bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
Size 9.2MB
Sample260905-tkzsgavwdv
SHA256 bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299
MD5 1a1445e5cbab66b7218aa8ae9b48e4a2
SHA1 872678204d113eef7b7fd47d1dc562227fa8a449
SHA512 5254d7f7e956d2455e5e35cb13ee264be30c20e4fb4de0530d1f6c63da469d0d347df1f39b8bb5ae322252a62d9c82605993200eb42e14ef45786d11d74c766e
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWQApwsN:TDpbgBr/4QAMQMrEGRHsww7Q8RuWQApZ
TLSH
T150A633E6784E6ABBC10D1CB98D16CD123A6C57B1C7548CA7FFD53EB60810C936B22D62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4520	RuntimeBroker32.exe

Executes dropped EXE 14 IoCs

pid	Process
4520	RuntimeBroker32.exe
2368	RuntimeBroker32.exe
4812	UpdateService.exe
2628	UpdateService.exe
5076	WindowsHost.exe
708	WindowsHost.exe
1856	WindowsInternal.exe
3056	WindowsInternal.exe
4264	DesktopWindowManager.exe
5248	DesktopWindowManager.exe
716	InputService.exe
5608	InputService.exe
1116	SecurityCore.exe
1968	SecurityCore.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\RuntimeBroker32.exe\""	bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UpdateService.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UpdateService.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UpdateService.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\WindowsHost.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\DesktopWindowManager.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\InputService.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	InputService.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
60	raw.githubusercontent.com
1	raw.githubusercontent.com
21	raw.githubusercontent.com
28	raw.githubusercontent.com
35	raw.githubusercontent.com

Detect suspicious telegram bot 7 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c540-21.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c541-86.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c545-121.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c541-155.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c548-191.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001a332-197.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001a333-222.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5852	bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
5852	bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
5852	bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
5852	bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
5852	bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
5852	bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
5852	bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
5852	bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
4520	RuntimeBroker32.exe
4520	RuntimeBroker32.exe
4520	RuntimeBroker32.exe
4520	RuntimeBroker32.exe
4520	RuntimeBroker32.exe
4520	RuntimeBroker32.exe
4520	RuntimeBroker32.exe
4520	RuntimeBroker32.exe
4520	RuntimeBroker32.exe
4520	RuntimeBroker32.exe
4812	UpdateService.exe
4812	UpdateService.exe
4812	UpdateService.exe
4812	UpdateService.exe
2628	UpdateService.exe
2628	UpdateService.exe
2628	UpdateService.exe
2628	UpdateService.exe
2628	UpdateService.exe
2628	UpdateService.exe
2628	UpdateService.exe
2628	UpdateService.exe
5076	WindowsHost.exe
5076	WindowsHost.exe
5076	WindowsHost.exe
5076	WindowsHost.exe
708	WindowsHost.exe
708	WindowsHost.exe
708	WindowsHost.exe
708	WindowsHost.exe
708	WindowsHost.exe
708	WindowsHost.exe
708	WindowsHost.exe
708	WindowsHost.exe
1856	WindowsInternal.exe
1856	WindowsInternal.exe
1856	WindowsInternal.exe
1856	WindowsInternal.exe
3056	WindowsInternal.exe
3056	WindowsInternal.exe
3056	WindowsInternal.exe
3056	WindowsInternal.exe
3056	WindowsInternal.exe
3056	WindowsInternal.exe
3056	WindowsInternal.exe
3056	WindowsInternal.exe
3056	WindowsInternal.exe
3056	WindowsInternal.exe
3056	WindowsInternal.exe
3056	WindowsInternal.exe
5248	DesktopWindowManager.exe
5248	DesktopWindowManager.exe
4264	DesktopWindowManager.exe
4264	DesktopWindowManager.exe
5248	DesktopWindowManager.exe
5248	DesktopWindowManager.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 2368	5852	bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe	91
PID 4520 wrote to memory of 4812	4520	RuntimeBroker32.exe	92
PID 2628 wrote to memory of 5076	2628	UpdateService.exe	96
PID 708 wrote to memory of 1856	708	WindowsHost.exe	99
PID 3056 wrote to memory of 4264	3056	WindowsInternal.exe	102
PID 5248 wrote to memory of 5608	5248	DesktopWindowManager.exe	107
PID 716 wrote to memory of 1968	716	InputService.exe	110

C:\Users\Admin\AppData\Local\Temp\bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe
"C:\Users\Admin\AppData\Local\Temp\bb40b2409a7d3b3facf51afa9da88dbb11b3d806fd2ea54ea82022fecb59b299.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  PID:2368

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4812

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5076

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:708
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1856

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4264

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5608

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:716
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1968

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 98b08bf802d3d70ca602982880b93dbb801c895753dba08530d7e48711c3b546
MD5 768e6de192ca683c67c5e614eeb9d0a1
SHA1 c5911d32089d885b4335e20c6f6c7f18fec9e551
SHA512 682b20036b82c777ccc6cce0280675b7a746a5f7193c6d4a5d014dbe2542b460498306b7165672fa33f19e11b9de5f53421c1e1615f86826c1326beeb0d6d4e1
TLSH
T10AE07D12676DC2C862538A248DF4A4B57CA9320F14974288592E77C109156BDD10F11B
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 60f59a399a0529e2ab79b05afc360652ee7a438e0a91c06b0182fc56a181958e
MD5 230459805282ab4afbe6d94f4daafc87
SHA1 f15fb0191b7e7f6cd35c1d6686847de8f8007577
SHA512 081f1adf167fdb2a176efada662fea0eba9e518f63dc14cbfed97de8d4185fa0c3e6e58a2c85b4a22c3fda184d6521226e586d2fc64e2afb144d4bbdeab98392
TLSH
T1AC41D7D96E68B425BFC48F45A978CF317E38F290899914A530FFC4A3B886B941C0EC5C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 282B
SHA256 08a447ef3dd66240110691dc7174d29d4713d55ba3d3dec4176a5d46ce38ef6a
MD5 38883942b39a34806ead8be5151db2c1
SHA1 d1463bff0fef81b3dd244e5e2c9097e8ef88a008
SHA512 f617f80fd886e3acce20d7dbb323d9064774dcc949bb8ee5a8bbcdddaf92e38a7edfb88100c7d79d2b0109714f2bbcea0f6bb0193775d5f4cae6941aa51eecac
TLSH
T131D02B1794F5C4A73912DD0019CDF93075135A7B13D8595A780DA9559D119785F0206C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 30f504672eae158fef37cea05717efaf81542874bb9df13e837cfaa5c1ac98f0
MD5 3fdaa97d3627ca74e0f5c805829d6940
SHA1 4f729b8e34548e910fa9d9176d3835cc65a6c0bb
SHA512 92b15425620781884540003fec93a1286d997c2b9500f0227a1681a5fe153df22991c952b255852b400705ee12bb0944e7668da661a52c70261190617d05240f
TLSH
T1EC1121821FB5E09085E656B4CAE8C1357C75748768EB74D12C9288932856B2DAB0643F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 2d9f7a2e50fc8a801cce90d9b95873706edc434e3e705fc229ed74e1cbed9e5a
MD5 f007012fb2b11ee401db679ec4f06e03
SHA1 e2e94e70d0756f8cd9bb007579d4f264ae85511c
SHA512 02837a220f81c9ff02aad0e416332af3ac78d819c99136b958ef43661a09b179c00425642cd05f05d6af910ea8c55fd92f30214aa70f74a8eed902454b95623a
TLSH
T10F41E9E72A4E3468FF428F996DB8C97A2D7C8564A1800C4278B7C4C714DA7A13A1785C
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 a8d96e64e4904762f55add0c61cc9241431a604add01f58b10217154bf50fb43
MD5 b1628c2e2c40e1f8bc7fa37c74de2fd7
SHA1 8222c8c36d656ba60d8922b20a0b88aae0dfe315
SHA512 7e902b184b741b0f9a8a05e6c13550237b37f8ff1d9c7dc3eda0ff7b7b1ff566b2c493cf65c42b17de4422ceabbe2a904cc8bcf8937c89893d3da372806721b8
TLSH
T1EEF05C2C17FC802CE132CEB9C6E5B265AD16F117240445EA0E934B0C9E02F012C5153D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 f3abe67486a5987239434342605123e103ed31919ec60da03d6bc9204d19252c
MD5 f6c579a91e910d3feca946d5e43bca4d
SHA1 f5dfeb7a9ca4ff522533b7427bbac0ea20792f8b
SHA512 4c9d54f22727cd9605e6874df427a06e5d26a450239f1afab2f0ed06c359199d31f452b712809296e161aab2134e0c692d0fc3428c34274fdc7b3b30ca1b25b7
TLSH
T10DF0682038FE403AF136AA3A47C133F1983AF20A38066BBA657103056F5BE216CD151A
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 4f905b945966c23d1d1897271293c365a07a6b0b7e77c217a3da777c08667236
MD5 2e2f07ffa257609f685207dbc0f715c2
SHA1 890a5373bc9217e02ec38786ba30c99582ebf5e2
SHA512 dc6194653fab6a5b7cfc4496cdae66c073d54bbd6432140a18ee5ca23ec1a8047b5146aca04ac8b45d38a08bcfcc88444146bd6a854980ebb47ac8f60e51799b
TLSH
T1BBF0A30415BC4019F0B2F978C2E527FAD935F125680A5AF60A9603095B12A011D1192E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 f5ff1c5ddbdebeffab1ac76fa059fc66e8a1d7f40f052f1964554835a2de8c66
MD5 10dfd9c0da09892e703d878ac90f2bd0
SHA1 16f1f3de0b5911d4ae1fea2108d3015d51d3fa53
SHA512 ff01c03f1cb28ec2daf3f62efeff28c7426ffa85f8431bddf80b722f356c59fd4c64705661ef4c0f0b47c6962b1de0ad2c41353a7f16fc151d60541180d8fe69
TLSH
T17CF055242AE240BEE632277485F4E399D91AB2563801CA6A16E60B0AFB0BE002D11439
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 de201239e625e8689e6ed01a1104134cbb808b1e9e9431c2f8a6ecd83cb32f58
MD5 64115d44d84f5ae0691966aa4a995cc5
SHA1 d983efa17eedd2fc4460b24b29297f5b1ee1842a
SHA512 fb183725a950f91d05576680e32448f78b50c91e8d5c45308780bb52ad87aaaab5a5a2e5f92af15343589eb9ee7adccf07174cdc7dd578345cfea5a213340b73
TLSH
T1E4F02B3839EB012FF235E6F802D123A68537F53E2604636D76A143495E57E81F9B0915
MD5 SHA1 SHA512 TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe
Size 9.8MB
SHA256 36182cc0b070b578ee2014d231cac19f6566870a3b2f6e9c2d7e8525537a1752
MD5 4fd2260dbedc4d6ec795448c7310409c
SHA1 775ab046ff350d5b3483aac894cabc2e40e4ca75
SHA512 f3ca4bb34ac7d7c328277b5b20b0af9cec26cce4d3ec8559b26511f68b4683a270700086cd6131ecd30c590187957e59e63e4c3c552c0be6f2cb748329c13cea
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWQApwsG:TDpbgBr/4QAMQMrEGRHsww7Q8RuWQApy
TLSH
T18DA633E6785E29BBC24D1CB98D56CD223A5C47B1C7548CA7FFD53EB60810C932B22D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\InputService.exe
Size 9.9MB
SHA256 751bce66f05378f90988ccdf35a334d3a67d9ec36450eba059410bc208e35f5e
MD5 b58cb59e97adc25ca0fa680e6d8962d1
SHA1 e56abd00e13b5c5f1227ea6c63c813a45514ead4
SHA512 5fa83226c9181498fe04961ae581904db2c3308fe17372e0c48b09e1cd51a2061b310e50c4db1a51ea12f77feed17b882fec06494646bdd9437d3dbd5d096eb7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWQApwsI:TDpbgBr/4QAMQMrEGRHsww7Q8RuWQAp8
TLSH
T1CDA633E6785E29B7C20D1CB98D56CD223A6C47B1C7549CE7FFD53EB60810C932A22D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
Size 9.6MB
SHA256 ae2a5f1fc88e06921eafccadf8914db258bc03ca0cf8c04148dae385566c5562
MD5 16a937122c2b850dd5b2ae30abb71451
SHA1 3ac357ee1c4407a7c8540d66263301e2e5e13cfc
SHA512 630798e80578fdf46ccf666deac761544c36c638abdfdb019077931654572d1626ba3de9a778a81059497c828fe5ee775e1c295165daade269fc5a6d016807c6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWQApws0:TDpbgBr/4QAMQMrEGRHsww7Q8RuWQApI
TLSH
T179A633E6784E69BBC20D1CB98D56CD223A5C47B1C7548CA7FFD53EB60810C936B22D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
Size 9.3MB
SHA256 f9a31ebeec558e16c86716acf9a8196c1fbc1886be766a3a61373dec6e74c266
MD5 8064b9f6aadead8cc5539af1a9bc4c74
SHA1 910ff5251a3ab9feef91225d1f01b8fdc8f51930
SHA512 0a363e287922fcff9b9235ae8383c19dafa8805fda9b320ff5f7755f1e3680d65f3ab522799d91f92661befd4c7f5c98626aa580712772ed10e5ba952aa0f863
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWQApwsd:TDpbgBr/4QAMQMrEGRHsww7Q8RuWQApx
TLSH
T129A633E6784E69BBC10D1CB98D16CD223A6C57B1C7548CA7FFD53EB60810C936B22D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 10.0MB
SHA256 ea8831ff5ae44863721bf77fbb08242ad5eab1fe273323aa11567864a9544555
MD5 44b523b2b8e6d880196efb55324bb6fb
SHA1 e397f050c130aa5971f3cb8b3d3f171fd83e3a0f
SHA512 be2f2578532e5e41d12bcb1e06bc2254033a9de3dc992252cd506ac71e44bf2c9c10eb84917de3f0f76bec008a400b96491e7d7c0029450f1b5ccf0cd1e5654d
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWQApws3:TDpbgBr/4QAMQMrEGRHsww7Q8RuWQApD
TLSH
T1BFB633E6784E29B7C20D1CB98D56CD223A6C47B1C7548CA7FFD53EB60810C936B22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
Size 9.5MB
SHA256 c52cfb647246aef5ed62d47dde4a614faa7c9c2d28e4d524834f69ccae5896fd
MD5 0a85864769edea0557f2efbf1618cf9c
SHA1 27c75a3d17fe30af1f8178411e5baa01d11b68f7
SHA512 890b8b2a2aaecfd8e4f9097b1aaf2cabcb4a9b7e033fc791370c563b0c07573a3d1abb442a6f0dcca34017f58aa78fd0fab305dfd6e1842408d5163352ddf8e4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWQApws5:TDpbgBr/4QAMQMrEGRHsww7Q8RuWQApF
TLSH
T127A633E6784E6ABBC10D1CB98D56CD223A5C47B1C7548CA7FFD53EB60810C936B22D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
Size 9.7MB
SHA256 b2cf7c7173eafeb9e2b218bc2a38154147c726ffec2e08f6133136a0f03b1264
MD5 23fbce99f2da3e199f84eff6d778cdde
SHA1 0b46e1a2818fc94ef9d1ec6aaf9d12ae559e45ec
SHA512 7845968a296fa255bb86addf722cde7f2e03f66a1888537b88fc5b7a8b97ad42430f1cd98c8cc6ef5a00281a07c17aecb046eba665e05bef20707091e66f0a32
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWQApws2:TDpbgBr/4QAMQMrEGRHsww7Q8RuWQApK
TLSH
T103A633E6784E69BBC20D1CB98D56CD223A5C57B1C7148CA7FFD53EB60810C932B22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download