79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
Size 10.9MB
Sample260903-s1ea2azfpc
SHA256 79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891
MD5 6224083de35cd09f64c3c0d223b3a52d
SHA1 195d466e5d63d4839442b5750f5debd7078585fd
SHA512 190f015070ebf63f82db87314042d9d2382480828257936562391eee04f662f30e2a0316e15480191d771713c80dd46df259fd909287acce8a7f009f806d0bf4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSWKCTF5:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWl
TLSH
T178B633EA745E6AABD10D1C79CE068D6235BC5BB19B648C97EFC23DB30C50C521723E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3096	DesktopWindowManager.exe

Executes dropped EXE 12 IoCs

pid	Process
364	DesktopWindowManager.exe
3096	DesktopWindowManager.exe
1284	CoreSystem.exe
2608	CoreSystem.exe
2820	DesktopWindowManager.exe
1036	DesktopWindowManager.exe
4556	WindowsHost.exe
4776	WindowsHost.exe
3432	WindowsHost.exe
3960	WindowsHost.exe
2596	UserSession.exe
3120	UserSession.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\UserSession.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\DesktopWindowManager.exe\""	79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\CoreSystem.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\DesktopWindowManager.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsHost.exe\""	DesktopWindowManager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
36	raw.githubusercontent.com
44	raw.githubusercontent.com
55	raw.githubusercontent.com

Detect suspicious telegram bot 6 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c53c-15.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c541-27.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016ad5-101.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af7-134.dat	suspicious_telegram_bot
behavioral2/files/0x005e00000001707d-140.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000000405-174.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4092	79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
4092	79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
4092	79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
4092	79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
4092	79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
4092	79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
4092	79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
4092	79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
3096	DesktopWindowManager.exe
3096	DesktopWindowManager.exe
3096	DesktopWindowManager.exe
3096	DesktopWindowManager.exe
3096	DesktopWindowManager.exe
3096	DesktopWindowManager.exe
3096	DesktopWindowManager.exe
3096	DesktopWindowManager.exe
3096	DesktopWindowManager.exe
3096	DesktopWindowManager.exe
364	DesktopWindowManager.exe
364	DesktopWindowManager.exe
364	DesktopWindowManager.exe
364	DesktopWindowManager.exe
364	DesktopWindowManager.exe
364	DesktopWindowManager.exe
364	DesktopWindowManager.exe
364	DesktopWindowManager.exe
2608	CoreSystem.exe
2608	CoreSystem.exe
2608	CoreSystem.exe
2608	CoreSystem.exe
2608	CoreSystem.exe
2608	CoreSystem.exe
2608	CoreSystem.exe
2608	CoreSystem.exe
2608	CoreSystem.exe
2608	CoreSystem.exe
2608	CoreSystem.exe
2608	CoreSystem.exe
1284	CoreSystem.exe
1284	CoreSystem.exe
1284	CoreSystem.exe
1284	CoreSystem.exe
1284	CoreSystem.exe
1284	CoreSystem.exe
1284	CoreSystem.exe
1284	CoreSystem.exe
1036	DesktopWindowManager.exe
1036	DesktopWindowManager.exe
1036	DesktopWindowManager.exe
1036	DesktopWindowManager.exe
2820	DesktopWindowManager.exe
2820	DesktopWindowManager.exe
2820	DesktopWindowManager.exe
2820	DesktopWindowManager.exe
2820	DesktopWindowManager.exe
2820	DesktopWindowManager.exe
2820	DesktopWindowManager.exe
2820	DesktopWindowManager.exe
4556	WindowsHost.exe
4556	WindowsHost.exe
4776	WindowsHost.exe
4776	WindowsHost.exe
4776	WindowsHost.exe
4776	WindowsHost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3096	4092	79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe	90
PID 364 wrote to memory of 2608	364	DesktopWindowManager.exe	94
PID 1284 wrote to memory of 1036	1284	CoreSystem.exe	97
PID 2820 wrote to memory of 4776	2820	DesktopWindowManager.exe	100
PID 4556 wrote to memory of 3960	4556	WindowsHost.exe	103
PID 3432 wrote to memory of 3120	3432	WindowsHost.exe	106

C:\Users\Admin\AppData\Local\Temp\79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe
"C:\Users\Admin\AppData\Local\Temp\79f1ad022a1081b25c153471b8d088c39c8a854684c1c21b00b032701557f891.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3096

C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Temp\\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2608

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1036

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4776

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3960

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3120

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 9354f053c1feadcc70558dd31bdebc8d187c9afe78d5bec7fde7cc60182874f2
MD5 d3381f883929ab0882059b522239a951
SHA1 c0027ff948d2d4221cda10092cd1ef9afd4221ac
SHA512 ed424302b64c8481815ebf8197e765cb84df0f63f2d0901239ac6853268bab167f55c2de390642b657620939b1079cdc2b607726368747ba887a0779e733454e
TLSH
T18D41D8E96B1C7415FFC08E805478CB366C3CF19499C4059A36FA88A2649AFE05D0A88C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 384f8ac0ed37496cf75a667ffd1b25487168ab4ebe9388704256e328e0a1e8cb
MD5 2b4679bc493669210784ec4d2667b719
SHA1 62edd8ac1a2e47a55cf52e4bfaed0d5c0483c9aa
SHA512 a5be2dd06ac8df02bbddb641b93f30680e2aa94944466b76afaef5b2a084b06fe3e52fa08bfe63601e276481b1a50d1f03a249c7d91ae79e3d5b8e092bb4ad2f
TLSH
T12DD0EB0601FBD19A2A37DC4480E0D0B0702215AA26E02826DC0EA1952E00CA9AD0258A
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 30f504672eae158fef37cea05717efaf81542874bb9df13e837cfaa5c1ac98f0
MD5 3fdaa97d3627ca74e0f5c805829d6940
SHA1 4f729b8e34548e910fa9d9176d3835cc65a6c0bb
SHA512 92b15425620781884540003fec93a1286d997c2b9500f0227a1681a5fe153df22991c952b255852b400705ee12bb0944e7668da661a52c70261190617d05240f
TLSH
T1EC1121821FB5E09085E656B4CAE8C1357C75748768EB74D12C9288932856B2DAB0643F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 8e3ab6c4e994e2dbd27cd4484b12d84e0ecd4b7ab0a19b72018397cfd376a577
MD5 a3e7a71332fc579538f2530564f2b06b
SHA1 4cecbc7b2ae1fa592d3d37bc5b43cf55f60055c0
SHA512 76bdb1ad0ee91d0591d50f4b56cebc8b28e0f132a840c0746a4b3966384bb037356349d20010860b904bff9a4e4df3cf3bd774ebd0ca52402d5cedfb8c1d042b
TLSH
T12541E9F70A5A78B4BF418F6A5EF9C93A1DBCD498A2840C86B477C4D2019B7911D4A48C
MD5 SHA1 SHA512 TLSH

Submit Download

ECD6FDADF7B82585744D7D2C692CBD2B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ECD6FDADF7B82585744D7D2C692CBD2B
Size 369B
SHA256 5239918300a929c78783f06389025fc8f8a7d8404f29d93edfedf92c1766ce21
MD5 7e66ef8ba3f05342684aaab1eb7314de
SHA1 2ccfd6c2c65458fee9b8a583ff11ae319d5ba9d7
SHA512 7e5747963fc367e0a59d80456af60a96b29a67149952d573272765e8b724941a7b07ad4c9591806370eebdc160df058585c28bcac6a9d587346654706c05b63b
TLSH
T161E060AB83307AC2C3E2CD028285DC471DB130FD0D8870222B5148878C63E9BEB4701B
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 431e9f8429378315dea89775f887a0ed05e8cb17902539858108c0d0ea0b07c6
MD5 f39e3d8acb14522ca865884a51d3500d
SHA1 817d7b9c50d68912fc66d8bb6df6d8c75e08f8e4
SHA512 f22c1eabaa75e0308d26bf18b2d9227a8a3b8c3cf8b69167a8ffda3a06cc69c12e5bde07639b69cb8f092889017b407b2ff1d202f89643b0cac4dfe386522d52
TLSH
T100C08C1C1EA20A06F2A8437C02C13A039B209282E241CF051BF12A48D996B166C38C3A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 8a11a87e02ec701a9863673ba37995bf0e7a3ece79d168305ef30266be9f614f
MD5 d08c6ea37d278d1f0ab8f59645930b98
SHA1 e05f7a684b2a40fe80ee0d37bbf0dbb6f082b4ce
SHA512 a71ef141c869a53e6607dbae7c6524a22a2a21cce8cd30ed859ee5e28038c245a546affd679753e56efcee93055774a346f086d77f1b031e7d25ea167a9223a0
TLSH
T132F0685C3EFEB17BF873DA7807C660320D35E219208923BA29F003046F14F607C41A05
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 2b7023123d0ac8851f77a3750ecdcc0e195fe454dd78319a8be29c9f099f749a
MD5 3e5cf2040f3346a6a915aadb1729000b
SHA1 5e8a670c0f11980c117e0e95a63c1fcdfa15851a
SHA512 f66e81798ba0a7ef4e862540de4737ff4835728fbc09a96edbb6da90466f8477f15735a66978bf2bfefb7c7886064308432427508cc5905cd8ae1e55ce30c51d
TLSH
T110F05C1818FC805EF0B3D839C3FA3176DC3AF045680541B903D712095E19F505D1552E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 4cba0e9ac5308ce6ede54ab2d60360cc28ac3281509c1833b5f8d2f44d3f121d
MD5 14a1271b99341b9f22baaa82ff816232
SHA1 40da641f629bcea2110c2c8ea9fafa4fc8130a03
SHA512 6fc642ae1a943178637fd34747a4741f998c184fd1caed8f896978dd79f299c3f1aba4e7d14154df8ad6e538365e6d716d5ee9f47d57debbaaf190b2148857e9
TLSH
T1F8F0AB282BE240BEF6312775C5F0D3EADC1AF2533801C97616E2060AFB0BE002D1183D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 39436a45441e950dd82f1530bf7e423c7420da7afea165efa862d515a4f24a5a
MD5 41d73a16e1f33cc044f5db4506d1fe2a
SHA1 23a7090ba52381c156847c9b572614f53f6249a3
SHA512 b16dbaeca206e6aa5147f266efa45cefc889956574fa6691cb4b3d8b26cd3f388a76dd952130fcedc7c23e72598220c3369da5083280d1de7ee06b594c4df9cf
TLSH
T173F0A33931EB002DF177C5FC03C652C58873E13331042BA9A6E2034C6D0AD407E60918
MD5 SHA1 SHA512 TLSH

Submit Download

ECD6FDADF7B82585744D7D2C692CBD2B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ECD6FDADF7B82585744D7D2C692CBD2B
Size 338B
SHA256 aaa92ae8f5777ecb1027b093c4ad642765e0af8c691111f00ab371acbdf5a9c0
MD5 d69b6e7aa947e5dd9164190ffae990cb
SHA1 6dc8b2c5a205c93cf6c7c0398178251d61ca30b3
SHA512 c41af989f609a01882b296228477fe3ec9f46fd5e0ca2b5e6cf6140bdffc1e29c58ba0a349cd9d072d393229d9b75bc467eb1631d184e4949103092a9346bdb7
TLSH
T1DDE0C20087FD5721F0A5637BA8B65151BE23790A7653D71D06A6240D0C22F012C2060F
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 8aebdc9753f4bf550f6fafbf794504880b73a56db4f4b5d8c549a913d005a83f
MD5 108f673d20a75f6a1f10cd0d83b4e9a0
SHA1 8bca772fce3303118f4e1db3c16e3fe98cb1f3de
SHA512 03c76daea9516a109ec5776443652e05b0ea8529649a5e3daef8df91df7eeab267b70f8b67010b042b9d856fae6e82580bb2311c7b2815bb9114a96f4e5b0a87
TLSH
T12FC08C1D06650606F2A893B902D229838A209211FB819F0126B12A0CCE25F122838C69
MD5 SHA1 SHA512 TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Temp\DesktopWindowManager.exe
Size 11.0MB
SHA256 2a48254b61b3b8a50ebb43f73d851b2185a68a5030317be5a76360efac7e1560
MD5 f2fb621546b5daa1bf9a683240cc5b92
SHA1 57b7d857bb8cc28dc895d61724ead1dff1e418b6
SHA512 ead428bc6c29c48d22da62668f5ffa56d5e609ce81b3432f6cb47c7c310eec71937a8dae5b635546ddda6e336daef7e6b16e40208288a33a7e57d4f76f257200
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSWKCTFip0:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSW3
TLSH
T195C633EE785E6AABD10D1C7ACE068D6135BC5BB19B244C97FFC23DB24850C521723E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
Size 11.3MB
SHA256 2ee756d9e895f66fc32fb88ab8eb203c4740ffa2d6f0f7a3c61998adf917c7ba
MD5 7d5b21ea055c34084aefd02746ec6341
SHA1 d491c7da3824a0f24706fb6c9f67cc187921411a
SHA512 b653333a7a7a8e12b1db66c839546e74778a9cfff219e285402e20d0344dcae0459f80e04fadd5ddbc91b631fe4dcabfe2402ef96519f73745d4bca6dd49471b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSWKCTFiptX:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWq
TLSH
T135C633EE785E6AABD10D1C79CE068D6235BC5BB09B644C97EFC23DB34850C521723E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
Size 11.6MB
SHA256 90245de3db494df00ae30162ee7119117a30e1d8c47b29e7d9ddb558a2d988f1
MD5 f0823eeb4b7186ca4906ed16d6134de3
SHA1 0725555b6029c9d7345d2b08cbc77ce899a87784
SHA512 2d031268dd831cb795b12cfb259d7d7b6206e4483493aa20adedf84d6716cfc9efcabd010f76e444dfc578b7f4105f0631872dfc86b81637ca842e9b558e8196
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSWKCTFiptlPpU:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWT
TLSH
T1FCC633EE785E6AABD10D1C79CE0A8D6135BC5BB09B644C97EFC23DB34850C521723E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\CoreSystem.exe
Size 11.1MB
SHA256 eeb3f675a0bea9ffbfb6c1404fdd55460fe3cf5040c411482e577720b6177aec
MD5 4d3b19aa376763644df30f813e2e18d6
SHA1 af10af3b5e567f2c66cd5fc4dbaee5da4901dd48
SHA512 98b050bc2e1b2c1bcee472188ef11cef9ebc9423c0d35431b9b6a887ff3ad4c9b2135052887498ea88128b5765df975636d77954a42ec071668ca02d121eac85
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSWKCTFiptn:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWG
TLSH
T101C633EE785E6ABBD10D1C7ACE068D6135BC5BB19B644C97EFC23DB20850C521723E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
Size 11.4MB
SHA256 e4f10fffe57229888b681bb0c09a673fa86d729a576461e72cb34e847a0c5e73
MD5 6f155dede8afac69b56d8daf23537877
SHA1 03e7f1c11ca643da2f49d1d8bbb04be25b5dda02
SHA512 39a58b109864ad726a8ba91cc1f1c5730e388a5de3a1ca20ce38a93acf64dfc508b8df9a5bc465b99e267afca6535a1e39eb578c08def1f7faeeafffc1c7b1c7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSWKCTFiptlx:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWE
TLSH
T136C633EA785E6AABD10D1C79CE0A8D6135FC5BB09B644C97EFC23DB34850C521723E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
Size 11.5MB
SHA256 247ff18ff86135f0f586fe01f0b3a241bdec53529b6d3425766cb9a88dca6f95
MD5 a05e1521df1ba83c16defd932d394d62
SHA1 cc6c82f39b06c668ba98d6438c6c9b8fe31d0575
SHA512 3021916f7f0d9885d0d3a4b597441ea159d6a77063e3b3efe926053c4ebab0baa4870b813127d0209215d32fad76f0d9ae175683f110c978c39e3effd957d7ad
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSWKCTFiptlI:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWj
TLSH
T135C633EE785E6AABD10D1C79CE0A8D6135BC5BB09B644C97EFC23DB34850C521723E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download