b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
Size 9.0MB
Sample260925-q8lnzaee72
SHA256 b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9
MD5 0a2fb0cd87e258be85721e747a7cd679
SHA1 67ab0d9730cb24794090ad5cd047eac3f2bd0b3c
SHA512 6d670dca1e3af7aaefcbe54ac6339af1bcea8fc0b83a28ef0d149ecb6595a54345adf1420692466633167ebfc09bc3d5dbab581b8f1aba5352f4fc9f1ab2d9a6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx7P:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8AO
TLSH
T1F59633EA785E6ABBC20D5C798E06CD7278AC5BB1C7644CC3FFC57DB64840C921622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
260	DesktopWindowManager.exe

Executes dropped EXE 21 IoCs

pid	Process
260	DesktopWindowManager.exe
4268	DesktopWindowManager.exe
884	CoreSystem.exe
5348	CoreSystem.exe
2432	RuntimeBroker32.exe
1960	RuntimeBroker32.exe
5488	WindowsInternal.exe
1296	WindowsInternal.exe
120	RuntimeBroker32.exe
1204	RuntimeBroker32.exe
2904	WindowsShell.exe
4388	WindowsShell.exe
616	SystemHost.exe
1396	SystemHost.exe
4344	NetworkHelper.exe
2740	NetworkHelper.exe
2684	DesktopWindowManager.exe
3404	DesktopWindowManager.exe
5668	NetworkHelper.exe
1400	NetworkHelper.exe
4144	UpdateService.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\NetworkHelper.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\CoreSystem.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\RuntimeBroker32.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SystemHost.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"þÿÿÿ\\UpdateService.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\DesktopWindowManager.exe\""	b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsInternal.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\RuntimeBroker32.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsShell.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
33	raw.githubusercontent.com
117	raw.githubusercontent.com
132	raw.githubusercontent.com
44	raw.githubusercontent.com
58	raw.githubusercontent.com
99	raw.githubusercontent.com
109	raw.githubusercontent.com
114	raw.githubusercontent.com
1	raw.githubusercontent.com
74	raw.githubusercontent.com
86	raw.githubusercontent.com
22	raw.githubusercontent.com
54	raw.githubusercontent.com
70	raw.githubusercontent.com

Detect suspicious telegram bot 11 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c4f9-30.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4fd-107.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c500-142.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4fd-175.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c500-209.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c4fd-242.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c500-249.dat	suspicious_telegram_bot
behavioral2/files/0x001200000001c501-284.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c500-318.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c502-352.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c503-387.dat	suspicious_telegram_bot

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\þÿÿÿ\UpdateService.exe	NetworkHelper.exe
File opened for modification	C:\Windows\þÿÿÿ\UpdateService.exe	NetworkHelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1392	b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
1392	b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
1392	b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
1392	b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
1392	b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
1392	b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
1392	b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
1392	b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
260	DesktopWindowManager.exe
260	DesktopWindowManager.exe
260	DesktopWindowManager.exe
260	DesktopWindowManager.exe
260	DesktopWindowManager.exe
260	DesktopWindowManager.exe
260	DesktopWindowManager.exe
260	DesktopWindowManager.exe
260	DesktopWindowManager.exe
260	DesktopWindowManager.exe
884	CoreSystem.exe
884	CoreSystem.exe
5348	CoreSystem.exe
5348	CoreSystem.exe
5348	CoreSystem.exe
5348	CoreSystem.exe
5348	CoreSystem.exe
5348	CoreSystem.exe
5348	CoreSystem.exe
5348	CoreSystem.exe
2432	RuntimeBroker32.exe
2432	RuntimeBroker32.exe
1960	RuntimeBroker32.exe
1960	RuntimeBroker32.exe
2432	RuntimeBroker32.exe
2432	RuntimeBroker32.exe
1960	RuntimeBroker32.exe
1960	RuntimeBroker32.exe
1960	RuntimeBroker32.exe
1960	RuntimeBroker32.exe
1960	RuntimeBroker32.exe
1960	RuntimeBroker32.exe
5488	WindowsInternal.exe
5488	WindowsInternal.exe
5488	WindowsInternal.exe
5488	WindowsInternal.exe
1296	WindowsInternal.exe
1296	WindowsInternal.exe
1296	WindowsInternal.exe
1296	WindowsInternal.exe
1296	WindowsInternal.exe
1296	WindowsInternal.exe
1296	WindowsInternal.exe
1296	WindowsInternal.exe
120	RuntimeBroker32.exe
120	RuntimeBroker32.exe
1204	RuntimeBroker32.exe
1204	RuntimeBroker32.exe
1204	RuntimeBroker32.exe
1204	RuntimeBroker32.exe
120	RuntimeBroker32.exe
120	RuntimeBroker32.exe
120	RuntimeBroker32.exe
120	RuntimeBroker32.exe
120	RuntimeBroker32.exe
120	RuntimeBroker32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 4268	1392	b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe	92
PID 260 wrote to memory of 884	260	DesktopWindowManager.exe	93
PID 5348 wrote to memory of 2432	5348	CoreSystem.exe	97
PID 1960 wrote to memory of 5488	1960	RuntimeBroker32.exe	100
PID 1296 wrote to memory of 1204	1296	WindowsInternal.exe	105
PID 120 wrote to memory of 4388	120	RuntimeBroker32.exe	108
PID 2904 wrote to memory of 1396	2904	WindowsShell.exe	111
PID 616 wrote to memory of 4344	616	SystemHost.exe	112
PID 2740 wrote to memory of 3404	2740	NetworkHelper.exe	117
PID 2684 wrote to memory of 5668	2684	DesktopWindowManager.exe	118
PID 1400 wrote to memory of 4144	1400	NetworkHelper.exe	121

C:\Users\Admin\AppData\Local\Temp\b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe
"C:\Users\Admin\AppData\Local\Temp\b63d14c99f4b703073ea2fa57e3f582645311f2b9c45b42e0d5d6943aef9f2e9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4268

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:260
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:884

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5348
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5488

C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1204

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:120
- C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4388

C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1396

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4344

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3404

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\þÿÿÿ\UpdateService.exe
  "C:\Windows\þÿÿÿ\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 f7cb80d8e1e6b0ccfe0b9c679ba312d77f64f9502cff386933ba749d2dce13f5
MD5 b2451bef54b51146480cefc4cd76e63e
SHA1 c23e495150a7796292ecd495e2bf8c0d951792d5
SHA512 76ae8667711a688d7c3c52d3dd15ce6b99e5093645a6db2107e156f24e3d842fe471b645a4a38e83037750f54003a9bb3728454229e15aee57e893fef0b7b4e3
TLSH
T191E07D06077C40827767593499E144363460145F94685E1A291C4AC50E9225FD907101
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 e38bc244b11ec350a2a27887434969fef8687f880e6264327a2545470affbe19
MD5 ce5eda5a11319344be574f19c9a63268
SHA1 b978579bd05621abb1c4e0328ee87ec0a1d247ab
SHA512 699fd03e026ddd2f119e51a980fb354176c01f6bda3668c400b1250f799042c89dc29e12cff06a5687eaf9136f0783b651e427e12f149ccccbbd91c25dd1a062
TLSH
T16841B7D92A1C7424FF818F451CB9CA363C78F1D1D5C490B571FA48F12596FD02D5589D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 a68218899b1a409d5089df3894ec2bdd43f1b0947fb7898fcec41f15bcef9a8c
MD5 6f38a043dcc4b2214c6da350f88d8110
SHA1 02d6fd79fadf76013d173bc18f6cc4f3e0633fd5
SHA512 095abb2e0a9791447a6406f849b3df270c631361a965976d50058f9a7e665ea8746114086b3e77eac1acccff622875ff4e20fcb6bc2c69837d3bc7848ff1d579
TLSH
T1F6D02B1603BA5CF53E259C6096D0A074346354A733C75496501AC796651DE393A02144
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 097cb1d5941043c8a89dd917167e72da8afe265db468aabc9fc42e7836aa292e
MD5 f434165bc304136555779c5e56e751d2
SHA1 aa772894f661d3a3cf9e5fcaf6f897bbcfc1dd85
SHA512 b328b25ba640a8b072675780e1bc9ced378a70bbd491d042fa894ddd469abbe653c76eef71370af89766a876ee94e6fb5d4920ad3954f42ca2514f0c001bf650
SSDEEP 3072:2exbv7DO/fCoGUyRWWQeGbvHotivSzhBJbN6Odl:x5v7q/eDWpeGLgaShBJRz
TLSH
T1E0042C646DBBB5A35E4ACE624C99BA9612F561DD2012772F7E307E105C03ABFCE17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 7dd1ff632ddd6df8ebdf2bea038f358372f4d43ed9624a86ca916a0cf1c90287
MD5 17910262c69f48b19ea6220188a16712
SHA1 2836896bb7a343f84082ce5c209fa62e836cc453
SHA512 7d287245f7703f88985fb33d287b96a99ed98c5062f79ebe07d33e83dc46ea407a9d23cedd0bfd58d36bd957391aa2510c85f295c631a384c893ee058976f522
TLSH
T1FB1121865FB460D096F35260C7F8C9327C7464CE3CEA38D55C838896346A72D2B0543F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 d9d92bb5e0f4a161494ae9e9a8002f2a5223422e25337b493879d69afc780188
MD5 728e32bc104abb055bbfa2e2aabfeb72
SHA1 0fca357807d792d3c40423fb12ecb53a6b013a70
SHA512 552716b4359da19f09d14952a4ab8ff303d7d30800abec132be9ec23a4a1eef0a8c54edde11208de26e4d7bbd6097aa5ed744812647544ad1244210b5a62dc96
TLSH
T19841C7E72B1975A47E419F8B2EF8C73A1E3890E562C40C82B5B7C892119FF90591244C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 c4c704963206a54c462c862c1c2026116817abc6f2ff58e29ae14dc9844898ce
MD5 9de4439f608ada0264477bc501eedf15
SHA1 29b7c34da59617059a260a590e72e3c8768c7735
SHA512 11f41a93709692c0285f990c96ec6acd85a98d7d1f4095ccc0b089757ddd1988174f0102fd6e8362c7b98459e996fd07625e3191c95db85665598b77462bc5b1
TLSH
T1B4C08C1C6AAA0A06F2E8437C43C13E039B308501E2418F161FF16A48DA96B162838C6A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 402da56ce417eb67906138cdd1288b93626d0cf97739f9685514a09780a9895c
MD5 d344829149375ebbf8e14fab1e31cac0
SHA1 cb7ce9d7fd33fe959ce65f26d624834024c7f74e
SHA512 23f0f33324942d09e3e81464e8127ef4dfb6ddec64248d9206ff37bcb238057382ec02325f83afa5829dc40bf591b5a009bb47537ffe89c03b5e960ea7581f3b
TLSH
T165F0273C2ABC907DE5B7EB789BEA66529D18F116140801D82ED24A0A9A09E006C9143C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 60fad8f23dccbb9720dd33a78040aac407174ea30da1db1d710b44c3d1fb2b04
MD5 e114a52cbc6a0dc02ce61ff2c81b4604
SHA1 094fb7d26701a81ee4a679156e919d6b0b4fcf2b
SHA512 c90128dc89acc2f0cab5fa18bdb3f7f63e5bb196aca2774aa9c0ce488ff57556b3a83bd71f05d545e3d288a3b06695785d96da3c7b8df8a937fa3072ea529ec9
TLSH
T14AF061283FFA5076F077A57887C971B5843DF2DA7401257D1EB61B042E07F606C9110E
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 cf205cec21476d6c399634844e423bf73b760fa95679c86644bb3efecebd857f
MD5 304cf32cdc70779b65ffaaaa2f001cff
SHA1 551cb6b2baa9a6f07874c0d2eb852e57d1b65c58
SHA512 35c85936045979a34f979b8d7da3e3cdd50b5d9acf8e5f3f962625ac1e8156122de308eb8ba325f0df2e2c10feae787fe1223309787193261b403c6a86e716c0
TLSH
T1A2F0A32405BC4109F072E978C2E96D767D75F51678068BB6069742075A11F504D9311E
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 9c3985a6f75adc0b4022e8d2acab1a1887a7a0351faf3521fb584e5e865833be
MD5 52feed3ec7834c8d320ab139a749b8e1
SHA1 ea19cbf263945d41d805381fe9fde68504742b97
SHA512 72701919453c5fc42d62c3685f1285d24ddb0bb2e28829e3c0708427940025374139da572aa1135afee57f3dc8b674d1aa0b37656fa6e880951314dc3adc6f04
TLSH
T19CD0222827960212F16C937989B10A40EFA19903A1A2DB0C1FB3521E8828A092C5980C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 d90d0c8bc6a0d9a78ee1443ff4d6a91ba8b1fafcedbfde55a67c9a21b411d5b8
MD5 92fbb19b9ea02e29b03980987fbc511e
SHA1 35fbaa8a4fa91f5403228b66d85824f0e101a4e7
SHA512 bd03d081a317ab6a96ad7e1e158fd10282c7bd35e42b068c868daa98478941e94eca7828712559ba09256e8fd9c3512d5a0dbdb411f52e10efa6583d08cd2cc6
TLSH
T119F0A3240BE3016EE371777486F597D6ED65F2973504DC681AD10709F617F426C1243A
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 0ec8db156b088f904b3446e18104581f653f64111017e1dfb01bb2e0a9c20780
MD5 5d5890331576d7bb6a2d72165b1bfe37
SHA1 19310464db019768cbe876dad55c18b5e6a746c9
SHA512 be14a933144d5579b8984f61cecb286b8261e2fbba0e6e8b4b4893d669b505aef668b770024f0158b1faaa7b3b127502d2031fc4832df21aada1871bc88863e7
TLSH
T105F0AB3C30B7009EF632D77D03C122D74663E53B22097F6979A243086E42E427DB0A19
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 64c143a431e76e1c995bc9576ca39358ff396b401c6e94a1a98aedd2c354023d
MD5 fec2469e1bba54e99dce0cdd4eefe6d4
SHA1 febae08f63f816240d4b26aa84e66fe4cbf62d43
SHA512 3b7dbf6ea67de2ff03f3a0388c22dcd672af9076d0d21dc0ca4f8454d2864ef406f9aa0de4cab422c21ea11df193b6b31229c1ad95e472dd459e0b74e4cecadf
TLSH
T1D9C08C1C06610607F2E883B812C22E838A708510F381AF012AB12A08CDA4F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
Size 9.2MB
SHA256 61d7e813244d9309890c9c9d7589a46e8fbd55a1fc74919b16959e4530c97b3a
MD5 def624538be4bf13cd5a64297a5db242
SHA1 f7450689ed061869f792f6a4922512f559b474bf
SHA512 5c85a55a446694b16901478b089461b85a8dde75eba3024e54e148ab3d9351a2661cc63e159d46cab5c74e02218d562c633744ec97bde0b67986c9f5f67d69af
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx7g:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8Af
TLSH
T1B2A633EA785E5AABC20D5C798E06CD7378AC5BB1C7644CC3FFD57DB64840C921622E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
Size 9.4MB
SHA256 dead768f13c32ce4fb154ef6052eb29df82025588ecd5fd30c02789414904c15
MD5 43d69d10185ba23e7925c8cf2829884f
SHA1 f5e124dfcfc23726114e70f20ebfea5819ca30ad
SHA512 ad28bcd8e43cf2fc31e6544e4bc30deece5374884d7348b68ac9848b492fd02c4df59a13e1b680ae3a0b9f0b39c68ba23bf938b61fe8ff1b4a3e4e46137a7009
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx72Am:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8Az
TLSH
T1B0A633EA785A6AABD20D5C798E068D7338AC17B1C7648DC3FFD57DB64840C521632D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
Size 9.7MB
SHA256 6feaa45b6f0426cb98f7479a99ea1496e905aa16d26ce8e836b662acc87759a2
MD5 a72f9ea1fa2eb1574c5c4acfcc547a18
SHA1 20a21041c2e435cb63cebc0fc0b1313f9d34802e
SHA512 a14f4ed08922624d00855fe966be3e0fdef45a8ad7697785197e463d669dd2d11687ad9b06672c3a22c29dc851758f0dedf9cdad198d8a6780bd208b12707f26
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx72AV:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8A6
TLSH
T156A633EA785A5AABC20D5C798E06CD7338AC17B1C7648DC3FFD57DB65840C921622E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\RuntimeBroker32.exe
Size 9.3MB
SHA256 f50fe3ead1e11edeebf930e323ae35a59809de86ce34b92f32c60dcd7011a031
MD5 4f8affb3d00fc26a8f17b2e002630b17
SHA1 3751fa308b4ebe7fbcf8324b040f79b1ffc41e34
SHA512 6217bb3df7f5253130094129358d9484a3df07a0d12192492c8f2736dc11c2717dbd145b6e509e7c8b3f3bc63519c852c39f998223fc4d7fdcf4f2f14856317a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx70:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8An
TLSH
T1B9A633EA785A5AABC20D5C798E068D7378BC1BB1C7648DC3FFD57DB64840C921622D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
Size 9.8MB
SHA256 a6e8cc928393b1dac56d4245f8c22ee666e89b76fd275621cf27fd55621a803d
MD5 c924ad539d4ff23eaf2173843458b495
SHA1 5dfe3bf37d2ba98382c5548f73eb111ce25a8a9b
SHA512 f477b2689ad660578de76c8575362cfab12931e061d75e61774a86ca103d8003c0023318b5babd845ea3c3060b9049b4616bf79b3e0216ce620adafb57de6611
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx72A1:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8AO
TLSH
T1EEA633EA785A5AABD20D5C798E06CD7338AC17B1C7648CC3FFD57DB65840C921632E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
Size 9.1MB
SHA256 d87a01d11a0a4008fd3c9db28a2dcf79ebc2735f53073c09906062c310e5a68c
MD5 c30e6ef3ba8e918b06cca7766b4cb199
SHA1 f13169cfb67b05713d250b8b6bd645062e81d75c
SHA512 cc608e3f34a3715783ab0bb1b75e0a0e923a99821dfead7568e22039c57833286aac9287b7be70d276107c4429a08d0f6eef9d8b7deaed2751cafb92d9100edc
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx7f:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8AO
TLSH
T11DA633EA785E5AABC20D5C798E06CD7278AC5BB1C7684CC3FFD57DB64840C921622D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
Size 9.5MB
SHA256 930fe9cdeb2758d9296357b5a0725b1fb29deda75b56d8e8aec6df91098079ed
MD5 ea8c3abdec3805f105d7eac1110896c8
SHA1 789ceb5ca28fe641c1e6649ff21eca0d997ffb78
SHA512 02ae52a09e9230330a8f43917a9e2dab76915903d17c8e6aeac2a418e786a5785537dfebc10c9fc06fd6b99e36b36c842d9b03a7fe1ad76092fc95efa2b33722
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx72Ad:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8Ae
TLSH
T114A633EA785A5AABD20D5C798E068D7338AC1BB1C7648CC3FFD57DB65840C521632E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe
Size 10.1MB
SHA256 5f9d1439cddfeb921327aa0e1d21dff661749e9e470e629a7ede0bf618083e12
MD5 e80987e84dde3d510209b66821ead999
SHA1 a3377e5a408c84e446e6547a16f470ae8ea52f44
SHA512 f8fbff52a62c7ecf985933d7a3274062d6f6ebf884d789ddee1aa2b952d5c88d192aab76bde8ca9aa4ef1d71c6ca987b0d8749c7258217297012e34ae1ef92ec
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx72A/:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8Ao
TLSH
T160B633EA385A5AABD20D5C798E06CD7338AC17B1C7688DC3FFD17DB65840C921636D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 10.0MB
SHA256 93933f72ed91ed7408c26d3a87e3758a3810c779178c4464b170c744bcbbc693
MD5 0610de72910d5c5e381acd2e7ec24c69
SHA1 ec8b08cfd16c76d51007bfb8db2ba8cd59330457
SHA512 0bfad588725e286bc66b6ae8d4135ae81359fec92724636d391bb7060814840863c0140c0d9f7d090eb7dfd25e27e33c2d920f5cb006d188dca239e9ff7ddbc6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx72AS:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8AF
TLSH
T14FB633EA785A5AABD20D5C798E06CD7338AC17B1C7688DC3FFD17DB65840C921622D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
Size 9.9MB
SHA256 9fe2696c731650023348614f696308c5fdfcbfa25d23803354030e91476138b5
MD5 469a4eb22f62b70d2e7ea36daffcb498
SHA1 f63d2bc82d95c5cb5d31405e49ecb69abd09fefe
SHA512 c0edc736b0a1da45a473492503fed89447f3e951bab30806b16cde516870382e7dccfdcd47dd08550bf8f13372f97a37e27dc9a7228d15e57624a2f833d80cde
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx72A4:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8Al
TLSH
T11CA633EA785A5AABD20D5C798E06CD7338AC17B1C7688CC3FFD57DB65840C921632D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Windows\þÿÿÿ\UpdateService.exe
Size 10.2MB
SHA256 f383ddc3a68f47f207a223f69d202854da3204b53773ad2b8e5c4151384dec4c
MD5 48e94ba0a4a13764fda5d679daeb11e6
SHA1 d769007c18b88fd898421ea6e54ef3df9771f7b4
SHA512 fe460e87f05b0ba0dae28766349ec2b95970ee3f593e1c276fdbce3895e9c847c0677e5ec18ae6ce1fed3f852cc0abed65c08b317f3c483bf31fbeacc9612336
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFA8AIAvNDsWgx72A2:TDpbgBr/4QAMQMrEGRONY/4VLjl5A8Al
TLSH
T111B633EA785A5AABD20D5C798E06CD7338AC17B1C7688DC3FFD17DB65840C921632D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download