	ServiceHost.exe
1824	RuntimeBroker32.exe
4856	RuntimeBroker32.exe
4468	ServiceHost.exe
2560	ServiceHost.exe
4972	WindowsShell.exe
4056	WindowsShell.exe
6100	SystemTrayHelper.exe
256	SystemTrayHelper.exe
2248	DesktopWindowManager.exe
5084	DesktopWindowManager.exe
3804	BackgroundTask.exe
3464	BackgroundTask.exe
2244	WindowsHost.exe
1904	WindowsHost.exe
2644	SystemTrayHelper.exe
3360	SystemTrayHelper.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\ServiceHost.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\WindowsShell.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\BackgroundTask.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsHost.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\RuntimeBroker32.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\ServiceHost.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\RuntimeBroker32.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SystemTrayHelper.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SystemTrayHelper.exe\""	WindowsHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
52	raw.githubusercontent.com
68	raw.githubusercontent.com
78	raw.githubusercontent.com
83	raw.githubusercontent.com
88	raw.githubusercontent.com
106	raw.githubusercontent.com
109	raw.githubusercontent.com
1	raw.githubusercontent.com

Detect suspicious telegram bot 13 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c4e6-12.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4eb-22.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4ef-86.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4f0-122.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4ef-156.dat	suspicious_telegram_bot
behavioral2/files/0x000200000001b224-208.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001b225-249.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001b967-283.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001b225-318.dat	suspicious_telegram_bot
behavioral2/files/0x000500000001b967-352.dat	suspicious_telegram_bot
behavioral2/files/0x000600000001b969-387.dat	suspicious_telegram_bot
behavioral2/files/0x000600000001b969-388.dat	suspicious_telegram_bot
behavioral2/files/0x000600000001b969-389.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5764	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
5764	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
5764	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
5764	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
5764	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
5764	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
5764	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
5764	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
2996	RuntimeBroker32.exe
2996	RuntimeBroker32.exe
2996	RuntimeBroker32.exe
2996	RuntimeBroker32.exe
2996	RuntimeBroker32.exe
2996	RuntimeBroker32.exe
2996	RuntimeBroker32.exe
2996	RuntimeBroker32.exe
2996	RuntimeBroker32.exe
2996	RuntimeBroker32.exe
1812	ServiceHost.exe
1812	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
1812	ServiceHost.exe
1812	ServiceHost.exe
1812	ServiceHost.exe
1812	ServiceHost.exe
1812	ServiceHost.exe
1812	ServiceHost.exe
1824	RuntimeBroker32.exe
1824	RuntimeBroker32.exe
1824	RuntimeBroker32.exe
1824	RuntimeBroker32.exe
4856	RuntimeBroker32.exe
4856	RuntimeBroker32.exe
4856	RuntimeBroker32.exe
4856	RuntimeBroker32.exe
4856	RuntimeBroker32.exe
4856	RuntimeBroker32.exe
4856	RuntimeBroker32.exe
4856	RuntimeBroker32.exe
2560	ServiceHost.exe
2560	ServiceHost.exe
2560	ServiceHost.exe
2560	ServiceHost.exe
2560	ServiceHost.exe
2560	ServiceHost.exe
2560	ServiceHost.exe
2560	ServiceHost.exe
4972	WindowsShell.exe
4972	WindowsShell.exe
4056	WindowsShell.exe
4056	WindowsShell.exe
4056	WindowsShell.exe
4056	WindowsShell.exe
4972	WindowsShell.exe
4972	WindowsShell.exe
4972	WindowsShell.exe
4972	WindowsShell.exe
4972	WindowsShell.exe
4972	WindowsShell.exe
6100	SystemTrayHelper.exe
6100	SystemTrayHelper.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 5736	5764	6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe	91
PID 2996 wrote to memory of 5416	2996	RuntimeBroker32.exe	95
PID 1812 wrote to memory of 1824	1812	ServiceHost.exe	96
PID 4856 wrote to memory of 4468	4856	RuntimeBroker32.exe	99
PID 2560 wrote to memory of 4056	2560	ServiceHost.exe	104
PID 4972 wrote to memory of 256	4972	WindowsShell.exe	107
PID 6100 wrote to memory of 2248	6100	SystemTrayHelper.exe	108
PID 5084 wrote to memory of 3804	5084	DesktopWindowManager.exe	111
PID 3464 wrote to memory of 2244	3464	BackgroundTask.exe	114
PID 1904 wrote to memory of 2644	1904	WindowsHost.exe	117

C:\Users\Admin\AppData\Local\Temp\6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe
"C:\Users\Admin\AppData\Local\Temp\6b7f82f9d8d95c4adb8efa4e55131e53382b5840c0857464eeeda52291ca3547.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5736

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5416

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1824

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4468

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4056

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:256

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2248

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3804

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2244

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2644

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3360
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe" --monitor
  2⤵
  PID:5324

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe"
1⤵
PID:256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 282B
SHA256 55fc8e1cdf129ad0a0206ec4abb9519e7ad53b812897eb11a2c62d6bb15f62c3
MD5 bc7468705f79afa8503bb51682f2b8c3
SHA1 d1ad73df3213f4e1ef816b66105eb7106ba453a1
SHA512 62b0d1b157602c7e2d3b0254567d6ea446d1d92bba31e09ac4054e612e9d2392737ff3779f65fa9ab85485231485f45a7a3e24fbd1ed6fed7e33e7938eb64e13
TLSH
T1DFD02B46A9BBA412BE72D99044D1F530740124B215E029323C2C8AAAA930569D707D64
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 9066534b093088a317bb7df20fec902d509d2b711c016a7d7600e2716cb4a79f
MD5 89d8bd33620c0cc6a7066158cc9551a9
SHA1 f358fa3cd3fc34fdc112817e3ac8489ac78de970
SHA512 d34f5dec12f5487e260ec7e5f257341e8bac0bcab006bb98e6a0b7b8c244cb330c2254529dd6dd0a1ea6c48c485a1a481aeae71d1c6e5091b2c39843fa85728d
TLSH
T1B1E0722A6B0C46843AA3CF2407E89C733C6A518964921215681897E20A426EEC30F29A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 46192fd99dd14ff84abbad0a5fe7f97bd5c0f69f6ccece10e35b752d5fdf0001
MD5 fa8c7b1c908e099bcc09dbf52a4197a4
SHA1 25dc527d3ffe7ac297410026b64a085492f91838
SHA512 224766911ec6fa418fc96f316f9a8b5883d7de4a719034c68bf651b7c65c08946c3b5efe22de9b781f6dacd936ff6eef477f3023c083ffe4271719c09771d2db
TLSH
T17F41F7D96B2C3464FF85CF8560BCC7362D7CF0806940A1A675FB84A13097FA44E0A88C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 175KB
SHA256 773121b352694c89359d8f1a20439a25a08375742d2082056a8822676c2c7d99
MD5 90a26b9fefbbc27f5424237bf25038d1
SHA1 0d853e9487a0bbb2395610e41324fa4ba77c8dbf
SHA512 59642457aad97d0be364a48d978302f6f3cb157729acac420fbdf3703167f5da90ef6de0ca48bbaa8caf51306a15856d65c5f7dd03a0ee7b56222a7b9e95855d
SSDEEP 3072:V6xnuMF+K35BgXrLCYHB4U/Am7R8sHMbhuJ4:V64u+K87WCB4U/Llsbh04
TLSH
T19E041BA85C3BB6A3AD07CF524DAEF69612E591C52912732E3E347E505C13ABFDA13C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 06e16fc816cd78ffb99afac3ddb8b50e6aec5ca8ccc83e66de02bdcaae6d3567
MD5 51184e69ed2cb5631bf01411ef13d33d
SHA1 84c61f6ada63505cd720ca6ee0ac30270c5acb41
SHA512 15b935ce752932e8289f8523ed04c757bc6d4b011d385b170321b1ac6361cf7d413e43e9b355393e7fb14e276476ebbf58638670d1513fb9065755b7e0752296
TLSH
T1E91121C29FE4A09085F786B0CBF8D5337C7870C62DEB30C12C81C59220967186B1903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 4ce2b314c02b6366b457504874137b6284e8740b14cc2ef2891f3ad1f1ae681c
MD5 3d35b4e5f0f811b75f5656ee44655dd7
SHA1 72932ad0851d1363afebe2ec5c8792f3df60bff6
SHA512 3efeb928bf36877375c5ac23f54dfb264adabea2292199de8128b50a4c1218c4dbabe95d2f7588b56d06f6e631bb81190cb70fffd2713ac3c0968402c8b9fca7
TLSH
T1B341E7E75F0F7464BF05CF09AAB8C9361E38C4B492801A91B8B389D610DAB912E4A84C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 2907edf3d3b900565ec8fc36b54e3f0282ff15cc4019d540e7d6711656fee742
MD5 bdc1477f58fa25f58b7db0ffba0527d9
SHA1 895d692c42df39d9d9193c2480d7ed09e8bd8c3b
SHA512 988526635fa46169765fd8ed2fe5263e1b2d405ce29b3d61325b8a7752fa5c49cc83f6016d36cbb06a26df3bcc23ef715fc729abf2a1e64a7725dcde640f1cef
TLSH
T13AF0A31075BC4258D072DCBDD6E472AAF616F1117808DAB61D5706055B079015D59A3D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 4c5deb94aa541652a6e571683c7c8324953e1001fcf7fd24526cb3fe9b101b59
MD5 aa5cc4f0c0c75940de298858fa66693d
SHA1 13965d1c26d151dd30453ce5b6cb849d4ecc2c65
SHA512 aa3e8329614bed83ed4f0ccf648df70fbf108fea1bdba12bd4e700ba5243fcc8915da5c47c1c27ff6ab0c015f68d5b981cd21b8b9c640e1bc0b286c0a5a53dbc
TLSH
T123C08C2C5EA24A06F3A843BD62C139139B208101E2418F051AF12A48C996B263838C3E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 cc1f3e9632d56d3bb72fdf21dda195f9dd2cd11157072cac47dd8ba5001b92c3
MD5 094339170b2b209ea499dc13411ce124
SHA1 95985b0e42d181636949cbefafc4e2376ea49af3
SHA512 136ec574fb4c5c0a16f2a5edf06d1e36185dabdbc8fa630cc970c7aeeb43fc421d72976f1125dc7738ec27e574e9543bd9c81eba347b087ad60e29c7fe2e4b05
TLSH
T1E7F0553C1AF851BDE07ADA789FD9A7A65C15F63314044AAF1AD14B4E9B02F029C4246A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 ad85b18043abc58faa4d560b29f6d631ec34e12a6f615b5b390e1066f5eaf6ba
MD5 72cb5f18d84c672da0c6b8bad696dd94
SHA1 e60f880770c11e71eba48025e5bddb79999bc2e0
SHA512 bcba792e376afffdf0074b4b99672d0173d02527058133f9494d0533c741a42af56c5a729f7fbd3e7e7803d8ffe1400ea39bcc4929d56c614b5af74190be13cf
TLSH
T1BEF0DF6839FFA17BF17BD97893CA61B18A6AE216700629B824F117096E11F61BC41609
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 9b3d132457b4b722a901ce605f1dc21fdeb45867cb6bbc6e6969b892c8121aea
MD5 12c175f213939c00039e27823444bb6d
SHA1 31adf3b3bc843ecff65f6fa811f7146c8229c2f1
SHA512 bb84e924932d25327ee83d76e1a47ce3fc09a1ceab945abbfb1f862cdb32548982d749c3d2d5d8f735b5cc8285f89a9e7aa7c7ff8312c023355e2fc57f665bb3
TLSH
T1C1F061283CFF5177F13BD97C53C930714929E216700219B639F11709AF41F607C40509
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 459171ca43696252527781f11bf3f652089f6e128fafc03b5c156339fd11ad01
MD5 f4de40b0da64582105ed6963107c4f48
SHA1 474958dd10cfbdac9bbac47b27cb93c1b982a912
SHA512 5c20d071dae68ce8e9108e9be8e689e456f14024b211902a2f8bbcbd068e5179ebd1a309c3ea6ff4657d4096dc0f07d9c6bbcd9e810871ea2b5f187793e36a60
TLSH
T104D0223DAB520212FAA5C23D22B506C0AAB49022B0C03F195BF3204C0818D002E6280C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 7b1d65d7dd03a318a723bd9b735d6261574a5de331cdb36eb68dc2ac13908960
MD5 9a9b08abac38c132fd1e956ca8a31fc4
SHA1 3ee8c2b4c6c8c6a22b031a6b77d8aec53b4e0aff
SHA512 7e09255926986fdec8fa1cdb23b51fa342564c82042bbd8932adc9080b2711303d68a04144b350e5f31f4bf6067e6201fe1cbddf88d0315a91318b6cf9f4d570
TLSH
T108F0A33517D2401FF2733A794EFD53AADD16B1563401CDD426F6470AEA17E105D1057D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 8c1190016fbcc6515ad155f7f92a029b751c0a66f86208ec78059e18c66a09f7
MD5 0c9bec21ebe4b1ddd73d2db60530406f
SHA1 d35ba45e015d5a8e6001e758606ac1165017f5d1
SHA512 27b92e2eadc9d90c9c4e2ba05e7a70814a2aabb1aab0d35cbd7632d8cc1d2183a9ecc6116237bcf356a1e22a8028e8003dd6a9d29ceda959fbcd580ec733443c
TLSH
T14CF0AB3C24EB001EF122D67C43C105DA5633F93730083B9E29E10309AE46B827E62D20
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 dc9def62ee03e83d86477bf50216fddb2db55693202dc69e5d5e4a052037773d
MD5 38211c8661ceaf893061143fc61984b8
SHA1 c898eb847e86e2819f9fd42e8a3e8c9237ce3858
SHA512 5d3ffc5debaece11b67be38e67a5003c549e1b3a2a9ddc93a640eb0524b69d51ac9b333d43573d356925bd46f94805ba05b545eeb1d31571755afd41456944aa
TLSH
T182C08C2C1B660606F2A883B812C22D838B208210F3829F0127B12A08CD24F162838C29
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
Size 9.3MB
SHA256 5688591d4b19251520f2e81d66389834d3febff385e31d37236b9b23e6c445c8
MD5 ccd88bc1b60888e8074ed0347aa5a72e
SHA1 9bcc3caddeebead9b2e4c830a1996c4631f4f8df
SHA512 5ed01b09c74e16be8b82f1f77c7dae2856f12b4509868d137cf5c68e261aa97538c6d38ed2b98329ac1a54475cbb03a117d4a3c50a7f7301cfb775ba3366ed6a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJZ:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2L
TLSH
T1CAA633EA785F67ABC10E1C7ACE068D6235BC5BF18B644C93FFC63DB60850D521722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsShell.exe
Size 9.7MB
SHA256 791b1143b72029cf5d5be520f920c95935f0b42f42c6301d30a3f81bcadfb330
MD5 fc4eb53ad17937103bf5166442499197
SHA1 5da318d0f1d5257373c6a7ce4a8dbe8d19c94d0b
SHA512 7312a179cfd5c886c170e36e544e3d54b78366066f68acf5c824cb161c34240e260986f2bdfd1b5080ea1b1d251405117704a1516b24b22b91ac10baa0d70648
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJBp:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2R
TLSH
T1A2A633EA785F67ABC10E1C79CE0A8D6235BC5BF18B644C87EFC63DB60850D521723926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe
Size 9.4MB
SHA256 ede4873df2b48d5c8de501a0c67dfffc1d7f817bfc48bc3b76ab664f00654ff3
MD5 8a983c981a286aad8a1828f98a4d62af
SHA1 d483132f2c31fb085a4a742c3f35900d46887a2d
SHA512 adaf94a0df54c540ee3c74439a8fe47d4788c593031be30d1a8e44331051b16d740951d5762dbb05eb0c6c1e71c2fad64192c291a993f3b2f0f59180d3d7df74
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJs:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2C
TLSH
T1C4A633EA785F67ABC10E1C79CE068D6235BC5BF18B644C93FFC63DB60850D521B22926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
Size 9.8MB
SHA256 4629c9b1b8d8344cb95e26d95766c3b1ee5a96b14b968dfe3afe5bb7251a8cd5
MD5 9cbff0e77ab94295bb68563d7c2f9987
SHA1 b7f63f461f123b21dcfbd81737fab125b660aa27
SHA512 2cf84f894c52655df3810387c2d576e9a9cfe300925d8939b4a354acc904d50d9aafff5c0b8a1265bee2b209b144a09bd01fbc82340692857ad059b8cb637086
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJBD:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2L
TLSH
T169A633EA785F57ABC10E1C39CE0A8D6235BC5BF18B644C97EFC63DB60850D532722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe
Size 9.5MB
SHA256 0207d396a500e85d00144a6841cf41a671b05fb7c0d51f86fb53c1a67cf2691e
MD5 866f0fd8815ed70af57756713caca2fe
SHA1 edaae4ff4edef77e467c96fe7dedbfd9eb74a4d2
SHA512 e79c73ca97256b867b566e3ba2ce49ba8a8bbba12556e2578da1ac0f45ae675d3b461536266a7c14433789af851ebfebab58c4a48f39d07589ce3b940afd0676
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJC:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2A
TLSH
T101A633EA785F67ABC10E1C79CE0A8D6235BC5BF18B644C87FFC63DB60850D521722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
Size 10.1MB
SHA256 d580976e22a67b40c030638240dbef919b450602b9080c22f7ba1e7119f9e8e1
MD5 4a39b54aab676bd1a76228efaf20b74b
SHA1 c478570b37afbf8a87509f5d335ed76ffe338d4e
SHA512 72df3061429ce9a815bf5b4ddf5d957c8cb3c79664d5726d20a5b83d314d44b7072b5bccdf0e852673777d9c4fbc6822c184fb5bad6b6c6c38e829595afc44b7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJBZ:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2x
TLSH
T1EDB633EA785F5BABC10E1C39CE0A8D6235BC5BF18B644C87EFC63DB61850D531722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
Size 10.0MB
SHA256 85e92d1b97cac1bb7690934ecde2a3c28b1def8cd5639ef25da73e794a191a70
MD5 08408b189132d0e97b5d14d827273abf
SHA1 0119e91f69ac863abb4b6121982f97dce8962b5b
SHA512 ea3499503cfd6c03745b8f1c3f32d297e0aa43e6a4d24e737e174dd8a323443d847aa0d8f06fdc0ecd69f45333a921810e02736c44f20d6adad41b59165d66bc
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJBE:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2M
TLSH
T1F0B633EA785F5BABC10E1C39CE0A8D6235BC5BF18B644C87EFC67DB60850D531722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe
Size 10.2MB
SHA256 0c38c87d744521674ef83dee6488a5b902091ed900a506eeb555f7a6fdea2b70
MD5 454fd37b15df082045b1fae49e2fd34b
SHA1 60ec3fd0912577d990035642578c87fa90bf832f
SHA512 a34660fe740aab19a6a29dbaf2d58c0a5d8105f9ff8d42615c50c310711cd397fe4953b24adcebf6be2996e0c53d6a6746cc6b57fdce1bf41952da61489a8c28
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJBe:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS22
TLSH
T1A2B633EA785F5BABC10E1C39CE0A8D6235BC5BF18B644C87EFC63DB61850D531722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
Size 9.8MB
SHA256 aa5ec7f47c8b892959f8b332640bd5bf3115cae189402f80da14cdd92be69ddf
MD5 fa5de576744a29cf5936b5ba6e592f6b
SHA1 4f3bf57151bf45e6a217adab1dfa0a8ecb92f1ec
SHA512 5116d1a0f2ae87483855c468e52bf11e11b087201c5edb5780a06713e6bffdb129b2ceee1f211b65a2f56abc8779575f568d9b43a5f613d0d767a310b3f54720
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJBr:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2j
TLSH
T19EA633EA785F57ABC10E1C39CE0A8D6235BC5BF18B644C97EFC63DB60850D532722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
Size 9.2MB
SHA256 d84c7d14e198104567c4b97d99d1ff03bb49992e21c7a7554df372e8445b0866
MD5 1a6e7831f7207fb509a6e4db7e64b9b6
SHA1 2c321adf380b5dfb0cb59758eb30c91c5661f158
SHA512 49d2f8d38f845a08c8a12a29bfff627055cd72329ed4fddbdd3c238090016882f0365d8ee77f5af5b0a7b45c7781b68772401d4080953f7b0c43e2777349a284
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJY:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2u
TLSH
T1E2A633EA785F6BABC10D1C7ACE068D6235BC5BF18B644C93FFC63DB60850D521722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
Size 5.7MB
SHA256 e93f25cb1cab13a56f594fc5bb7701add4b4419bf351af1cb743b5215e93ec94
MD5 5b5ae0cdbff43e70522fcc11a77476bf
SHA1 54ac9e9c661e6ab1c39b7fb5264f91e1795bba73
SHA512 18ac59849ea0f398f9eacab60b0e0ee6f170e67eb82abefcc0428b96268fa9179bdd4bc9cb9821cb6a7b6ccdaa4013c6ccf38a2db4915146c4c45b4b788a8ac5
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8Leq2orYGmFmxV0oOy8PhWVl:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDv
TLSH
T12C5623E9785E6ABBD20D1C7A8E16CD6235AC5BB1C7644C97FFC53EB60810C931633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 9.9MB
SHA256 5601085bcd9efda1c9bc1030ea5982ed1e993291185e79e3d26f0b79a31e4ed6
MD5 880610c6a91d544edec812c8d7fab71e
SHA1 6035b9d255519ffcb81b4c3fa2421133e40fa5fc
SHA512 da8205a8c58ede8e05cd7da8d035c79e6454bddbeaac79ef9963b0df4c795960c4722a45baadd419a791b1409322b300bf4a6d9846ca3fc74d859628f4a2aee2
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJBP:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2H
TLSH
T12AA633EA785F67ABC10E1C39CE0A8D6235BC5BF18B644C97EFC63DB60850D531722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
Size 9.2MB
SHA256 248f633c981a81af72caf49444347589894bedafeeba5255ff297c82bdf08525
MD5 ba9be8a6c017d5bdd4833ea21c6c64aa
SHA1 8df3847ee5d1ac7b41d9ecad1229a2237ef2b4fc
SHA512 08323975a32293ba17ab18be6060a286ad92f71651b8a3afb50b3bec02b79503e61685cafb5c9a1922c7c25cfc80fdb96ab0737b32f55f261143dddecb606146
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLS2jTJL:TDpbgBr/4QAMQMrEGRONY/4VLjlBLS2t
TLSH
T192A633EA785F6BABC10D1C7ACE068D6235BC5BF18B644C93FFC63DB60850D521722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download