8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
Size 1.9MB
Sample260910-al3e7ssfrc
SHA256 8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2
MD5 05b3db67ecdce8da942db0cd89a48543
SHA1 566e592e8e387e2a9f94baf868e4b6dc9055ff88
SHA512 6f364f31c7b839454843fcac07281015bebb064c5ffebf58898701bf0506334bba224e237dca137a9a05784fc12b995e604766fc88ec007e492166ed1bc02175
SSDEEP 49152:+eWUGHITpj2h0VZrG+G61LwCQCggzGxYsm9kjwF:+ebGH420Z1T19p5zGl2
TLSH
T1CD9502D5785E7AABC00A1CBA8D16CE2635AC5BB1C7604C93FFD53EBA0950D931723932
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	DesktopWindowManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	BackgroundTask.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	SystemTrayHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	ServiceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	ServiceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe

Deletes itself 1 IoCs

pid	Process
4244	DesktopWindowManager.exe

Executes dropped EXE 12 IoCs

pid	Process
1620	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
864	BackgroundTask.exe
744	BackgroundTask.exe
556	SystemTrayHelper.exe
3504	SystemTrayHelper.exe
904	ServiceHost.exe
3664	ServiceHost.exe
4344	ServiceHost.exe
2756	ServiceHost.exe
752	RuntimeBroker32.exe
3252	RuntimeBroker32.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\BackgroundTask.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\SystemTrayHelper.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\ServiceHost.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\RuntimeBroker32.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
17	raw.githubusercontent.com
99	raw.githubusercontent.com

Detect suspicious telegram bot 6 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x00070000000245f6-21.dat	suspicious_telegram_bot
behavioral1/files/0x00070000000245fb-88.dat	suspicious_telegram_bot
behavioral1/files/0x0004000000000727-129.dat	suspicious_telegram_bot
behavioral1/files/0x000400000000072d-165.dat	suspicious_telegram_bot
behavioral1/files/0x00030000000006d1-200.dat	suspicious_telegram_bot
behavioral1/files/0x00040000000006ff-230.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	BackgroundTask.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SystemTrayHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	DesktopWindowManager.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1568	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
1568	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
1568	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
1568	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
1568	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
1568	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
1568	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
1568	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
1620	DesktopWindowManager.exe
1620	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
4244	DesktopWindowManager.exe
744	BackgroundTask.exe
744	BackgroundTask.exe
864	BackgroundTask.exe
864	BackgroundTask.exe
864	BackgroundTask.exe
864	BackgroundTask.exe
864	BackgroundTask.exe
864	BackgroundTask.exe
864	BackgroundTask.exe
864	BackgroundTask.exe
864	BackgroundTask.exe
864	BackgroundTask.exe
864	BackgroundTask.exe
864	BackgroundTask.exe
744	BackgroundTask.exe
744	BackgroundTask.exe
744	BackgroundTask.exe
744	BackgroundTask.exe
744	BackgroundTask.exe
744	BackgroundTask.exe
556	SystemTrayHelper.exe
556	SystemTrayHelper.exe
556	SystemTrayHelper.exe
556	SystemTrayHelper.exe
3504	SystemTrayHelper.exe
3504	SystemTrayHelper.exe
3504	SystemTrayHelper.exe
3504	SystemTrayHelper.exe
3504	SystemTrayHelper.exe
3504	SystemTrayHelper.exe
3504	SystemTrayHelper.exe
3504	SystemTrayHelper.exe
3664	ServiceHost.exe
3664	ServiceHost.exe
3664	ServiceHost.exe
3664	ServiceHost.exe
3664	ServiceHost.exe
3664	ServiceHost.exe
3664	ServiceHost.exe
3664	ServiceHost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1620	1568	8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe	85
PID 4244 wrote to memory of 864	4244	DesktopWindowManager.exe	90
PID 744 wrote to memory of 556	744	BackgroundTask.exe	101
PID 3504 wrote to memory of 904	3504	SystemTrayHelper.exe	104
PID 3664 wrote to memory of 4344	3664	ServiceHost.exe	107
PID 2756 wrote to memory of 3252	2756	ServiceHost.exe	112

C:\Users\Admin\AppData\Local\Temp\8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe
"C:\Users\Admin\AppData\Local\Temp\8d5f6f0be9100b4bd6bf0f534a11a121aa41c685e25866d4c84b20564c8c89c2.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1620

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:864

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:556

C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SystemTrayHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:904

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4344

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3252

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Temp\\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 6ac45142693bd1c458512e3b8def1881e3fe3a81b85425044c0f460d67eac362
MD5 c10ea189c98d33ce0e871d19b27d2ee8
SHA1 b8e07c52568b0b8ac43d24df87ce133dedc95e96
SHA512 fa95426053eb82e9c3468f3bdf385197b306b22556ae80e4d255de3a1b6c7ded2b605a67dbac0f9295cd922e395aa2e0e0401d4057b15eaa1d26aec4d3524e3e
TLSH
T1B4E07D0E572CC3C3BD164C1026E5857A3AF270AF44D2150E643517C9CD42137C847049
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 abfaa383387b94cb47972294a6ad04c5972c1cf14d442b3d690d1bfee70d0236
MD5 abaf1327c08dcda4c923beb93d0e490c
SHA1 019b69404eb5f4b55254e6eb31f66b4be36ed78f
SHA512 f45ab94e40c5d8bcce0aa115b5dbca2816996583ab3249106dbbfb7bf37db00eccb04a17190c05b2da8790978833d896eded1d6b39895eaf90f06d863ea302ff
TLSH
T1CF41D8EA7E1D7064FF498F851874CA393E38BAD05585005DB0FE84B2349D7D16D1981C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 0e88a5f0db492c6d183a9c530238a34b60ddf8e643d59bb067a8bed73f3b04d7
MD5 ca45821f82f18cbccb347fd3d2edbdd0
SHA1 3c0bbcc22bc271a84cee8414221d42d021d221e3
SHA512 85a9f6c20f07e9bb0ba9aeaad0ed6dde142cc456dd82f56db61ea2b8b1f6ac821d6921fd59aef0530ac8cb3ac1ce2ba85a4108c3780fc861e81c4090bd7a1425
TLSH
T13ED0951715F6C9553B53DD044DD0D170B423AEB773D36C1AA48FD0D65800D2D3F0A215
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 979B
SHA256 40733033c1cbb77c1f524ca34fc162fca7d358f2c2b897d3f8d826ea83c7be58
MD5 468e77b14ab7a8d9c2d6285dc4d270cf
SHA1 464109a45a30bc42bc87cc8b7927378a70f59998
SHA512 03d87cedff009e0a55adbd00e3f96360578130e7caf75a9cf4623c30a277c58d8409c5fa3244cd9c3b76617e829e7902761055ab965b89d694e362bdb786a7c0
TLSH
T1061121C36EF8A18499F39760CAE8C6313CB9608669FA30D11C9198D3205B72C6F1803F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 a163fb2b2d7cf2c5f4b08bbb02846819bb6aea66f9c32942c5ae71748ff58fa4
MD5 8b17e61ad6fc16e485aa9a141f2617fe
SHA1 29b6b9b2078752420be6cfc9d1beb035c7d9cfd8
SHA512 bdfb351d2e3df55e18029ebaac7a275cbc4c924bba0cf5efb687a14821d40ddc50883f372e913e5d98f416bf37b4a0d4228b68e4097b7bae2456ee6f1a771442
TLSH
T16B41F8F3574A3928BF428F4A5DBDC2756D38A0A4D2815983F5B7C5E604C9BD02C1798C
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 dd4f9ccc5be1e15865b263a7aaaf00d465cdd1c67f4dc0f397e1107bb5a2b479
MD5 20b7e53721a8c4043012eeacc200bf2a
SHA1 5816434a2e5f7e4d30622b72bb9be95afb252885
SHA512 fd518dc88cee053382b7aa8aee2ccd3280ba45bc45b57ffb2fe0c7ef549f23ff14103b73297060afd349e36e29df396f5ef48d35996fec7f4bb74b25ef0d0a25
TLSH
T12EF0552C1AFC802CE032DFB98EE5E6E65C1AF223380445E90F910B0AAA02F441CA043C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 fd29993b311b2eef786921e31a64a69037ec46b6a49a0001e71b6acf566fe40c
MD5 484e0b12a58646dc1cdf72e796b7d65d
SHA1 39bd62739a5de110098b21a6763caf715f4c3c87
SHA512 788e23d92091439f331e8bdfb4a3fd9293afd70d8b3388b3b456b0ffe8282d704548e2650d730ef2d7245ca2cd6a6adb9e154a79302b4ae6dfa254985130851c
TLSH
T1F8F0681039FF917FF133AA3603C132F8562BF253701227B91A7213182A14F106C9550D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 5deb3c2a2f21c7f0cfeb705d6b83379f0cc7b93d20e4acc626b7791cae8f61ba
MD5 15a5a00e7c7afec8fdd6515cbc59cd27
SHA1 99d6bc07790e8e4441e4809ab929df30e7e08fd4
SHA512 9cf837585140a6402d329e203439b82cec0a80968d5f8625171f4ec0b65a2d23587fa68f6a49927c0eab68feff5382b299df1f7a066f54ea92039562a7b60e73
TLSH
T18DF05C0C15B8400EE0B1E874C2D521F56C35F109280482E707D711465907E103E129BA
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 ae27f1c27e8d229c9266f3bd4f8008c0cadc923053aeac35dc134be14cfe8cd2
MD5 cc10b0abc25baae5950e38acbb0211c3
SHA1 f5911a705d68421bbebd0e4c099cdef2a6ae0c09
SHA512 7552496efd57d6a8a46bf124828fa6a8fef6dc3b9f1cda330dec8164c1f38d2f6808993ef4d6673be9cc77de572c689647ef0c9e60c964a66dac356497f8d97f
TLSH
T10FF05C381A96407EE331267A4AE4A7EB9C09A3123408D46735D1160EF607E421E51479
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 45b2c4411f814329a10db4572bc696f50626198ef0e50f195133d38f2a07a3ba
MD5 eab0130ac7acf4eb047b1a6071f603c1
SHA1 84f85cd65a3c0f91403beec7f13a16a8f84bc8d7
SHA512 320b039c405f125128ce97c889c1b49492a1d425717217c364c218da4c1d39281a5bad158b6ed5d8a9b8e67f87deedb0b4a845dc06826479789bf43a3ca452f0
TLSH
T177F0AB3C24E7016EF220D67E02C106D68A27F6323584A6953BB042086D4AE01BEA0A12
MD5 SHA1 SHA512 TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
Size 2.3MB
SHA256 7dbab21e48ce7c0a9e42be1412bb2c69704c1aeb9520992076df5d32207de77a
MD5 6d26982e3003f28d2d256d532b5a9854
SHA1 2e51ac32285ea105d7bb86b298431532f6a987a0
SHA512 0d495fb336f037e7622bcedf152f23d6ed160230a4b45b53f96bfb7d75b0972c5294755034cbddae73a5cdb985fff5e320239cc27369047bfb20f9876d294319
SSDEEP 49152:+eWUGHITpj2h0VZrG+G61LwCQCggzGxYsm9kjwjm//KQD:+ebGH420Z1T19p5zGl4mxD
TLSH
T157B512D5785E7AABC00A1CBA8D16CE2635AC5B72C7604C97FFD53EBA0910D931623932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
Size 2.6MB
SHA256 666e37cdcf3ecc5e9308c6dad43a24dc2b0a399761c3defda78a32dd78218782
MD5 596b9aca94218da78ff231532e1345ba
SHA1 4faa56e175a6f9c12e6a57691071f7c5c92e8ca2
SHA512 69d3c85e178fa22300e0fcfae15235a7922679cbc19222c3962f42c91692ffcd233e6f58732e2bd8913b5652f865891d56fb900bee202d943d989595cb9a7389
SSDEEP 49152:+eWUGHITpj2h0VZrG+G61LwCQCggzGxYsm9kjwjm//KQgIEtCGeD:+ebGH420Z1T19p5zGl4mxGtCVD
TLSH
T130C512E5785E7AABC00A1CBA8D16CF2635BC5B72C7505C97FFD93EB60910D831623922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
Size 2.1MB
SHA256 a6eab7ec222ed3b272c899d5e8623efbc2e798d1625c0909a614f06a1605ed0d
MD5 63d3e1349d02bee750f7addacea7ef48
SHA1 146c5fccbb563d6e11b52e44dd31f129a42f3787
SHA512 d8371436c09e2aa00e88af1989971b42e3256c37f8ca8f838a4233738ba43b70317ed4158e65d6ad5b0522349b8148ba944678b0267c5ffcc2aa164a036c9f13
SSDEEP 49152:+eWUGHITpj2h0VZrG+G61LwCQCggzGxYsm9kjwjm//Ki:+ebGH420Z1T19p5zGl4mX
TLSH
T133A502D5785E7AABC00A1CBA8D16CE2635AC5B72C7604C97FFD53EBA0910D931633932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
Size 2.4MB
SHA256 0e664175a68d1d01140121344363d7258de98c18f9f42b262859151bc2172545
MD5 8be4b68baf09da3f4598a6ae44885ba4
SHA1 12c8081bbed3eb91ad171af1f06141faaec6ac75
SHA512 1bbf9a8e388268a7c7132b3890b877b21d7ef7fbda73941a9f190fd60e32c8209c3420702f9ff73747a5e7e41b17d77b05e72f8efd9850807ced28087f7e15cc
SSDEEP 49152:+eWUGHITpj2h0VZrG+G61LwCQCggzGxYsm9kjwjm//KQgII:+ebGH420Z1T19p5zGl4mx6
TLSH
T19CC512D5785E7AABC00A1CBA8D16CE2635BC5B72C7504C97FFD93EBA0910D931623932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
Size 2.5MB
SHA256 c722b32f1efbdb2de626c33448bb71182e7095d4dd9bd05fd8c4f97f835badd1
MD5 86abfdd2e3a9d558f3349fcd6ce6d14c
SHA1 e751d5a882e2704d153d68ffc74a9c7c04badac5
SHA512 1b61c6b157df6db90a505422f8f617e77b29849c2ee28ec7919f7bd8628f2663a5b60a439cd1e6cca1bf677c5f68669f2c1d9e4c38ab99c66d67f3deb7a9c1f9
SSDEEP 49152:+eWUGHITpj2h0VZrG+G61LwCQCggzGxYsm9kjwjm//KQgIEM:+ebGH420Z1T19p5zGl4mxGM
TLSH
T157C512D5785E7AABC00A1CBA8E1ACF2635AC5B72C7504C57FFD93EB60910D931623932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 2.0MB
SHA256 eea5e551a0d3dea00eba8c2520372e5980bbea9ed4b232afc075d6a074c0a9ea
MD5 ceedfa07a0497dc47d054f35550effee
SHA1 bef2d1179253e4fe45f942424ad9cd8cd9d8cbfd
SHA512 a15e1c74e8cdf1df9e1301ba262ec16336f9e4ffccde7959fcf42dfa3b0379082d97cbb679c08226bbe2888f1c6c1d62ce8167b996ba2d43c53aa2c374963a0f
SSDEEP 49152:+eWUGHITpj2h0VZrG+G61LwCQCggzGxYsm9kjwjm/A:+ebGH420Z1T19p5zGl4mA
TLSH
T1B5A502D5785E7AABC00A1CBA8D16CE2635AC5BB2C7504C97FFD53EBA0910D931723932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download