b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
Size 10.3MB
Sample261003-snbpda1fjg
SHA256 b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd
MD5 0e341d52b0df84d6d91df1077937db2b
SHA1 c9c9c1b7886a71df6d6fdc7791f50b633e269eee
SHA512 fd3a255823c1196e933997b02ea7fe155114f3854c31308f398f6d86fdf0b4145362af2b69b42e7b1f15dda841ab0d019998eed9ddfd876aadb34656519937bd
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBe:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQr
TLSH
T1BBB633E6785E2ABBC10D1C798D568D2339AC57B1DB544CA3FFD53DB60900C932B22E62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5472	WindowsHost.exe

Executes dropped EXE 17 IoCs

pid	Process
4668	WindowsHost.exe
5472	WindowsHost.exe
5160	RuntimeBroker32.exe
4968	RuntimeBroker32.exe
6132	DesktopWindowManager.exe
3084	DesktopWindowManager.exe
5128	WindowsHost.exe
3288	WindowsHost.exe
3052	WindowsInternal.exe
5252	WindowsInternal.exe
2040	SystemTrayHelper.exe
3872	SystemTrayHelper.exe
1256	DesktopWindowManager.exe
5116	DesktopWindowManager.exe
3188	WindowsHost.exe
4484	WindowsHost.exe
992	SystemTrayHelper.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsHost.exe\""	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\DesktopWindowManager.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsHost.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\WindowsInternal.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SystemTrayHelper.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsHost.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\DesktopWindowManager.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SystemTrayHelper.exe\""	WindowsHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 16 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
30	raw.githubusercontent.com
44	raw.githubusercontent.com
52	raw.githubusercontent.com
89	raw.githubusercontent.com
123	raw.githubusercontent.com
1	raw.githubusercontent.com
26	raw.githubusercontent.com
102	raw.githubusercontent.com
12	raw.githubusercontent.com
41	raw.githubusercontent.com
76	raw.githubusercontent.com
79	raw.githubusercontent.com
92	raw.githubusercontent.com
49	raw.githubusercontent.com
63	raw.githubusercontent.com
114	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c425-27.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c426-98.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c429-133.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c42a-166.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c42d-201.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c42f-235.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c42d-270.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c430-304.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c42d-338.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4732	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
4732	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
4732	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
4732	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
4732	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
4732	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
4732	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
4732	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
5472	WindowsHost.exe
5472	WindowsHost.exe
5472	WindowsHost.exe
5472	WindowsHost.exe
4668	WindowsHost.exe
4668	WindowsHost.exe
4668	WindowsHost.exe
4668	WindowsHost.exe
4668	WindowsHost.exe
4668	WindowsHost.exe
4668	WindowsHost.exe
4668	WindowsHost.exe
5160	RuntimeBroker32.exe
5160	RuntimeBroker32.exe
4968	RuntimeBroker32.exe
4968	RuntimeBroker32.exe
4968	RuntimeBroker32.exe
4968	RuntimeBroker32.exe
5160	RuntimeBroker32.exe
5160	RuntimeBroker32.exe
5160	RuntimeBroker32.exe
5160	RuntimeBroker32.exe
5160	RuntimeBroker32.exe
5160	RuntimeBroker32.exe
6132	DesktopWindowManager.exe
6132	DesktopWindowManager.exe
3084	DesktopWindowManager.exe
3084	DesktopWindowManager.exe
6132	DesktopWindowManager.exe
6132	DesktopWindowManager.exe
3084	DesktopWindowManager.exe
3084	DesktopWindowManager.exe
3084	DesktopWindowManager.exe
3084	DesktopWindowManager.exe
3084	DesktopWindowManager.exe
3084	DesktopWindowManager.exe
3288	WindowsHost.exe
3288	WindowsHost.exe
5128	WindowsHost.exe
5128	WindowsHost.exe
3288	WindowsHost.exe
3288	WindowsHost.exe
5128	WindowsHost.exe
5128	WindowsHost.exe
5128	WindowsHost.exe
5128	WindowsHost.exe
5128	WindowsHost.exe
5128	WindowsHost.exe
3052	WindowsInternal.exe
3052	WindowsInternal.exe
3052	WindowsInternal.exe
3052	WindowsInternal.exe
5252	WindowsInternal.exe
5252	WindowsInternal.exe
5252	WindowsInternal.exe
5252	WindowsInternal.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 5472	4732	b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe	91
PID 4668 wrote to memory of 4968	4668	WindowsHost.exe	94
PID 5160 wrote to memory of 6132	5160	RuntimeBroker32.exe	96
PID 3084 wrote to memory of 3288	3084	DesktopWindowManager.exe	101
PID 5128 wrote to memory of 3052	5128	WindowsHost.exe	102
PID 5252 wrote to memory of 2040	5252	WindowsInternal.exe	105
PID 3872 wrote to memory of 1256	3872	SystemTrayHelper.exe	108
PID 5116 wrote to memory of 3188	5116	DesktopWindowManager.exe	111
PID 4484 wrote to memory of 992	4484	WindowsHost.exe	114

C:\Users\Admin\AppData\Local\Temp\b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe
"C:\Users\Admin\AppData\Local\Temp\b253d5a2467166be09ce56e9388246880871b72bf276c768a9ab69fbfddcccbd.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5472

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4968

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5160
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6132

C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3052

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5252
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2040

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1256

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3188

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
MD5 eb444c59d03b1567ebbb5e58480a6eef
SHA1 e638b0d4f8bc77cb263d4e561ca3cfd1e286432b
SHA512 43cc6537c3b42c6a520ad798c7d57f02e3a6770d08ee501ac16a6db81365e6c09ba75a15d2b614b2b19ab3d667c9753a671c6e77a54797011705393da73686f8
TLSH
T1D9E0721A362DC0DABF6A49394A6250BF78A1008F00CD855A342C87F84C8262F9F0BA08
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 749860344f94a12e314cdb27fc86b31285596137f12714a6443e366934020d67
MD5 4579cccb20eb53d3f8634118c8b6d128
SHA1 15cb3605bea7c55aa1d417108cccc1313b690090
SHA512 202a34939f16e742a9ed1159f684cb0fd0e2572c158de7fc5600aff8059b8cc8476764f61ad56f55292876199ae82a6863861e141ff788b83c6b10e2c708258c
TLSH
T1DC41A3DE5E2C7464FE818E451938CB322E7CF9C5E480556E70F788B270D6F942D4A88C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
MD5 32d66548cf2a8f1b6b0ab9d6c335806c
SHA1 69e42d1c9f5e7760749da4331591e196bba4b81d
SHA512 f8d7ae900b29dbddb66293c320367f3b4dc41ecd372baed0f690bd657d8d92c77f8dd5cb3a10b7d93e1b1d7ed2a90c12d3461dde8845e2c7eeef1ff2c3237842
TLSH
T1A3D02B1D15F56D137E27991487E8E56174651A2713D0485C14498677A8015E9194F704
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 abe3e0f4688d4aa9ce35d9ac4da33eabe83049d06581f10d0647254a32e54280
MD5 9fa5790f8352068cfa0cfbd31bc91a9e
SHA1 59c100f890ebd946f7ceb0bb97c502f1c30cbe2c
SHA512 1ce07597118adfe1a07645fa91941515f9ab49d992f3d2f3264e25b660ae5bbe6ea679ec8bc75128326529a2a240d7b6e67d18a5a2949bfb4fbc97f03d1e6e6d
SSDEEP 3072:vtZR/ECXHwcAvW9wAQlHQti4XbqMYeCK6SduA2:vtf/DkvEwASo5rqMYPAa
TLSH
T12D044C542DBBB5A35E4ACE620C99BA9603F561DE2112771BBE306E505D03ABFCF17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 8c7602efe22cb85666dfca8b597ad0f33617fdd861c8bf7e951c305dfe59b3dc
MD5 de10d5794ceacb41f46aacbc68d07747
SHA1 167aa5e4fd0a87215579791b0bcfa181d7848ada
SHA512 6d7a173bbe00ac650b201daa93ebc17e0d4f345d5d321643ec500a76356f2e300ca626f3a414321e9c09eaf98258e5ef52c5f87cbb2b8a6d52d7636bce097323
TLSH
T1131121865FF4A1909AE356A0CAF8E1367CB424C66DEA34822CC688E2245776D7F0443E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 57c2ac700d8b52ae8edcdda9ac8069ab4dc4ea1233a73844b32803889da2b052
MD5 dc91a314b321d3f0620ef08ba37cec78
SHA1 a4d798cb12adf028013c556a5d39a2c6f9ca1cc5
SHA512 ef5f8e8bb04683a69768312f846bf5c846e2242e64c0695ed4215e7f17b8a9e221f6fe5d8abedfcc8a8c7343deb16d144b5fb993d618b391b2d1afb80acf823e
TLSH
T1974109EB5F097428BE06DF8A1DB9C97A1D3CC1B4D2C40951B4F38486109DB866C0698D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 ddf5117a7e298e901a19f19e5830dfad83519968359c39899abbc787bb722b1f
MD5 437fb413044d15267e9cc7fd19bb7590
SHA1 6347c5027bcfb0994e776ac61831047c2e509596
SHA512 531c7f108ec496ccbd34a5569ac03d3e537a45a3ef35ec4cdcecea9e6ea440138780859a872783da59001ab0d067ac6fb9c465cbcb8a65c2919afdaa58e7ffcf
TLSH
T127C08C1C1EA34A06F2E8437C62C13E03AB208101E281CF091AF16A08C997B162838C6E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 56c4c2ba2d7705e0f72af3ecf22c333fe49f52e098cf786855735d4836426a5d
MD5 ba3031979a5191976d0501192753a841
SHA1 65defc92c160db3aedb1f3153d343329f655a23c
SHA512 646f9734762228146782542c9603f3c222adc167371e611b9665fbf337aa2ec6ee4f4b0851ae503d5216d764fe1ad74888c2b362ebe67fbaaa9075d503cc826f
TLSH
T1E3F0553C12F8805DE072EA799EE5A2D96C14F123380889AD4EA04B48AA02F005CE253E
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 5d1d6ff2475483e727383d8d7a56021a5ce504f5bb3f0eb040725c1d9f106a9b
MD5 53b631a2b2199f735091d95c307d5470
SHA1 ef1e56c587b14a00db1591b4b24ae058e479c73f
SHA512 a92e2abfc9b1f845c94cd0eec6054f53c77d1555a4d2a34052809a50b84a0836d9580a521884edc3b8bcef6a02d8e7e516fa3ba4333a0427230f54e82200fbe5
TLSH
T143F068583DFF823EF0339E345BC670B6CD2EE2272002AAB4257213082B10FA0AC51B0D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 e51ecf5675e9963d0ca6d029129dfe16f5fd674b7fa11a5d387cf617071044c1
MD5 9ab6618da375636dca44cda39098ca71
SHA1 47ab5fc37d375129ebe2afea642a3c8883cc84cb
SHA512 409531e2b414e5bd4ccd3fbae5262dd511ebcfa701a315d5b7c25d2f53349f768959ef432355073939065acee1ac92d470797f30561231a78c43747214a59dbb
TLSH
T121F0AB002CBC006DF4B3E9B4C2D125B6F936F1157C04C7F60BAA03425F62A010EA312F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 9cd10aff65443981ec6cd91f47f068ba60308d6f19acd4dad45354e4efa1ae9b
MD5 915825bb283b142551185204d7250026
SHA1 4837e87f2c867568a24afd17fb0fa19dead0d920
SHA512 69fdd78f6f116bfae4f95ffe4ef687860d4f519a0970f2d969b0097e3be2debcb621f47457f3893fa2fd8eb50c00d2eaf040e8579aa853848e36e10b4cdc881c
TLSH
T108D022206F1502F9F0B5663BDCA00582CEA05522F0D24B8D6B60026D042CE010E3080E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 ee4bde65cb60d91fad6e05e0d7bac13d2966e0ac6ea63c6b9a6bbfd2e75e254b
MD5 21403a84c11155a790677b821c41fe2a
SHA1 dfb5992728b51bf84bcff750b8e90db22db3e3ab
SHA512 eabefa4a3d86755dd7ede6c790f210e306000fa1db74c8b46f67d9fada87eb22db6ac294afb0b460f355d135b9f51496013736258e1151d58573cdaf2c7c9e1d
TLSH
T1E7F05C342ED2016EF672223D8DF853A5D904B7053405C45915E20B09EA67FC01E9283C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 1bc44dd8a300e814ee180a61c4cf88b1044faf29aa52c87b24df8152ad0cb3bd
MD5 af237941bd1956fb20c84d0ad3d3d5c0
SHA1 2b9598a013d485a2c9c8cb43f550d5340edc0281
SHA512 7345e5b4bb8cd899d1015501dbbbe7977b1997fb0083f6f7213beafaae7cf376cfd91df824db4a0b8acedffce3e19dc7c6d5d4d94932fd4215cc74503a179ccd
TLSH
T118F0236C24EB015FF533DB7C42C622D54927E37321451A55667243055D05F40BDF091E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 abcc70b565a71af70a6dc4e71807818f12028264bd752ca3515b93512377b325
MD5 9ab4b90791d716aa1233e5c3b070b12f
SHA1 60f3a8664dfb942db424619752c018181baa5042
SHA512 6faa21662efec079945d8d5e188fd66c36445885ec5809c227a71faa1f37cffb51155a74236e05f921fb73db99f86f6e1cd728a9f344f8ed6e6db6b78bc9a1d6
TLSH
T151C08C1C0A62060BF2E883BC12C22A838A208110F7829F2526B12A08CD25F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
Size 10.8MB
SHA256 463eeaff197ec93919eca9cb3c340b76a69910efdbae3b536f0d2a8d2ad387f4
MD5 c11ca26847717e05ad112ab8a07beda4
SHA1 e7894baced8b7e1311d8071177cbc2f95ecc0478
SHA512 e93f20a8b596383c64ee37d964d3b3a7aebd6abb0da7f1e1acc1a16b3b515bdc07ecf34031787e3d5eed9495e5bc6c456bc0704d306ff8651de4981e9e5dc65a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBD:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQM
TLSH
T131B633E63C5E2A7BC10E1C758D4A8D2379AC57B1CB545CA7FFD53DB60940C932A22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
Size 11.0MB
SHA256 1fd90879e0d0cb2d15a480704007efa185cd22ce2577aac7dd194c25df4f1d81
MD5 a4189280d15fc7da824618374914e8be
SHA1 6e671935485f94ab5bfbcf8a5980943242956244
SHA512 b2cd9003b8a0e69cf7b71ebc0991283d688b738c55b596134ec5710bcbd35f5509ca57e37a98d99013096bbdfd0b44f49f682b543d3bd77af77e3bfe3f09dcf9
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBJ:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQG
TLSH
T129C633E63C5E2A7BC10E1C758D4A9D2379AC57B1CB544C97FFD53EB60940C932A22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
Size 11.3MB
SHA256 911a10b7937ccaa5403e752cadef3e220c67ea996816b9f8d99d7fe81207d05d
MD5 8774698063cf16e0f8aae6ceef64eae5
SHA1 3545842090d80deaacb7147ffa0d81237c79bb11
SHA512 8c7634a3efbe272a5ff88cf0c97d6db87f07f36ae6e24207a1ed48c10d9fb0c81e88d6fe2b6ea39731e93a5271220eeb7a1bee4d9cc50cf7edbd7c1bf1c2b593
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXB6:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQD
TLSH
T1DFC633E63C1E2ABBC20D1C758D469D237A6C57B1DB585C93FFD53DB60940C932A22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
Size 10.6MB
SHA256 5cf09c7c5e636aa64057825b8c442003d75b4ea80afafa203389660058a52bfb
MD5 ba2adddfaf14e9ecba78c177b248e015
SHA1 0241702065edfc9f044369a1873e632df45a48c0
SHA512 8b2b8d1a6d7168190b140e52002d52c01439df4763d323e0e0478f83f890cbdd05da3ab84a90b3a0348eeb05bb9e6d0cae25d2ce3d575a664f7411d738c6456a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXB3:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQ0
TLSH
T19FB633E6785E2A7BC10E1C798D5A8D2339AC57B1CB545CA3FFD53DB60940C932722E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
Size 10.7MB
SHA256 1fba7c3779d4669e018751904f8cb55ee0836a9dd4d9d5402e2666f49ec8a61d
MD5 8b8b40dd0bfd164e45de399a8e80ab4e
SHA1 8b532214b7bc58d706d235e637d716b470f056dc
SHA512 906bf3d6f8f8f93398e8fdf464c71070a4cb92e5bb74e2aad9a9c6492c414f6964a3cc3f0ce427269a23f9dddc585c7b1879942d0f1c59387db8929f903dc620
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBi:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQr
TLSH
T138B633E6785E2A7BC10E1C798D468D2379AC57B1CB544CA7FFD53DB60940C932B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
Size 11.1MB
SHA256 8966dc7b6213d93f8f27afecc2e255fea26f6f40d20455098b02b16df5a703c1
MD5 99d29fd61da46dd2b1d946cee6f0c71a
SHA1 0bba48edc7e4b61efd370b3524fb4d8f3303a794
SHA512 675fafd179b39c7053844b2719a542cc74ca927d51510919745cedb1ea03d56b1fdfee69ce378e8fabadb878c3b60d8d75885559417a92fcce8bdcb85429c66f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBK:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQl
TLSH
T126C633E63C5E2A7BC10E1C758D4A8D2379AC57B1CB545CA7FFD53DB60940C932A22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
Size 10.4MB
SHA256 521d46ff57c276f56641d83f2305ad2af4620f54919d5e3d9124db3dea136e8a
MD5 78959d686f83d7f00bc20e038fcd1c9d
SHA1 a53da0c2e164e9a0a442e330b8605db4b711dda3
SHA512 3cf61901595216b1750ff4fb2f483b05747d405c51ad8c6b1ff1f86381da72affa77ac7ffc0f4b5d7efa2ea45c8be4776ebaf6e52b7bd5e33a2a393ab482988e
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBR:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQE
TLSH
T130B633E6785E2ABBC10D1C798D568D2339AC57B1CB545CA3FFD53DB60900C932B22E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
Size 11.2MB
SHA256 5edf2bcca9990f1a812e1f46037069d2b86b5a2e8a40cd6ee93115681007db79
MD5 bbf90d5415596b62d410f4c985ef5c80
SHA1 6c54796214e104c7354b7b458b2886dd006ac791
SHA512 2637872a7a523b26f5d51e55ccad9ed6ab0efc1600544f940bccdb816cc260d3adf4310ca6150689ece24d97f04ffee29714c6a4e4f9c2c822aee31e44da760b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBQ:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQz
TLSH
T138C633E63C5E2A7BC10E1C758D4A9D2379AC57B1CB584C97FFD53DB60940C932A22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
Size 10.5MB
SHA256 3448b6376c84027a9bb69d6848972c869901c17682d16c90ab968d6cd39cc339
MD5 59fb944bc52ffa4c3ef96b12d95b5f7a
SHA1 8f694d89154ed6191d1e9516c2ba276b7efbac8e
SHA512 50fba2c389536e1ba706ab9723599d883375b7fdbc6709f7bd248e723108b5a1a0a877c366a76e995f4db768db4c24cbaff8bbebdfb5b8fe06dc2566e703a079
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBL:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQE
TLSH
T1DBB633E6785F2ABBC10D1C798D568D2339AC57B1CB545CA3FFD53DB60940C932A22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download