0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
Size 7.7MB
Sample260910-yc69ssxwev
SHA256 0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de
MD5 20d53413754beb14bb71000dc378eb53
SHA1 dfe3245ad2b60c1a90e495ad14183549aa04c1d5
SHA512 af5ab5661f9263f96b4955b5f9fe5024b57b05991faaf0df0d2f5b39afbdd1e4aca33ad82307ee9415cbb419aec230f382d16972f8667e8215401460e7509e0e
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWXIuFHrI8mY:TDpbgBr/4QAMQaTCvkA3BWXIuLIg
TLSH
T1DD8633D67C9E5ABBC10E1C7D895B9D6235AC07B1CB905CD2EFD52EB64C10CD31A32A22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5476	WindowsInternal.exe

Executes dropped EXE 18 IoCs

pid	Process
4156	WindowsInternal.exe
5476	WindowsInternal.exe
2408	DesktopWindowManager.exe
1796	DesktopWindowManager.exe
5412	RuntimeBroker32.exe
5688	RuntimeBroker32.exe
1356	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
904	SystemHost.exe
4564	SystemHost.exe
3000	SecurityCore.exe
5864	SecurityCore.exe
1980	DesktopWindowManager.exe
3884	DesktopWindowManager.exe
3104	NetworkHelper.exe
4948	NetworkHelper.exe
2036	InputService.exe
4708	InputService.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\DesktopWindowManager.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\DesktopWindowManager.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\DesktopWindowManager.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\NetworkHelper.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\RuntimeBroker32.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\SecurityCore.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\InputService.exe\""	NetworkHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
24	raw.githubusercontent.com
66	raw.githubusercontent.com
74	raw.githubusercontent.com
77	raw.githubusercontent.com
103	raw.githubusercontent.com
32	raw.githubusercontent.com
46	raw.githubusercontent.com
52	raw.githubusercontent.com
85	raw.githubusercontent.com
97	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c53b-12.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c53d-76.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c546-120.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c54a-163.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c54c-202.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016ad9-241.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016ada-276.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016ad9-304.dat	suspicious_telegram_bot
behavioral2/files/0x0006000000016ada-339.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5820	0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
5820	0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
5820	0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
5820	0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
5820	0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
5820	0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
5820	0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
5820	0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
5476	WindowsInternal.exe
5476	WindowsInternal.exe
4156	WindowsInternal.exe
4156	WindowsInternal.exe
5476	WindowsInternal.exe
5476	WindowsInternal.exe
4156	WindowsInternal.exe
4156	WindowsInternal.exe
4156	WindowsInternal.exe
4156	WindowsInternal.exe
4156	WindowsInternal.exe
4156	WindowsInternal.exe
2408	DesktopWindowManager.exe
2408	DesktopWindowManager.exe
2408	DesktopWindowManager.exe
2408	DesktopWindowManager.exe
1796	DesktopWindowManager.exe
1796	DesktopWindowManager.exe
1796	DesktopWindowManager.exe
1796	DesktopWindowManager.exe
1796	DesktopWindowManager.exe
1796	DesktopWindowManager.exe
1796	DesktopWindowManager.exe
1796	DesktopWindowManager.exe
5412	RuntimeBroker32.exe
5412	RuntimeBroker32.exe
5412	RuntimeBroker32.exe
5412	RuntimeBroker32.exe
5688	RuntimeBroker32.exe
5688	RuntimeBroker32.exe
5688	RuntimeBroker32.exe
5688	RuntimeBroker32.exe
5688	RuntimeBroker32.exe
5688	RuntimeBroker32.exe
5688	RuntimeBroker32.exe
5688	RuntimeBroker32.exe
1356	DesktopWindowManager.exe
1356	DesktopWindowManager.exe
1356	DesktopWindowManager.exe
1356	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
4916	DesktopWindowManager.exe
904	SystemHost.exe
904	SystemHost.exe
904	SystemHost.exe
904	SystemHost.exe
4564	SystemHost.exe
4564	SystemHost.exe
4564	SystemHost.exe
4564	SystemHost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5820 wrote to memory of 5476	5820	0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe	90
PID 4156 wrote to memory of 2408	4156	WindowsInternal.exe	91
PID 1796 wrote to memory of 5412	1796	DesktopWindowManager.exe	95
PID 5688 wrote to memory of 1356	5688	RuntimeBroker32.exe	98
PID 4916 wrote to memory of 904	4916	DesktopWindowManager.exe	101
PID 4564 wrote to memory of 5864	4564	SystemHost.exe	106
PID 3000 wrote to memory of 3884	3000	SecurityCore.exe	109
PID 1980 wrote to memory of 4948	1980	DesktopWindowManager.exe	112
PID 3104 wrote to memory of 2036	3104	NetworkHelper.exe	113

C:\Users\Admin\AppData\Local\Temp\0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe
"C:\Users\Admin\AppData\Local\Temp\0b2b47c411a8bd80c69334447a09e686b7e212e50ec407ca40faff3984eac8de.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5820
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5476

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2408

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5412

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1356

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:904

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5864

C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3884

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4948

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\AppData\Local\Temp\InputService.exe
  "C:\Users\Admin\AppData\Local\Temp\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2036

C:\Users\Admin\AppData\Local\Temp\InputService.exe
"C:\Users\Admin\AppData\Local\Temp\\InputService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 6ac45142693bd1c458512e3b8def1881e3fe3a81b85425044c0f460d67eac362
MD5 c10ea189c98d33ce0e871d19b27d2ee8
SHA1 b8e07c52568b0b8ac43d24df87ce133dedc95e96
SHA512 fa95426053eb82e9c3468f3bdf385197b306b22556ae80e4d255de3a1b6c7ded2b605a67dbac0f9295cd922e395aa2e0e0401d4057b15eaa1d26aec4d3524e3e
TLSH
T1B4E07D0E572CC3C3BD164C1026E5857A3AF270AF44D2150E643517C9CD42137C847049
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 407466a7bf7a775973c4c9f5277feec33d64debdc13b130e25446b9b5af3893d
MD5 415bc882f76a7b3e971dc0f091c9e07c
SHA1 37e4314fdbdd38a097d7371dbcd9f06f0becbbcf
SHA512 2ed928ae36c0e8cf7573c495786e80c6025f58a0972de548bc11eca029059e6c8bf7f7bf498e5cfbddaf40626fccbbd859d43a65e18b3a059b1ca0c59fa4a28e
TLSH
T16041A9DA2E187422AF814F805874CB353D7CF1D49988505974FA84E36495BA46D1A85D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 0e88a5f0db492c6d183a9c530238a34b60ddf8e643d59bb067a8bed73f3b04d7
MD5 ca45821f82f18cbccb347fd3d2edbdd0
SHA1 3c0bbcc22bc271a84cee8414221d42d021d221e3
SHA512 85a9f6c20f07e9bb0ba9aeaad0ed6dde142cc456dd82f56db61ea2b8b1f6ac821d6921fd59aef0530ac8cb3ac1ce2ba85a4108c3780fc861e81c4090bd7a1425
TLSH
T13ED0951715F6C9553B53DD044DD0D170B423AEB773D36C1AA48FD0D65800D2D3F0A215
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 177KB
SHA256 7d0f6df5f36e062a516cedcbfd4ef40616adcd767ec1d8b14ef85961122408d2
MD5 1a266210e74b768c7c5f1e87c3c04556
SHA1 947e95122d39b61d8fe7f803fd9c4114a1a41978
SHA512 bb11fb4b14ca0ced323712922f53d748347141fa1c80f76edd0417413b6deaa11bedd3e34722f29e10460e86a6db615830c8d5bfce0f088c3194ae9f805b0a97
SSDEEP 3072:MHlcm9KPx74X/pCh8ycyMGBeDvu6tizLF:u+AEx7I/fcrBeiqa5
TLSH
T105043C645C7BB6A35D4BCE524CAEF69612F591D92812732ABE347E005C13ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 d47f36305c57a449d1209353c65cf916990d10c10bbb8dce40387ad034ead9fe
MD5 da2321ede03f4a5aa95d46060ca64ab0
SHA1 426f6b6524e6e41e03b9d2897076c8d0a2fdfa43
SHA512 d30bc6ed1e2abf680fcd8a7902f8e931ba1b7c64f3d794e9ea55fdbad2282ee766386816ce8dd0cd5782526e61b61d5eb17817d8affbb31ba58a43724ef579dd
TLSH
T18B1125C35FB5E19045F65765C6E4D5313D78708638E938C15C939842245772C670943F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 05f55cd741ebf04fa6143cc1279f95b44c856f1efbd611312ea2cd1793a0b673
MD5 c2f9f75d444f05b448f600f9f498972f
SHA1 73efed1f442da35a14c31316406bbd1dbc14b9fe
SHA512 533226cb07ebc8d0f7ca310bd09c478deb65bc93d0dd6a1806c03d2a1bb475c31baffab1ca3a7980feb230b7d67a6905441efed6fb02e8d99439a878da91ddfc
TLSH
T15141E7EB6B1A3968BF469F866E79CD355C38D4B981800885B9A3C4DA10CE7C16E0698C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 8594b1aa589f97dea8125b411ad19e03ee4a632154f0f2937dcc3cd534c034fb
MD5 fafe1b94ee6fbe3d1b357e27601d8732
SHA1 c73c0be27cf0867bcaa649213aaefc60384d077b
SHA512 b0439f98949460af4143f1d8f11302a11c44ecb966efa9d31d9ef4e31387dad7ceb3ca722477de94211f63a6ad7e2f56b58a07f19d3420c12b8b6d511b255f37
TLSH
T150C08C1C2AA20A06F2A8437C02C139439B20C141E2858F151AF12A48EAA6B162838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 ffc155722eeac9955988c67ce4bd0df50b946b5d3b32b2c22f1c96f68c3a809c
MD5 c56ad8c23f017f32b1abfc99c7c0ebbf
SHA1 4496ab6e03112d063c2a5cf6efb5f5cf66d9cad1
SHA512 8efc2d2a11d63053e3f78aab6047b08e8c6caeac17996f673f4d282a0eb14cb8e5d9f2a3f9ede65b4f5a04916ef8bfc7ad23a91b8ce21b005722142776111b28
TLSH
T177F05C2C1AFC801CE036DBB98EE5E6E65D16F227280405E90E914B0A9A02F441C5043C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 73a28cc4b1d49fd165bdec42c3c06db522615a5d766afeec8990a5b3e868eb93
MD5 0d2769b43073b0456435cc68e6036a53
SHA1 0c217bf77c89cd555b0966467f0728f3757f072b
SHA512 2b3316b5ef362d19bf8376cc0ccd1b13e5510b3ef75fb22c141340d4a24773a863e6e909917aee3ce19f41911766fb329768d472a1b84397a0e553648f58ef00
TLSH
T143F068603AFB903BF033AABB43C571B10D6AE30674026BB61BB027042F24F206DD3511
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 28269b429abb8d38f35119fe9a1ba14c479516b0ca269f22f0608231c150206a
MD5 4760b13e9ce7316465e4a02350cc4f5e
SHA1 1c61a19fa42e148ad5825deca083bd1e536b261a
SHA512 d36e9208b2e709b510cf24252568e0b5287f062c2e61dc231a665e9a11e623c9110b30143662589b2adbf58f3e9c202b0608bf15bb17a6cdd5a850b6c36aa0a7
TLSH
T11DF05C0C15B8400EE0B1E874D2D565F5AC35F209680482E707D751455A07E103E1297A
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 4dc3b37550f15b75c39d60b4ec25e68c6e8e55f130bc3799574e3f3d63c96d66
MD5 560c31e56a3fa334497a62a691995f79
SHA1 2e4347ad412dd94d29dbdc40c8e1609fccfc0e53
SHA512 d681547ecda30590034d2636b1f891ed395d10d37c41466730d3122f7bf42fb56846aec659ecbed14f052cc2cfed01826a8ced75740b7147a3d6eea5831708f2
TLSH
T175D0223C3369231EF0B0423846A645C27FA21881B9D1932D0FB3130C442EC820EE1C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 a157df8048100859ea0065babc3e4d8e327814583ef0566c7a992f275438e3ef
MD5 ef4f30cfef31f61f01f10029006b0595
SHA1 239ac74d32f122bd564897f49ed5271ed7399928
SHA512 2d9adf4b7ae4cb8c38a5ba26a5efac71ac0faf493297b82b3ef2a98ec92896d3b63d57d6085cafff441cbc3a09eeb500b93780e221c33d84dae26245e541176d
TLSH
T15DF0AB285AEB405EE23267794AF553ABA826F3523408C5652AE95309EF43F406E12434
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 421f438ef8cd0e1658119535de3178ee573d02b89466117cc7fae4defec2321a
MD5 611d0f4b9b79d6b690c24a36bb24691f
SHA1 3b7ade29326989cb6e392adef1220a9733295d01
SHA512 8c6517afb6bf10681d7daee9597231d92e51a5b0da5070679494225b3c8aa2d98ce06984538c1cf38b46389b9590e03ed858e74fb2d09ce3ff7f4b6aaf8487db
TLSH
T164F02B3535FB115FF262DBB812E052D5CA72F53731092ABC7BB046095D05F40BEA2926
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 79a900c5e8655735a434698b978af938063276681317336f96d8c1730c57a8ee
MD5 94510cbb788c6e0735830223ce4eed08
SHA1 6848f15b2a331de08b650a7b02b64a97cbadf616
SHA512 740d6b2834a77e9cce89a3f196e3dd10cfd838b3f924aac174a3405e1f5741b579219c9666df8ff8095c0f97bbf2881da53271e37208dd2f71f2c43297945546
TLSH
T1AEC08C1C1A658606F2E883B802C62D838A208110F3819F1126B13A08CE24F122C34C2A
MD5 SHA1 SHA512 TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
Size 8.0MB
SHA256 3adf19fd4f936f0e499097794035d9ff534d487e8c1a8b20cd92f7d3a4d783a5
MD5 b55f27e1748e5c9ac7c02d91a641f935
SHA1 8f0c9d5142fbf96df2890c7074632c0a1181972b
SHA512 875dfda7c9c3514bbed12325dfee5de880c1ba5dab3bb2cbf0687b6930e40bae981f3b56bedb1ac2e3ab980f6a64a5935b708a08d41a5753175f428261040698
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWXIuFHrI8mbk:TDpbgBr/4QAMQaTCvkA3BWXIuLITk
TLSH
T1A38633D6789E6ABBC11E1C7D895B9D2275AC07B1CB505CD2EFD13EB64810CD31A32A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
Size 8.6MB
SHA256 4cced8f234d79d33349a14631cc946193f9b620e7a54359870e36e1e8dd80604
MD5 bd9e80b129161cc1acc344bbb279a654
SHA1 f81c420a4556f2185869b83ff4f07690649685d0
SHA512 94a59094fd0fb7ab123f4e2199760a3747359c3e4f8fca90a423922ab6cd1ea7bbcac7aea0f4b2eee7250c6f229c1e2edac60fc29b985f24311ed4fabf45c207
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWXIuFHrI8mbbjyPZ:TDpbgBr/4QAMQaTCvkA3BWXIuLITbjYZ
TLSH
T1849633D67C5A6ABBC10E1C7D895A9D2275AC0BB1C7505CD2EFD13EB64820CD21B32E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
Size 8.4MB
SHA256 28d97674c28ee3a036a07b96c9d2d73bcdc3312e7ce937f94c6b7b6118038883
MD5 27e32ff3d9fa36733b7cce5a1d2578d9
SHA1 1f898d18eb7cbc54c7bcbfcd7484193321d6de40
SHA512 e0cfe9d629f604b004e156fcd43365d4a06307e7dfe259b86c2d5588bd3d8dcf874a4fc37d659647a933bb74cb98585a261e459cf6b96384ddc0a7c042f2f01f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWXIuFHrI8mbbjyN:TDpbgBr/4QAMQaTCvkA3BWXIuLITbj4
TLSH
T1D79633D67C5E6ABBC01E1C7D895A9D2275AC0BB1CB505CD2EFD13EB64810CD21A32E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Temp\InputService.exe
Size 8.8MB
SHA256 1927a546cc73facb200c1e39dcfb776cbd3692f3f8235dd1e33bb0234d6d5386
MD5 6714743de224edd316159cca92b5766c
SHA1 080c8ce01f46b4b081ee2dd48c6c1889ee5dff6f
SHA512 70fb9e69a9e984b8a57f6dba80d615887958b9d9a739d3b28027d7cdbb2ab6b61db9322236049e35977961d35f22416cb95c1a7ab80cdb17c16732ee8ec7d5f9
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWXIuFHrI8mbbjyP+u:TDpbgBr/4QAMQaTCvkA3BWXIuLITbjYZ
TLSH
T1B89633D6785A6ABBC11D1C7D896B9D2235AC0BB1C7505CD2EFD13EB64820CD21B32E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
Size 8.5MB
SHA256 e1c204becdcbadf85ce491e5381f48e974fb9e14978595de0c2d057b2644db3c
MD5 f9408fbc5a38d9b71a05613a5ef2b56c
SHA1 2f5c246f876d60c846e5074feedc5069d8c3ccb0
SHA512 4983a2d416f4c963599447d9f431d3a6c5c3078b12e8271ce5a5595fd4850c3a1171e87bbed0f8768445b6317773c9fed4fffd8d7fd6c7dac43de68e94a72093
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWXIuFHrI8mbbjyPF:TDpbgBr/4QAMQaTCvkA3BWXIuLITbjYF
TLSH
T1259633D67C5A6ABBC00E1C7D896A9D2275AC0BB1C7505CD2EFD13EB64810CD21A72E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
Size 8.1MB
SHA256 31305273429bfa77336da4f7f2daf6bffc106c7da87463c3dc7aed63cd90fe33
MD5 17a39fd8e283979bdb6f99ba2a496ca5
SHA1 7f4d0485b9fb5832b3b2cfbb674a13d7d2efb7f0
SHA512 5c0e61a3059181d24b1026eeecd0325ecbb064ccab88278baf59a86f3f971ae7325a7af17c5d77a385a598cbee442df224f0fa9866ee9cbbf1f667e8f23c90af
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWXIuFHrI8mbbV:TDpbgBr/4QAMQaTCvkA3BWXIuLITbV
TLSH
T1DA8633D67C9E6ABBC11E1C7D895B9D2275AC07B1CB505CD2EFD13EB64810CD21A32A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\DesktopWindowManager.exe
Size 8.2MB
SHA256 fcf7852f2173676c3022d6c4c5d35efb384afbd6794d2a8de221955ec11e8443
MD5 530f85b11d2b818113f2f272820427dc
SHA1 6a5d884eaa7884f9aa79b853ebcc06a62d32f51a
SHA512 d155d7138a04450a2b37ec30cfeab305485ebd2c6065795329aee62be1fbf7f475659790aa12552ad69d86a3b2b4778597c0fbd3152c58c437bffa7e2678eb48
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWXIuFHrI8mbbg:TDpbgBr/4QAMQaTCvkA3BWXIuLITbg
TLSH
T1CA8633D67C5E6ABBC11E1C7D895A9D2275AC0BB18B505CD3EFD13EB64810CD21B32A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
Size 8.3MB
SHA256 24385cb05dd1d18d7ba1e1431daad8b1270cd9f773cd4b6a3fee98eb521eaa22
MD5 54e19f4ab9e7ba2671007ab99b96d0b5
SHA1 b6d03095d08bada368dcf0f84cb12a2581f8b078
SHA512 6e02e2de4e9eff3b5e411e4ea71037199083012e17bb10f0188948d3539e376d714c235799d2abb38c147827533e8d11801c29bb842b7b5fd6738137cecbe048
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWXIuFHrI8mbbjyN:TDpbgBr/4QAMQaTCvkA3BWXIuLITbjY
TLSH
T1629633D67C5E6ABBC01E1C7D895A9D2275AC0BB1CB505CD2EFD13EB64810CD21B32A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
Size 7.8MB
SHA256 c53e35712b5e22ba7a22244c3cc5bb57365346592b903e4dcd7072b3b43c1582
MD5 55c173c5fae51db240f0398355afbd0c
SHA1 e7e66b97757dbe77fa0bdbb1345a415f25181277
SHA512 e9553da02f2dc28d844601a72e9b91456e6ab797f90c3864e2e7712504613774f621e49d224c18ff39f8a8de6677ebf5ffa7228a1862865fd91a54398be2ec52
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWXIuFHrI8mN:TDpbgBr/4QAMQaTCvkA3BWXIuLIF
TLSH
T1138633D67C9E5ABBC10E1C7D895A9E6235AC07B1CB505CD2EFD53EB64810CD31A32A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download