e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
Size 5.3MB
Sample260910-tyhfcadr8y
SHA256 e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7
MD5 1195c05f540cba8d75f8f8b4048c6199
SHA1 379d6ea30e074ce1dae8f389058fbefc93342b87
SHA512 2209ad03f9ab20f97a008e6d815a6dfd1e7560bc322e82591e559e2ec61c133f0da45fee7cfe2221220c20b91521d35e9804e92eb0cc378eea34efb2b49bf728
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3Iwb:+0s420bTjzGlBrJTJb8QAMQ/ZRuZ
TLSH
T17C4623D5789E6AABC10E1C7D8E2A8E2135AC57B1C7605CA3FFC53DB60910D932673932
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2780	DesktopWindowManager.exe

Executes dropped EXE 16 IoCs

pid	Process
3380	DesktopWindowManager.exe
2780	DesktopWindowManager.exe
2280	SystemTrayHelper.exe
5596	SystemTrayHelper.exe
1856	UserSession.exe
5868	UserSession.exe
4696	SecurityCore.exe
5320	SecurityCore.exe
2716	RuntimeBroker32.exe
5916	RuntimeBroker32.exe
5992	WindowsHost.exe
5068	WindowsHost.exe
4852	UpdateService.exe
4484	UpdateService.exe
1404	SystemHost.exe
5876	SystemHost.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\DesktopWindowManager.exe\""	e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\SecurityCore.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsHost.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\SystemHost.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\SystemTrayHelper.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\UserSession.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UpdateService.exe\""	WindowsHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
91	raw.githubusercontent.com
98	raw.githubusercontent.com
101	raw.githubusercontent.com
1	raw.githubusercontent.com
17	raw.githubusercontent.com
34	raw.githubusercontent.com
58	raw.githubusercontent.com
79	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c480-12.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c491-95.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c494-114.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c491-169.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c495-203.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016aea-238.dat	suspicious_telegram_bot
behavioral2/files/0x000b0000000113b0-270.dat	suspicious_telegram_bot
behavioral2/files/0x0006000000016aeb-305.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6024	e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
6024	e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
6024	e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
6024	e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
6024	e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
6024	e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
6024	e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
6024	e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
3380	DesktopWindowManager.exe
3380	DesktopWindowManager.exe
3380	DesktopWindowManager.exe
3380	DesktopWindowManager.exe
2780	DesktopWindowManager.exe
2780	DesktopWindowManager.exe
2780	DesktopWindowManager.exe
2780	DesktopWindowManager.exe
2780	DesktopWindowManager.exe
2780	DesktopWindowManager.exe
2780	DesktopWindowManager.exe
2780	DesktopWindowManager.exe
2780	DesktopWindowManager.exe
2780	DesktopWindowManager.exe
5596	SystemTrayHelper.exe
5596	SystemTrayHelper.exe
5596	SystemTrayHelper.exe
5596	SystemTrayHelper.exe
5596	SystemTrayHelper.exe
5596	SystemTrayHelper.exe
5596	SystemTrayHelper.exe
5596	SystemTrayHelper.exe
1856	UserSession.exe
1856	UserSession.exe
5868	UserSession.exe
5868	UserSession.exe
5868	UserSession.exe
5868	UserSession.exe
1856	UserSession.exe
1856	UserSession.exe
1856	UserSession.exe
1856	UserSession.exe
1856	UserSession.exe
1856	UserSession.exe
4696	SecurityCore.exe
4696	SecurityCore.exe
5320	SecurityCore.exe
5320	SecurityCore.exe
5320	SecurityCore.exe
5320	SecurityCore.exe
4696	SecurityCore.exe
4696	SecurityCore.exe
4696	SecurityCore.exe
4696	SecurityCore.exe
4696	SecurityCore.exe
4696	SecurityCore.exe
5916	RuntimeBroker32.exe
5916	RuntimeBroker32.exe
2716	RuntimeBroker32.exe
2716	RuntimeBroker32.exe
5916	RuntimeBroker32.exe
5916	RuntimeBroker32.exe
2716	RuntimeBroker32.exe
2716	RuntimeBroker32.exe
2716	RuntimeBroker32.exe
2716	RuntimeBroker32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 3380	6024	e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe	91
PID 2780 wrote to memory of 2280	2780	DesktopWindowManager.exe	93
PID 5596 wrote to memory of 5868	5596	SystemTrayHelper.exe	99
PID 1856 wrote to memory of 5320	1856	UserSession.exe	102
PID 4696 wrote to memory of 5916	4696	SecurityCore.exe	105
PID 2716 wrote to memory of 5992	2716	RuntimeBroker32.exe	106
PID 5068 wrote to memory of 4484	5068	WindowsHost.exe	111
PID 4852 wrote to memory of 1404	4852	UpdateService.exe	112

C:\Users\Admin\AppData\Local\Temp\e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe
"C:\Users\Admin\AppData\Local\Temp\e1c08d7401a408614a41208392b632724955cfd817f598b59b134702f0379dd7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3380

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2280

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5868

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5320

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5916

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5992

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4484

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1404

C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SystemHost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 6ac45142693bd1c458512e3b8def1881e3fe3a81b85425044c0f460d67eac362
MD5 c10ea189c98d33ce0e871d19b27d2ee8
SHA1 b8e07c52568b0b8ac43d24df87ce133dedc95e96
SHA512 fa95426053eb82e9c3468f3bdf385197b306b22556ae80e4d255de3a1b6c7ded2b605a67dbac0f9295cd922e395aa2e0e0401d4057b15eaa1d26aec4d3524e3e
TLSH
T1B4E07D0E572CC3C3BD164C1026E5857A3AF270AF44D2150E643517C9CD42137C847049
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 407466a7bf7a775973c4c9f5277feec33d64debdc13b130e25446b9b5af3893d
MD5 415bc882f76a7b3e971dc0f091c9e07c
SHA1 37e4314fdbdd38a097d7371dbcd9f06f0becbbcf
SHA512 2ed928ae36c0e8cf7573c495786e80c6025f58a0972de548bc11eca029059e6c8bf7f7bf498e5cfbddaf40626fccbbd859d43a65e18b3a059b1ca0c59fa4a28e
TLSH
T16041A9DA2E187422AF814F805874CB353D7CF1D49988505974FA84E36495BA46D1A85D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 0e88a5f0db492c6d183a9c530238a34b60ddf8e643d59bb067a8bed73f3b04d7
MD5 ca45821f82f18cbccb347fd3d2edbdd0
SHA1 3c0bbcc22bc271a84cee8414221d42d021d221e3
SHA512 85a9f6c20f07e9bb0ba9aeaad0ed6dde142cc456dd82f56db61ea2b8b1f6ac821d6921fd59aef0530ac8cb3ac1ce2ba85a4108c3780fc861e81c4090bd7a1425
TLSH
T13ED0951715F6C9553B53DD044DD0D170B423AEB773D36C1AA48FD0D65800D2D3F0A215
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 177KB
SHA256 3ee1d2c8d78e42cb0fd8c9c51166eb660f996986c8f32edee4cf24e89d63e753
MD5 defd1c0b007eeb98b8a4c6b706366387
SHA1 90ca3509604357a2db95e8c845e4056d2388528f
SHA512 194b4fa1f4beae4938d8f2b00277ae696c91e0d01e2d8b6e116ee2beddeebf31600b6ff599c39de8004d8a4a9f02f65a28877f58be1cfa37acfd6ecdd4a7d107
SSDEEP 3072:OHlcm9KPx74L/pCh3ycyMGBeDvi6tizLk:0+AEx7a/ycrBeGqa4
TLSH
T10D043B645C7BB6A35D4BCE524CAEF69612F591D92812732ABE347E105C03ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 d47f36305c57a449d1209353c65cf916990d10c10bbb8dce40387ad034ead9fe
MD5 da2321ede03f4a5aa95d46060ca64ab0
SHA1 426f6b6524e6e41e03b9d2897076c8d0a2fdfa43
SHA512 d30bc6ed1e2abf680fcd8a7902f8e931ba1b7c64f3d794e9ea55fdbad2282ee766386816ce8dd0cd5782526e61b61d5eb17817d8affbb31ba58a43724ef579dd
TLSH
T18B1125C35FB5E19045F65765C6E4D5313D78708638E938C15C939842245772C670943F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 a163fb2b2d7cf2c5f4b08bbb02846819bb6aea66f9c32942c5ae71748ff58fa4
MD5 8b17e61ad6fc16e485aa9a141f2617fe
SHA1 29b6b9b2078752420be6cfc9d1beb035c7d9cfd8
SHA512 bdfb351d2e3df55e18029ebaac7a275cbc4c924bba0cf5efb687a14821d40ddc50883f372e913e5d98f416bf37b4a0d4228b68e4097b7bae2456ee6f1a771442
TLSH
T16B41F8F3574A3928BF428F4A5DBDC2756D38A0A4D2815983F5B7C5E604C9BD02C1798C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 835c42c0e9827a62800a4a81c2584e64bfa5e0b0f845b6a954f673df2993c834
MD5 60785a76183c8fa7c2aeb4db6df2e923
SHA1 e2bec66b02ff1996d613b3b235174441a791d6ad
SHA512 d4837a3efe453947c3b0ca90284dcf9489139139cd955e6bc581243f715c89bec279fec85569d6b8ce85ca90bd79c1e3f12b3fb12b61583f5520b892660ac5af
TLSH
T1ECC0801C69511505F194437C01C17D0357104102E241CF151AF12A08C956B152834C69
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 9f611b5748b12bc15490c1b5ae11a678583b0b52a5a42ba9e2680409402be650
MD5 017815c957fdadaaffebab7402fe18a4
SHA1 230b85090221493d378161455e8e0b85699cca2d
SHA512 3e5c7749cac994e3da6d780d983bcfc28b08ae834e7c692fac96a89b6bbee4352f3d4b90a5aae95205d3d5efc18aebb425023772f4bbe989bbf76d045585e64e
TLSH
T15BF05C2C16FC802DE076DBB98ED5E6E75D16F223280405E90E910B09AA02F441C5143C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 c7ecf3ed42f4de5cd710be17e3422fd4b1684649a0800b10cdb94541f00c0887
MD5 de2a1abecb71b669720044d509bea59f
SHA1 7962419991aec4ef245555e48cc0f770b0af20c1
SHA512 48854aaef5c9975eeff381b1f0deaa94c479f3d4fe5bf650988ffae82313aea94eceb85a2ed9bdee9df28a4079ba7949ed18a78192348a235e6988ac3e4742c2
TLSH
T1DFF0222039FA903AF023AABB47C561B6096AA30674026BB61A6023046E24F206D82511
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 8fa31c2d8b91d5d0c07e2fd4d10722d4252eaf8884fc96905a1d68a8bfb09e6a
MD5 8451d9cf1b4356e04c1be6494de5ce8e
SHA1 579ab8dd29a1588e3396ffc20a045dc2f382c61d
SHA512 257140fefd6a2452695d1281212bd8f508c7dd9224ce3d3066138368f96a80a5278ae317f956508ccb21f5ffacff295e40cdf40635bd1e19c9ae4e479155d228
TLSH
T1FCF05C0C15B8400EE4B1E878C2D521F6AC35F2092804C2E707E621495A07E103E1297A
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 5d32e31341c38982b781c350cd1ea88ff8940549cd194f3e4f0693ef357863f6
MD5 a2a8f8b7cc97d8534a54859adf63bc80
SHA1 6b436225bc1c36eaf314f28271538ff919382ba1
SHA512 f5dd15a89893c2699b1ea60dc7825e7a1ac6b0ba1d491a7d9c9414897dc7e8e4eb5ea0c4750a4672babcb4cb856d60aeb37cc28e792d19e3598edc031693f9a3
TLSH
T139D0C734375A5215F4A4013958B107D35B657D2675818B6D6F61571C892AA411C92A05
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 79112b2bf2865dfc761d95caee913318f6585fae03001072e68371fac07540cc
MD5 3affe0017ab68c51b63781fc1702da18
SHA1 cdb7b1b0748eae9045a01b14501d68fbbee2e975
SHA512 993b069bf4fa18eb63e7ddda038057462b9b7cf7c0a1106d82b5ac70fc457ad62bb3bedee7438589518200630890afec1eda5717a885b0bbe193113ad9f40f4c
TLSH
T1E0F0AB285AEA411EE2326BB94AF553ABA826F3463408C5A51BE91309EF43F406E12534
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 b1d87a5f0f1e87e7d757b07140a3c81ab2ad71db0aed3e303156af4289b82d18
MD5 099a51c4729c24bebb64cb592fc554f6
SHA1 289b4d83676dc2222fded6cba4a96b4bdb02d020
SHA512 d35d2037a9259f12c0bd2b1ad4f8c095bc9c28d58dc117bcbd8e80a2da007c720fec94f31110d217e323067e91dd4c0dcb4d9da992530a9a18bc498d8ef1b427
TLSH
T191F02B3D34EB056DF221D6BF02C116D68A27F6333554A6653AB14319AE49E01BEA0A12
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 2056ab449340889405a8c45620eda113c0d9b22dc24f483767123ac4d9129c7e
MD5 a93f9e89bd41935722bd8f11e9552a85
SHA1 9452941f4bfda70799bda41c84d8595ea947ba35
SHA512 d2ac36f7195154a746f29473b0deb35542215b68ef8bd2116c0144f8cfe7b5a1c8873c18ecd8b63b975aa67b2a2b98b1565cc9f5de6ed1bfb2214dd54117c613
TLSH
T1EDC08C1C56610606F2A883BD02C329838A228220F3829F212AB12A1CCE24F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe
Size 5.5MB
SHA256 9a8ae7485a50ed8374d5f1164af0e62b96499b40820df3121cd73905f75ee968
MD5 6b62a576e0901096c5f58e60f8444969
SHA1 d5ef7b173984dbaf2a9ae5533af404ee5b3cdd79
SHA512 62af165a55fe36a9b806e8d7bc02ca876bf3355dee88fd41d56f10260b7048306fba94d64c5d96580c16b1cf7c770f907f9b62eb34245faa12df882f99719219
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3Iwlcn6:+0s420bTjzGlBrJTJb8QAMQ/ZRuX26
TLSH
T1664623D6789E6AB7C10E1C7D8E2ACE2135AC57B1C7605CA3FFC53DB60910D922663932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
Size 6.0MB
SHA256 59a311ffe11f407955abf0a5a72d065c011bddbd7812bb042f840142e1740635
MD5 f25277e7979d80d01ddfc26a504b8445
SHA1 5a2379f4838e89e7fdab5e43a8a92596298a6be5
SHA512 b32b403daf09553c9abc6fc427d000ff1366c44e5a36cc559550953e05fa7b94be9ea83d6ab2286185b043ac0dd6b6b7a259ad4acdf84cb7c1dd9f0784a5d8c7
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3IwlcnZpLm2f0:+0s420bTjzGlBrJTJb8QAMQ/ZRuX2TLy
TLSH
T11E5623D5789E6AA7C10E2C7D8E1ACD3135AC57B187604CA3FFD53EB60D10DA22663932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe
Size 6.2MB
SHA256 ab2b96048ff39e1d124ccfc8148cf1ce2c3982d68bc12c3ae709d6aeb3ae9ebb
MD5 d04f0a160b71b129be161dcc308b3518
SHA1 235f0180e42dbb39e3b55095d605897e8ac9d099
SHA512 8b456fc7cad8c4ed5ecb51057385391191ac5d86c6d1f5c8417549cdc3ed547a04f0eabba6be73e6860391c1c0d1996771d99f349680e80104ef28a2e503c630
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuX2TL5C1G:TDpbgBr/4QAMQ/ZRuI5Cs
TLSH
T18D5623D5785E6AA7C10E2C7D8E1B8D3135AC57B1C7604CA3FFD53EB60910DA22763A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
Size 5.4MB
SHA256 e1e4253c92d141169203df521f5191bbbf523740f4a43b4b676037e2f7a8d69b
MD5 cac0a47a89ce75a667c10810bc758859
SHA1 24afb5da65fb3c37906d3c3ac9b54d28345b3082
SHA512 53b5521c96e8d87bcc7446413250af88fa29a02a360374b2b76fade46e0a351e0df31e91b59402e4244dfc4a4c90e5773d740e90f1375d14cdd3e57a5a77957e
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3IwlcJ:+0s420bTjzGlBrJTJb8QAMQ/ZRuX2
TLSH
T1AE4623D6789E6ABBC10E1C7D8E1A8E2135AC57B1C7605CA3FFC53DB60910D932663932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
Size 5.6MB
SHA256 fe533e2f46713a82476d3146efc017f4630e44da2ac28782621ab4d293409d85
MD5 5f02b2cb9098553ec0b6373b338c5cc0
SHA1 1c3222fb2847771a9cac91a59df1678f4cd62d42
SHA512 2a5464f33b72609c7ea49acde98d8294c17ba0b9d6403f2bb2e29a406c6491d3e81406fa91466e17fdfc6376dc9bcec612edb7ffc67fac47b440ba6776cadaf2
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3IwlcnZa:+0s420bTjzGlBrJTJb8QAMQ/ZRuX2w
TLSH
T19E5623D5B89E6AB7C10E2C7D8E2ACD2135AC57B187605CA3FFC53DB60910D922763932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SecurityCore.exe
Size 5.7MB
SHA256 087921868a6d97172d853217fa1132ad1d8f5e9bf2903eba2679e31f49797208
MD5 cfc06c1a52252fe6762189249f67f105
SHA1 6804e5fcf3587bcc19ac082c2bd26a1572c497bb
SHA512 64bf7867015c5510f76dbcec0a669fa3f737ad81aa8c74d63c2e1148de82f7931f36403a6cac20d3ced233d17e22a91654e0cbeb17367e0845e13dd5b159428e
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3IwlcnZpA:+0s420bTjzGlBrJTJb8QAMQ/ZRuX2TA
TLSH
T1BC5623D5B85E6AB7C10E2C7D8E2A8E2135AC57B187605CA3FFC53DB60D10D922763932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
Size 6.1MB
SHA256 1f92014d20a7ba28e383d3d85aeb932ebb2c670da947fae0dec9402cc18f3f1b
MD5 007cc726ebb26b2fafedb7952479998c
SHA1 f815ce5c17f7327b67775b8935bd4edf4c23aee5
SHA512 1bb833661a8b6884878274ffa8f6c1aad62176113a3a97ab005be5b1bd7699945c1588272d064cfc1d7399be6063612eafba38f8da6ad39c99eb7c70cb395d9f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuX2TL5CK:TDpbgBr/4QAMQ/ZRuI5CK
TLSH
T1FE5623D5789E6AA7C10E2C7D8E1ACD3135AC57B187604CA3FFD53EB60D10DA22763922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
Size 5.8MB
SHA256 2bdf283f2966e6f17dd12bb8b2fffc18dcc5f9f706c13d64f0a9a316bb104911
MD5 99e7aea503043bb2194599677608bdac
SHA1 707ecd03b7f149f6c0f0e98f054223efbf0a7ee0
SHA512 2f12859b3e598ff59443b714e2b54432eaca50138c584882eda2350f3feff0abb46e8589c2d99ab64d87927958055182f2960c9bc9cf9ecbae448863eea8d5c3
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3IwlcnZpLI:+0s420bTjzGlBrJTJb8QAMQ/ZRuX2TLI
TLSH
T1AE5623D5B85E6AB7C10E2C7D8E2A8D2135AC57B187605CA3FFC53EB60D10D922763932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download