ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
Size 8.8MB
Sample260907-xd6h8aep2s
SHA256 ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675
MD5 29702892c3433cd34e9865f49118528b
SHA1 5c0b485b074f593d4fae334c4c04a609c1297694
SHA512 58480e6590947bcf94ccc8f8d964966e216caad95316ffef88bc9eea2406f83f3ef868cf670cf37305ed5b877953a41a576ee3f3102c47873b1676bb620da3fa
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485DAzGkWGdApSJ:TDpbgBr/4QAMQMrEGRONY/4VLMDWGpSJ
TLSH
T1219633EA785E2AABD10E1C79CE06CD6635BC1BB2C7248C97FFC57DE60811C531622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2688	DesktopWindowManager.exe

Executes dropped EXE 14 IoCs

pid	Process
2688	DesktopWindowManager.exe
4060	DesktopWindowManager.exe
2772	BackgroundTask.exe
2072	BackgroundTask.exe
2416	UpdateService.exe
2532	UpdateService.exe
3128	BackgroundTask.exe
6064	BackgroundTask.exe
1320	WindowsHost.exe
5816	WindowsHost.exe
2876	ServiceHost.exe
5236	ServiceHost.exe
4896	UserSession.exe
2960	UserSession.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\ServiceHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\UserSession.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\BackgroundTask.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UpdateService.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\BackgroundTask.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsHost.exe\""	BackgroundTask.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
46	raw.githubusercontent.com

Detect suspicious telegram bot 7 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c60a-12.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c60b-77.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c60e-115.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016ae3-156.dat	suspicious_telegram_bot
behavioral2/files/0x0006000000018846-193.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001a506-229.dat	suspicious_telegram_bot
behavioral2/files/0x0007000000018846-262.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4196	ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
4196	ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
4196	ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
4196	ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
4196	ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
4196	ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
4196	ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
4196	ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
2688	DesktopWindowManager.exe
2688	DesktopWindowManager.exe
2688	DesktopWindowManager.exe
2688	DesktopWindowManager.exe
2688	DesktopWindowManager.exe
2688	DesktopWindowManager.exe
2688	DesktopWindowManager.exe
2688	DesktopWindowManager.exe
2688	DesktopWindowManager.exe
2688	DesktopWindowManager.exe
2772	BackgroundTask.exe
2772	BackgroundTask.exe
2772	BackgroundTask.exe
2772	BackgroundTask.exe
2072	BackgroundTask.exe
2072	BackgroundTask.exe
2072	BackgroundTask.exe
2072	BackgroundTask.exe
2072	BackgroundTask.exe
2072	BackgroundTask.exe
2072	BackgroundTask.exe
2072	BackgroundTask.exe
2072	BackgroundTask.exe
2072	BackgroundTask.exe
2072	BackgroundTask.exe
2072	BackgroundTask.exe
2416	UpdateService.exe
2416	UpdateService.exe
2416	UpdateService.exe
2416	UpdateService.exe
2532	UpdateService.exe
2532	UpdateService.exe
2532	UpdateService.exe
2532	UpdateService.exe
2532	UpdateService.exe
2532	UpdateService.exe
2532	UpdateService.exe
2532	UpdateService.exe
3128	BackgroundTask.exe
3128	BackgroundTask.exe
6064	BackgroundTask.exe
6064	BackgroundTask.exe
6064	BackgroundTask.exe
6064	BackgroundTask.exe
6064	BackgroundTask.exe
6064	BackgroundTask.exe
6064	BackgroundTask.exe
6064	BackgroundTask.exe
1320	WindowsHost.exe
1320	WindowsHost.exe
1320	WindowsHost.exe
1320	WindowsHost.exe
5816	WindowsHost.exe
5816	WindowsHost.exe
5816	WindowsHost.exe
5816	WindowsHost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4060	4196	ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe	91
PID 2688 wrote to memory of 2772	2688	DesktopWindowManager.exe	93
PID 2072 wrote to memory of 2416	2072	BackgroundTask.exe	96
PID 2532 wrote to memory of 3128	2532	UpdateService.exe	99
PID 6064 wrote to memory of 1320	6064	BackgroundTask.exe	102
PID 5816 wrote to memory of 2876	5816	WindowsHost.exe	105
PID 5236 wrote to memory of 2960	5236	ServiceHost.exe	110

C:\Users\Admin\AppData\Local\Temp\ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe
"C:\Users\Admin\AppData\Local\Temp\ddb4b6c821ceee1ba83aaefba8454de4038856f9910752665295f1f8e82a9675.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4060

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2772

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2416

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3128

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1320

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2876

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2960

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 da2d91573b168c43759a32c155aaa1a9ec6404d49a825507c96782a830aee6dc
MD5 bdfeb16c4c7563a00184c000aedc7067
SHA1 f56dff9d6ea14b0a7db8de01a2b721be74bb1dc1
SHA512 cb9c241209052c51bbf9fe171620d4fa1e72608c6ed2a5531d0ee6c4b3f67bcbee401ee2802b69dd4559915aaa1d97c13abd8373c69e65b1d8c9322574d23196
TLSH
T1D141A5DA7B2C34B5BFC18E448D38C6366E78F2D4D991645624FBC4A36446B812C5A44C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 282B
SHA256 08a447ef3dd66240110691dc7174d29d4713d55ba3d3dec4176a5d46ce38ef6a
MD5 38883942b39a34806ead8be5151db2c1
SHA1 d1463bff0fef81b3dd244e5e2c9097e8ef88a008
SHA512 f617f80fd886e3acce20d7dbb323d9064774dcc949bb8ee5a8bbcdddaf92e38a7edfb88100c7d79d2b0109714f2bbcea0f6bb0193775d5f4cae6941aa51eecac
TLSH
T131D02B1794F5C4A73912DD0019CDF93075135A7B13D8595A780DA9559D119785F0206C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 979B
SHA256 40733033c1cbb77c1f524ca34fc162fca7d358f2c2b897d3f8d826ea83c7be58
MD5 468e77b14ab7a8d9c2d6285dc4d270cf
SHA1 464109a45a30bc42bc87cc8b7927378a70f59998
SHA512 03d87cedff009e0a55adbd00e3f96360578130e7caf75a9cf4623c30a277c58d8409c5fa3244cd9c3b76617e829e7902761055ab965b89d694e362bdb786a7c0
TLSH
T1061121C36EF8A18499F39760CAE8C6313CB9608669FA30D11C9198D3205B72C6F1803F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 2f30f612ebe6b5ddf73587f48b3c435fdaf7966644ea9d009a3753063f561e96
MD5 48b31f0c525313935e61c498ebb8e48d
SHA1 b63964b7e3b0f40d541dfb7e88a000495b250ed9
SHA512 6f9bd3256a7e49fbd77cd67019b83026718d9716dad0433457ba756ea3178e621398219a92e9fb2ac685733ce8a5a63d5fca8c1adcda407d599669886be88a21
TLSH
T1D641C9EB1B4D7DA4AF418F8998F4C9362E38D4A991C018827476C4D3249E7852D07C5C
MD5 SHA1 SHA512 TLSH

Submit Download

ECD6FDADF7B82585744D7D2C692CBD2B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ECD6FDADF7B82585744D7D2C692CBD2B
Size 368B
SHA256 5274e14b79ddd7e6d89fa6faa01cd7eb1841ff26f61266db27050a0012ba8932
MD5 bed4ebce44c84f4f60947688bd5177e1
SHA1 4b269ba76501f6419fd5e63a4681d78dd1d36ecb
SHA512 4ca07f625a847bc71c9a15c9536a4b7c1da46796bd6b87845e37dc16d4fc60939c65ef4ac222ac6b7cfb5bd80d06d2cce6c4a4c78426faee4cd7b0583edc3aed
TLSH
T17FE0CA57561469C39061C95783E4DC131DB060CD4DDC74587D7145C2D4639F5FF0145F
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 e8afd16d6736b8e4857c3e620a464df3bec5dbaf79cbf61fa94e844bcae3138b
MD5 01a71a2fed1d620d9fd6a2e1e5a29a68
SHA1 9707a6596b92f1409a276dcba0aeedf28a8140b3
SHA512 367ee20add03477f2ce61d0b9b6e8aa1127a56a0b294cf262bbb01df583f4ca593201198ddc11afbd0fbd31fe17f3db4f202718ee9ed815e898f84f4f2b8e824
TLSH
T1BDF068A839FE623AF0379D7953C931F04579E219340512B92AF81308AF00F216C4352D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 368b75f7e150cde3d27cc55b716012632e92fe72915b9243e064a6e95a38a1ab
MD5 13e70039f44a37fb514fa4ef25958035
SHA1 338b00adff670f3589db5dc2b06223d562401426
SHA512 21191b6e53fff88a743277073f52bfebc6f6ac052e250ae0f758b31b7d9718919151b6458226e0e6b02dd62dd195b92979b8148f85cfd85d0f80a8551a212254
TLSH
T12CF0A30415BC401DF0B2F9B8C2E627FAD935F115680D5AF60E9503045B12A410D1192F
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 167089bcaec7d8360ce9dd666285067a2074d74ad013dc5d7c30fadbb5dfe730
MD5 ebe361c4bd48b444a7034ccbe76674db
SHA1 4622a66b4212567236cbefd447b6d766de3d7d20
SHA512 46d856e54951ca79f39ec3609cae3f178376e96e37ce10a8727e7a764fe56f1ae96b87dec5be0861f7e62c2763262a078a73d5ef291515a479ee3123ff11f566
TLSH
T10AF05C341A92407EE2316A7A4AE4E7EB8C0DA3123808C86735D1170EF607E421D91439
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 330eb5577c0da380973562496a009b1c2a76ca112479097e78b8534dffa1518d
MD5 318466a8149edc2e50585a08c88d35d6
SHA1 599b740cd8d356d0be8227125e56af4985e626b6
SHA512 622beed0da8aafd7899150af519ae275664416bb181b441682810e775d8deb22f0ca8b01ae381a0f82d225e5a16a678d28534f5cb0de770bd588f39fa47c1167
TLSH
T178F02B2435F7046EF151E6BC42D11AD786B7F2373144367E6A714305AD06E40A9A1965
MD5 SHA1 SHA512 TLSH

Submit Download

ECD6FDADF7B82585744D7D2C692CBD2B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ECD6FDADF7B82585744D7D2C692CBD2B
Size 338B
SHA256 04def42cc619e903cf598d4890ede30b42bf076f3cb6049a3ce439787250548e
MD5 67a2dbc6d4ecf912c2671eacdd9e2c5f
SHA1 830a19555e8dd5ccd7b90d44968ee711b730ad5b
SHA512 26cf7694bac3aaf1611a67eddbd18ac0b6b662949ad69fca83b09733f94e5d496669cb92e29a08d867f8abeb031a44411d1e4ec172969808699e354a09213bd9
TLSH
T1FEE0C2205BE80317F1D6033F9C712551BEB7B819B642D31D4662094E0C14F012CA162B
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
Size 9.5MB
SHA256 711ca71dbe9d76dd30c3f99de5ad10081c5ffea99a42ac956c5917cd6fe9e4fc
MD5 438095f5944217c5401b8927d43d2823
SHA1 f306518fabef2409c5ae35532cb72daf8effe672
SHA512 6325a86783c7aae933bf816475000c6dc22f647bf9debef97df03cb5895185358e87e42d9518a890e36b8e6afc34e2b66a0ef84bcd72a18be96f52a20a01de99
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485DAzGkWGdApS8a:TDpbgBr/4QAMQMrEGRONY/4VLMDWGpSr
TLSH
T15AA633EA786E1AABD10E1C79CE068D6635BC1BB2C7648CD7FFD52DB60811C431722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe
Size 9.0MB
SHA256 8c58047c790b8f8c4a94458958a124c167cb27788efdf93283243f0f9c5944ee
MD5 fcbcd716876c72255f0b7d85b1523929
SHA1 1d1d590abf39a2004ff3ad9502be16bfbcc2e7e8
SHA512 e60b595d1e4c0d2ec1c4e385c0ce4f1e5d0ad45907453201a4fe14baf766334216f114bdb15032299155c213e5887f799dd15728cd43838eef6d587d276616c6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485DAzGkWGdApS8S:TDpbgBr/4QAMQMrEGRONY/4VLMDWGpSj
TLSH
T1C29633EA786E1AABD10E1C798E06CD6675BC1BB2C7248C97FFC53DE60811C531722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
Size 9.4MB
SHA256 7662720e06960cbafffca5fb7792b145268b8593b6ada5a60ddf9b282e7a1207
MD5 5b117011a6d18bff6dcb6a10270b1b12
SHA1 477c0434658585f2badb8ab239080c579b0451bc
SHA512 161b0cdb6e9a1302ef613fd0b66d787df23fd1bac97d62f91c5287f94568709268e624222393d664babf46394432dcd6a3f8c875eb54c584585be6d4639cd87a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485DAzGkWGdApS81:TDpbgBr/4QAMQMrEGRONY/4VLMDWGpSg
TLSH
T196A633EA786E1AABD10E1C79CE06CD6235BC1BB2C7249CD7FFD52DB60811C531722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
Size 9.2MB
SHA256 b5059ed09deca07a35768ba2b8ae64ff25cef623da555f2995475a4389fc5b14
MD5 6df1525ebd82c42f1b81b4e4631592e4
SHA1 a2d3ba5a402430bd3ac1a277b8d02bb1c10946e6
SHA512 d18d7b37a1a09a14271dd149047cbc505b0d498470fabcc8fa9d70846b8dddb3de10d8a317ade17070389074589fe47a22c7dd8a839d1fee83c6fb5c16504b55
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485DAzGkWGdApS8F:TDpbgBr/4QAMQMrEGRONY/4VLMDWGpS4
TLSH
T183A633EA786E1AABD10E1C79CE06CD6235BC5BB2C7249CD7FFC53DA60811C531722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
Size 9.6MB
SHA256 dd1568de9a81107496a9bf5584c38ac453332c99d539a69db05e8ed36490b75c
MD5 728c10cc39c0c420c11f8475304929ca
SHA1 5cb2a5e3defe78ea87de59942dbf932adf8123ed
SHA512 6c33784b295062f0ca9805e48c1726b87224964e4af637717319a99b1905a1759bb696ed5d6adf563bb792aeae78a0296e1ed111a0c51e80687fd751ea7826e6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485DAzGkWGdApS8O:TDpbgBr/4QAMQMrEGRONY/4VLMDWGpS1
TLSH
T1D9A633EA786E1AABD10E1C79CE068D6635BC1BB2C7648CD7FFD53DA60811C431722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
Size 9.1MB
SHA256 f6c7747fc769be6f3405c594211eea5e61151610d34bffc4ffe7bf762f0a40f9
MD5 fc5a7963d4ff60d035d4a25de05fcf2c
SHA1 0853fc056775d7f8294b5d150c4b0412bb803e97
SHA512 7b6673c280768d39a8975895dd7849b63bb2cc682fd235309ed206de5802eb9998b7de3ac08efea37e6e3538be9e5c3343ec6755a59b069ae556970754785454
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485DAzGkWGdApS8l:TDpbgBr/4QAMQMrEGRONY/4VLMDWGpSs
TLSH
T1BAA633EA786E1AABD10E1C79CE06CD6235BC5BB2C7249CD7FFC53DA60811C531722926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 8.9MB
SHA256 ed530b529a80393c3cf2b16a21f12492984e922ba5c2e787d197a77434b611d2
MD5 e8b60b8ae41df4a02a5bb6bc442680e7
SHA1 878e6d4d1457516aebd45227f72132fc8f8c3657
SHA512 d507e94ee7934dc8620c3b08fc2920270055f45df1f017526d6de5bb5ccc394f8c11c153196a762071b634a52110feb9437defa9a012ff1dc31a8a5a2dd065d9
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485DAzGkWGdApS2:TDpbgBr/4QAMQMrEGRONY/4VLMDWGpS2
TLSH
T1FE9633EA785E2AABD10E1C79CE068D6675BC5BB2C7248C97FFC53DE60811C431722D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download