56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18

Analysis

max time kernel
147s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
Size 5.9MB
Sample260905-tk7hbavwex
SHA256 56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18
MD5 344f87924ac0f0d7437eba1075dff734
SHA1 f9a164f32394bd70f1f3e6429c15468366d1c033
SHA512 f964fdc3d5f501d4bfd4013257b5371f88845ad79095848971458ae1f7968ac751a543a381386e51f7ba8fdb5f8d498df272ac4b5a3dac2b3bc0fd5d3f6241f0
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0bc9h3zZMJe92Ei:+0s420bTjzGlBrJTJb8QAMQ/Zc41+f
TLSH
T1D85623D6B85E2ABBC20D2C798D168E6675AC4B71C7645C93FFD53EF24810D932732822
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2816	DesktopWindowManager.exe

Executes dropped EXE 13 IoCs

pid	Process
2816	DesktopWindowManager.exe
3172	DesktopWindowManager.exe
4344	WindowsShell.exe
5440	WindowsShell.exe
4272	WindowsHost.exe
4608	WindowsHost.exe
3956	DesktopWindowManager.exe
4192	DesktopWindowManager.exe
4872	RuntimeBroker32.exe
3176	RuntimeBroker32.exe
2696	WindowsInternal.exe
924	WindowsInternal.exe
244	UpdateService.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsShell.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsHost.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\DesktopWindowManager.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\RuntimeBroker32.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\WindowsInternal.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\UpdateService.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
18	raw.githubusercontent.com
28	raw.githubusercontent.com

Detect suspicious telegram bot 7 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c5d9-18.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5da-26.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5db-96.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5dc-130.dat	suspicious_telegram_bot
behavioral2/files/0x000500000001697e-165.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af5-198.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016af7-202.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3340	56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
3340	56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
3340	56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
3340	56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
3340	56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
3340	56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
3340	56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
3340	56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
2816	DesktopWindowManager.exe
2816	DesktopWindowManager.exe
2816	DesktopWindowManager.exe
2816	DesktopWindowManager.exe
2816	DesktopWindowManager.exe
2816	DesktopWindowManager.exe
2816	DesktopWindowManager.exe
2816	DesktopWindowManager.exe
2816	DesktopWindowManager.exe
2816	DesktopWindowManager.exe
4344	WindowsShell.exe
4344	WindowsShell.exe
4344	WindowsShell.exe
4344	WindowsShell.exe
4344	WindowsShell.exe
4344	WindowsShell.exe
4344	WindowsShell.exe
4344	WindowsShell.exe
4608	WindowsHost.exe
4608	WindowsHost.exe
4272	WindowsHost.exe
4272	WindowsHost.exe
4272	WindowsHost.exe
4272	WindowsHost.exe
4608	WindowsHost.exe
4608	WindowsHost.exe
4608	WindowsHost.exe
4608	WindowsHost.exe
4608	WindowsHost.exe
4608	WindowsHost.exe
3956	DesktopWindowManager.exe
3956	DesktopWindowManager.exe
3956	DesktopWindowManager.exe
3956	DesktopWindowManager.exe
3956	DesktopWindowManager.exe
3956	DesktopWindowManager.exe
3956	DesktopWindowManager.exe
3956	DesktopWindowManager.exe
3956	DesktopWindowManager.exe
3956	DesktopWindowManager.exe
3956	DesktopWindowManager.exe
3956	DesktopWindowManager.exe
4192	DesktopWindowManager.exe
4192	DesktopWindowManager.exe
4192	DesktopWindowManager.exe
4192	DesktopWindowManager.exe
4192	DesktopWindowManager.exe
4192	DesktopWindowManager.exe
4192	DesktopWindowManager.exe
4192	DesktopWindowManager.exe
4872	RuntimeBroker32.exe
4872	RuntimeBroker32.exe
4872	RuntimeBroker32.exe
4872	RuntimeBroker32.exe
3176	RuntimeBroker32.exe
3176	RuntimeBroker32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 3172	3340	56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe	92
PID 2816 wrote to memory of 5440	2816	DesktopWindowManager.exe	95
PID 4344 wrote to memory of 4272	4344	WindowsShell.exe	96
PID 4608 wrote to memory of 3956	4608	WindowsHost.exe	99
PID 4192 wrote to memory of 4872	4192	DesktopWindowManager.exe	102
PID 3176 wrote to memory of 924	3176	RuntimeBroker32.exe	107

C:\Users\Admin\AppData\Local\Temp\56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe
"C:\Users\Admin\AppData\Local\Temp\56683651aed75e3521c778243c942a3a8f73901a7f7fb35744808f15d2465e18.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3172

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5440

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4272

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3956

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4872

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Temp\\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:924

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2696
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe" --monitor
  2⤵
  PID:5668

C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\UpdateService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 98b08bf802d3d70ca602982880b93dbb801c895753dba08530d7e48711c3b546
MD5 768e6de192ca683c67c5e614eeb9d0a1
SHA1 c5911d32089d885b4335e20c6f6c7f18fec9e551
SHA512 682b20036b82c777ccc6cce0280675b7a746a5f7193c6d4a5d014dbe2542b460498306b7165672fa33f19e11b9de5f53421c1e1615f86826c1326beeb0d6d4e1
TLSH
T10AE07D12676DC2C862538A248DF4A4B57CA9320F14974288592E77C109156BDD10F11B
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 60f59a399a0529e2ab79b05afc360652ee7a438e0a91c06b0182fc56a181958e
MD5 230459805282ab4afbe6d94f4daafc87
SHA1 f15fb0191b7e7f6cd35c1d6686847de8f8007577
SHA512 081f1adf167fdb2a176efada662fea0eba9e518f63dc14cbfed97de8d4185fa0c3e6e58a2c85b4a22c3fda184d6521226e586d2fc64e2afb144d4bbdeab98392
TLSH
T1AC41D7D96E68B425BFC48F45A978CF317E38F290899914A530FFC4A3B886B941C0EC5C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 282B
SHA256 08a447ef3dd66240110691dc7174d29d4713d55ba3d3dec4176a5d46ce38ef6a
MD5 38883942b39a34806ead8be5151db2c1
SHA1 d1463bff0fef81b3dd244e5e2c9097e8ef88a008
SHA512 f617f80fd886e3acce20d7dbb323d9064774dcc949bb8ee5a8bbcdddaf92e38a7edfb88100c7d79d2b0109714f2bbcea0f6bb0193775d5f4cae6941aa51eecac
TLSH
T131D02B1794F5C4A73912DD0019CDF93075135A7B13D8595A780DA9559D119785F0206C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 30f504672eae158fef37cea05717efaf81542874bb9df13e837cfaa5c1ac98f0
MD5 3fdaa97d3627ca74e0f5c805829d6940
SHA1 4f729b8e34548e910fa9d9176d3835cc65a6c0bb
SHA512 92b15425620781884540003fec93a1286d997c2b9500f0227a1681a5fe153df22991c952b255852b400705ee12bb0944e7668da661a52c70261190617d05240f
TLSH
T1EC1121821FB5E09085E656B4CAE8C1357C75748768EB74D12C9288932856B2DAB0643F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 48a71ec1ad54675b6ff6b9bdbc936ae42a6d12ccfa358439377e9281dbfdc764
MD5 191501f5fdcda850c2151355051205e4
SHA1 3d7f5c222a4743b8bcb2aaa6a5a16bdde3359f44
SHA512 427ef21d475580b60e3410f962e4d6897dcee3c1d73e26249e048d20e5264e15f30c1ff7508e4195674cd04fe526277f9bfe569d5e1c1dfea2b272d3345ace98
TLSH
T14741C7E76A093474BE418F8A55F8C5311E3C82ACA1801981F47AC0D1009EB956C4E4CC
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 796d09251cbea4033a87c560be480347c2d3e1a0007a3b97b403905e55ee18fe
MD5 d15d547efd3c1569bde0ff4d2f4f3096
SHA1 9e330d508f2dddcbe5490d5f50e783f623530d8b
SHA512 990d248d546d84cfd3a3026853ed70b728c23c509a9222c697d6d044ac73bd9b62085d8259f0b1b66dc5b01ac736de9552aada9e4a61f7e9331657a25fb325ea
TLSH
T154F0EC2C17FC806CF172CEB9C6E5B265ED16F117640445EA1F924B4D5E06F011C5153D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 dc268e06cfda6d3df361f08cfc7d783176e7cd3e7b58f47a804cd425ebdfcf09
MD5 765c07870b15c1d2c9fb38e9aa06e20f
SHA1 b51b55042300829a974db0d3c4047652bc5f69ed
SHA512 4e596bde4c15da21b0ed82bd3576db798de21dd88f13dc0445c7cbbbd5fb539f3aeba25b59c7069a258c0b09219f093224acbb2d6f279df053a16dc72f5b1521
TLSH
T1AEF0682038FF903AF133AA3A4BC173F19836F20A78065BBA693103056F5AE212C9151E
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 422a4195cf2124b5e764c25a9d3ff40e1fd8722fe702dbffa4f4d94b5b44846e
MD5 4f1430feded898ec6580f636a4e71c2a
SHA1 d29a0b3999919ace250ce6aa9222e43128389877
SHA512 bb45de44e604ba5995496c981aee037295ae623846c5b973e0c7ed8c2e97cbb02ee4d1b9bdf55674156aea746ecc2ec6e5bf5dbc00229ac229f2191a0b6df23c
TLSH
T128F0A30415BC4019F0B2F9B8C2E527FAD935F115680A5AF60AD613085B12A020D11D2E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 f01dfef0424321f8dbca1345aa35d1d912da4de2dfc56afa3c09eca6c454f672
MD5 748f1eeae7de8f708837e59395d89d9f
SHA1 e87b5c7bd1f639c792c7e764a0cfe61988e69b77
SHA512 5900cf83c33ccd44cf6f09c3f266d25f03cd36308186d5c27279afef58eee83ababc255bf3d0d24dbb54084b943c83f12b3e73b0ab09beaf4aece1638b074919
TLSH
T11AF055242AE240BEE632277585F4D399D90AB2563801DA6616E60A0AFB0BE002D11439
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 85af2028b9fc384fb795adf591f208f06b24f79b7fd920b09472904588a99f3d
MD5 01a059ce07831a33069a2fc223754e13
SHA1 01c4adce35c5f440ed22795e41240e80b4965408
SHA512 841346bf0a473cba929772b4b5c6565392612fd512a341a95502869cec5f61a049faa9ecfda636421e4cfe5ba1c4e15f9250a652afa99460b3225a981be35cdc
TLSH
T1F8F02B3D25EB065FF233D6BD07C0D7D58622E13B31492F69ABB1520D6E59A01BEB0D22
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsInternal.exe
Size 6.6MB
SHA256 4308ae7af15b6f70d3fe22b2d77714a4040838b21c49214ba1b2d1844b36935c
MD5 24a01791c83429b66fec5734c61fa0a4
SHA1 7403545563c77f8c51220b8d508b93450069668a
SHA512 8d65928d1fac8e8429a600f7ed52bfc4743fd96b9b8e5d02c4031cd04f2de43844377be96f18ab2945b54e29be0b0ed15ccb5b27b3fd145eaf71aa80698f456c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/Zc41+3OVPX:TDpbgBr/4QAMQ/ZjaOVPX
TLSH
T1A56633D6B85E2AABC24D6C7E8C168E26719C4B71C7645CA3FFD13EF34411D932622C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
Size 6.1MB
SHA256 27747406d494d1bcb8b3d2a051eee39ac68efc5d509430edd84ef18f527f3b08
MD5 b764cc185613690be294cdd1d9d40ec2
SHA1 60d64df0789220b5ac08b0a5f4373eac4e692935
SHA512 4f56804930a6a52a2f21e16389039fea84f964216f43297ba7e15e1b1d6372ba79d7ffd870c8792962f2b3112620a78af493cc2860fa056cb897734ea1e69439
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0bc9h3zZMJe92EE+5Ri:+0s420bTjzGlBrJTJb8QAMQ/Zc41+3Oi
TLSH
T1805623D6B85E2AABC20D6C7A8D168E2675AC4B71C7645C93FFD53EF34810D931632C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
Size 6.7MB
SHA256 5df02c3461b98b62924954e494f6ec7802e476e3b73e93d7f0bb8893cf43af69
MD5 71e0d5fd2d80051fa32a3137e02e4fa4
SHA1 8db9876d92ded4bfdef3df1804f23908dee3607a
SHA512 940d9515e35bd052e34736cdb7e61cb4dbad7756c474f18c7d6406d8609a025f97bd982dd709de67328f2dd6b802ba68f0825977009ed2d8e9b3f8d54077ea1e
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/Zc41+3OVPN:TDpbgBr/4QAMQ/ZjaOVPN
TLSH
T10E6633D5B85E2AABC24D6C7E8C168E26759C4B71C7645CA3FFD13EF34810D932622C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
Size 6.5MB
SHA256 daff83794ee89cbb4a6f4b47f84caf3b2de941cd9eca79fe125eb887ebfac424
MD5 7bc479dae1abf01884ad1ea19d851976
SHA1 bf581a3304ee240d24abeff97542923ac1a12b52
SHA512 03fe0dd42b169096702aadbf257376d8ce023e8aa8e55a48c9a48db9bf4095825343b9545f177b7af8fdc7b07d8971f85dc65a42df97b50588f0224e41627b9b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/Zc41+3OVPc:TDpbgBr/4QAMQ/ZjaOVPc
TLSH
T1466633D6B85E2AABC24D6C7A8C168E6671AC4B71C7645C93FFD13EF70410D932632C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
Size 6.4MB
SHA256 12a4a782504a3cd69e24e035648eb68e5d14729babc02a61f358b5802a2e72ea
MD5 3d6da1c9687d5d5cf3bb713aa8350e4e
SHA1 9d349f245e6469a15b673f9e149845169ef549c0
SHA512 4b5fc721798d01eec419df45614bdd4f382f37aafb73349ed4af6646d453ec5352bf95ccc39c76b28ab717ccd2bc2389bb2fde3685a24bb5f34125cc6cd05c48
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/Zc41+3OVPV:TDpbgBr/4QAMQ/ZjaOVPV
TLSH
T1506633D6B85E2AABC24D6C7D8C168E2675AC4B71C7645C93FFD13EF70810D932622C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
Size 6.3MB
SHA256 4afc6f88dcc131ba17a589f91178fa1dc8d1a651e1f91f436f02e9734423521f
MD5 0c9cdc7f91024d50b77d2f898f974acc
SHA1 9b694e06b859d2a7f87ea518fa306e59f6129135
SHA512 09b22ee18bfdf83fbad921cbc3ab8ed8d1c338afd393214300663606615d26495961daab52939fa36364f9043f01d56cc2e4bdc66bbe07b47323552b050d51e5
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/Zc41+3OV0:TDpbgBr/4QAMQ/ZjaOV0
TLSH
T1176633D6B85E2AABC24D6C7A8D168E26759C4B71C7645C93FFD13EF70810D932632C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 6.0MB
SHA256 e8f1cd971edb2d31516cd8420b5c1f6a11bede359a7be4b95f2cb4c8d1358bfc
MD5 af85c6223458febc93d42cfb3241575e
SHA1 49420c43dc3e34945eae04efbfebe0fb5cf803ac
SHA512 c90957710ba9b0348dec47bb1e0966f108c020b149e7be6035ae97d7d7e0dd2fed77f81d68c8883fb4fb26747856fc8b1373dbd69b114cee89db42a5e73e829a
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0bc9h3zZMJe92EE+n:+0s420bTjzGlBrJTJb8QAMQ/Zc41+38
TLSH
T1EF5623D5B85E2ABBC20D2C7A8D168E6675AC4B71C7645C93FFD53EF34810D932632822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download