291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
Size 14.4MB
Sample261017-s52bcswtcs
SHA256 291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a
MD5 0e2379805caa4ea0b4677d688ed75dba
SHA1 26c766cc1f9aa1a58e478d3910731c4260bf7a21
SHA512 02f9e47128697d80f8ff0ca1683d14a52be9da7b4288db689a6eb01bdcd36e0477efcb977fd4715ffb0f93254c315efea123d89b3c269d47ead878d670225ede
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLMDWGGGwukHLa89:4JwMrcMGrraA
TLSH
T1AEE633B97C1E26AAD20D0C7ECE45CD6635AC6BB287149CD2FFC57DB54810D622B22C27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2484	DesktopWindowManager.exe

Executes dropped EXE 11 IoCs

pid	Process
4596	DesktopWindowManager.exe
2484	DesktopWindowManager.exe
5660	SystemHost.exe
1388	SystemHost.exe
1200	UpdateService.exe
2512	UpdateService.exe
2476	DesktopWindowManager.exe
4164	DesktopWindowManager.exe
4104	WindowsInternal.exe
1204	WindowsInternal.exe
3208	DesktopWindowManager.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\DesktopWindowManager.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\WindowsInternal.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\DesktopWindowManager.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\DesktopWindowManager.exe\""	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SystemHost.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\UpdateService.exe\""	SystemHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
26	raw.githubusercontent.com
33	raw.githubusercontent.com
43	raw.githubusercontent.com
55	raw.githubusercontent.com
65	raw.githubusercontent.com
68	raw.githubusercontent.com
85	raw.githubusercontent.com
15	raw.githubusercontent.com
81	raw.githubusercontent.com
94	raw.githubusercontent.com

Detect suspicious telegram bot 6 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c4ef-26.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4f0-69.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4f9-107.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4fb-135.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af5-170.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016af6-204.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5216	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
5216	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
5216	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
5216	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
5216	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
5216	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
5216	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
5216	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
2484	DesktopWindowManager.exe
2484	DesktopWindowManager.exe
2484	DesktopWindowManager.exe
2484	DesktopWindowManager.exe
4596	DesktopWindowManager.exe
4596	DesktopWindowManager.exe
4596	DesktopWindowManager.exe
4596	DesktopWindowManager.exe
4596	DesktopWindowManager.exe
4596	DesktopWindowManager.exe
4596	DesktopWindowManager.exe
4596	DesktopWindowManager.exe
1388	SystemHost.exe
1388	SystemHost.exe
5660	SystemHost.exe
5660	SystemHost.exe
5660	SystemHost.exe
5660	SystemHost.exe
5660	SystemHost.exe
5660	SystemHost.exe
5660	SystemHost.exe
5660	SystemHost.exe
1200	UpdateService.exe
1200	UpdateService.exe
1200	UpdateService.exe
1200	UpdateService.exe
2512	UpdateService.exe
2512	UpdateService.exe
2512	UpdateService.exe
2512	UpdateService.exe
2512	UpdateService.exe
2512	UpdateService.exe
2512	UpdateService.exe
2512	UpdateService.exe
2476	DesktopWindowManager.exe
2476	DesktopWindowManager.exe
4164	DesktopWindowManager.exe
4164	DesktopWindowManager.exe
4164	DesktopWindowManager.exe
4164	DesktopWindowManager.exe
2476	DesktopWindowManager.exe
2476	DesktopWindowManager.exe
2476	DesktopWindowManager.exe
2476	DesktopWindowManager.exe
2476	DesktopWindowManager.exe
2476	DesktopWindowManager.exe
4104	WindowsInternal.exe
4104	WindowsInternal.exe
4104	WindowsInternal.exe
4104	WindowsInternal.exe
1204	WindowsInternal.exe
1204	WindowsInternal.exe
1204	WindowsInternal.exe
1204	WindowsInternal.exe
1204	WindowsInternal.exe
1204	WindowsInternal.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5216 wrote to memory of 2484	5216	291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe	91
PID 4596 wrote to memory of 1388	4596	DesktopWindowManager.exe	94
PID 5660 wrote to memory of 1200	5660	SystemHost.exe	96
PID 2512 wrote to memory of 4164	2512	UpdateService.exe	101
PID 2476 wrote to memory of 4104	2476	DesktopWindowManager.exe	102
PID 1204 wrote to memory of 3208	1204	WindowsInternal.exe	105

C:\Users\Admin\AppData\Local\Temp\291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe
"C:\Users\Admin\AppData\Local\Temp\291aec60c50228bdce7a75f426680ed6ba9b41c7593ea8be3325e05d3bb0b56a.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5216
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2484

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1388

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5660
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1200

C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4104

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 312B
SHA256 f81c4d14e873614514725d56abd8f0be34b6f5d4477cd74ca95c932b5983b14b
MD5 0227e28c5d089b59e4d0861b677bd89d
SHA1 7cb7b790d9d3c5abb7127e2c4e472490554db2f5
SHA512 53f9b98fe942c6cd7ced07851b93000da0f866d115b17752fb3fabc8da3ff5e238e07645bf902f960d7da00b809e0f5b63bbca0dd63c4c3ba2236eba97c42989
TLSH
T17AE0E716F70D58943B76CF5DCDA1196F7C73301950C44509282D54E44C031E64407498
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 86b679f1f8035cd88e3c9c3e26b63b003698329e747ec19286a81664dd786c9e
MD5 924bf4aaa8e1d30334b83c353a4e69b9
SHA1 7a7d8f6638446d449bde485644e4e9de1769cebc
SHA512 7416c21cdb0a2a9c83cce2cd471559faca14c5b0b225f391473439bed69becd7d7131b336afeaa36da893a7b1657a9e38c2993ccf23160a09c9e0ec0e5476915
TLSH
T11E41D7DA5B683058FF828E858C7CC6322F78F1905988951E36F784A2249BBD01C0D49C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 97e8275b1265f18faa1c822b003da554dc4f197c3ef7e8d7b4e6f954a57592f5
MD5 51247251ca18ff9d40f011c533b0831c
SHA1 df10b4463b52638d64f3a534e7206be9b92754d5
SHA512 123959014a85fbb83f01c1f726852ded60a542a1e45c0544d6dcd522c6daca513b378fd40f99cb6dde38e0d66b02238a8dd3e3d91a4b23731976d0a4914a7eda
TLSH
T120D02B16C2BD24923D63DCA1D981786570B39A7A63A6551A7498801A9806AEA1D09298
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 185KB
SHA256 2c2b4b2be636e0facb2e873d8f69107845fe3d5febb267ff8f7c6c6ea7fa4452
MD5 5c456360220c3759ba09794d5749c324
SHA1 43085fb80d33662edadd1364b8ed6a3e8e1f6646
SHA512 29a0882b8fd520e134b62ccd718014ebbb667471671eb6480acfdb88ccd3c0d41afd0b9c818291459f15f688aeaf9770abff983431721cf0591243a83205bc00
SSDEEP 3072:l3O90GlXxqzrYJNGuP7L4Cxe1YMM10RKKZGWgzyuJX:tOnc4jGuP7L5xeT3r4X
TLSH
T11C043D186DBBB1619F4ACDA24C9AA95E03F571DF2312331B4EB76E901D43A9BCE0744C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 975B
SHA256 a1328c11e932d7278405f5dd8c9ef787b794d6da33d7b3cfa9f36595d7b7e127
MD5 2255d39360f7c5be95cc56579b4ff63b
SHA1 751829b64978194df35e348533e76ddedb7cdb8c
SHA512 446bab42f89badbd7507032a6c1a68d4ef164ae9925b9e1d1aa221ccfd67aa1d71a384e97628267004b22f02fad94bb878c6aecf4a6adaa8ee07b4e0c133a92b
TLSH
T1901102829EA8B0515EE756A0DAE8D5217D75748528EE34911CC2C492385676D1F0403E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 2c02d02c83e21f1bd426a7e82d8a0022d800bcf01ea12e238ceeadaa9a561780
MD5 f12b6f948eabf191975da398787daa93
SHA1 04cd30a90305f763a31a024c6ac7d68d38c1988b
SHA512 5e1c08e747cc53a237f24ab5db1e107c42ab89e7731b77f60d24e3530ef9966f7ec6243bd38b17de1ecf90a1be55d4aafff354423ef214a6aab3fcad44494c14
TLSH
T15B41CAEB1F4A3464FF868F855D78C67A2E38E564A144494276B6C89100DE7961D0688C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 6fe79250404bacf2a0180c22cd8215ce0e628cb14783e5bb568bbcfe208b4215
MD5 dbbaff317a91c39a483416aea6044ec6
SHA1 dc151256ac675f319dee81ce895589a3a3319253
SHA512 674d24050f90d85b79c187497a9224d77bfd8162da142dcf80c5970e0506df0667bda77fcbd37fa7d53f85b9c2ca11571bf25eec961b4390e20369cb075f0484
TLSH
T197C08C1C1AA24A06F2A8437C12D13A03AB208501E6818F051AF12A08C9A6B162838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 33242b6f1c0b2fdfa6889b1b52f6416d35154c17c77bbfb9253494cbde0e6d52
MD5 1cee31e9ddb682bce335881adffd2193
SHA1 0cab02459417c3ec250ed6a01fd9d117730fa3cc
SHA512 a128129ca21773c5ef05273125500da4b01c1ceeff68da70baceda3e313601d12658c11e3fae4b70665b89350f5a9e56e0eaa57f0102a98fd86e8b7fe6388b03
TLSH
T116F05C3C2AFC857DE0B3DE7C67D8B7D25E15F1163404059826D24B08DD40F002CD1438
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 62771602a9793707636768c591ab65455b2c90edecdcbd2857b250ef8c765d19
MD5 788f06450158c59ab10dc902835a70c4
SHA1 9a0d34c37f3e3798971f4c93389ae9dadfb7cd3b
SHA512 b03f74fa7b4e0a1bc10c2b9dc16d5c7ab687ce6f8e63f42b1571e640ce01b85986a24d2b7e91b29a604afd2998a3b348d9780077a7a27f96001b6fa2f0585077
TLSH
T1B5F0683139FE527FF8336F3853F16171286AB29B30061BBE267527047E16F102C8020A
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 c85f616fdccee948069c608e4a72ea6baefb82c0d143e10adcd28b2853137195
MD5 5ce6cf0ece2ce8ea45743228e0ba0266
SHA1 f272b7cddac33bf181b98a4d67b43a90af5285c5
SHA512 b7dc532501795e49f60dbb5edf7ed4ee00bf6e5b7ee19af1e926d70d13089066aba72fda0ac602eb43ae1a24471b574f0a53dfab9f60f944503bcfd157b7b836
TLSH
T101F0AB18057C006FF4F3F8B9D3E426BAF635F01674069AFA86D70B069A01A502C51A6F
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 4f47ade394e8ff936004aa1f4b64bb4ac612fbb786e749d50b6f4ac47dc750d7
MD5 aaa694c872b4e001ceb19db35ddbb609
SHA1 d30378db800df7cfd395cc515d14ccebacc3facc
SHA512 09f281e4a06490b4c3427aafde6e1e4af728c9729bf23bcc19a754e79c378e89147443f871ea28b97f94656ac02a354a05b439eb27fbb6f9a478c8b5e0a2f598
TLSH
T16FD012240F350373F076E63E58A04B82AA909955E5D29B952B67475D9C1CFB01CA0D0E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 0ed108a60bd52f21e314be6f8ed68b3af8442c52c029ac859edf90feaffff86f
MD5 4888bb03861db6a15fba14460bce65eb
SHA1 f36ba9e78e41171508381662511726ee8ada95a7
SHA512 8cb6910c5b54ba6deec2d7e285afac5f7fa47d68c851fb7d0a5ba7d2f25f58c1f823538a3c019bbab537b7d390911c3edff7305745780b2b8da66244a72ad298
TLSH
T1EDF0A33C0AD6402EF230237449F453E59805B31B7444CC652EB6134DEE07F405D12638
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 e4c046cce1276c47f92b2a721f261260f7fe9054bafb7ae806c609d4d4426452
MD5 34a297d08034b41f7a54cf9f1c922ffd
SHA1 a2a1cb747863c7167b9ab7fe73b19cb84ad6c947
SHA512 ae2d2b9c9bc4cebcb6ac76edb856baf7a838464b836058c75a9bee646fb3a7e5567d0c1f9f0862e351d6da4ac7824dcf29897c93e1f52a548cc5af82f8373a2b
TLSH
T1F2F02B3460AF014EF172D6BD83C151975A23F13733086BE9766153491D47E51A9A1B12
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 ea24d5a9820fa9769c3169ad80dc1e8d503e6054610917e3914816087162e399
MD5 e455b6cd68b399f8c465f3e02184662a
SHA1 c3e4fa9a2313aa594a9c4a129c785ff9809bd13c
SHA512 c1b4ac2ac4ad3762b9d7b37becdb3bcbdaaca9671d9d93e9702acec5bc825cd61115e881d41ddc2d44cb2f54767d8a1ab15e3db4e7458f55229deba4eae516ff
TLSH
T183C08C1C06610A07F2E883BC12C229839A218110F3819F0126B13A08CD24F132C34C29
MD5 SHA1 SHA512 TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
Size 15.1MB
SHA256 eadbf234491988737e528fe1588a0bb4983ea8834d432e4b28fd2e9dcb6d81a4
MD5 d98c4ef44c6e819326f35fb92686d8f2
SHA1 d3a58dae988be1f53794c9afc85b7cd129bd081b
SHA512 e84f32902ff1a43f83050ac386cc2972783380e70fd3ed53c7c131abbd3ce70bfcb9fdc86a4e44e0bb313a02b5bc0c255fd48eddf577334813e94e68a79412d6
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLMDWGGGwukHLa8UaSn:4JwMrcMGrra0G
TLSH
T139F633A9BC1E26ABD20D0C7DCE45CD6635AC6BB2871498D2FFC57DB60810D532B22D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
Size 14.8MB
SHA256 000047fda441e077dc013a7b8ad562b9163a3bba6f5b48596a3654d73c29fb28
MD5 bd46ad0b8571ffc3f2e2f5d7a097d616
SHA1 f35357bd222034572cee06563290dce90bfa4d77
SHA512 fddb1ed3dd2716b240c9830ee3ddd7f20c20f1ab0e11ff6a65fb98fedce61eec3092a0c499c9350e64d4ca307e0eb2c43986a10033c2af46a9137ec0d6616bff
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLMDWGGGwukHLa8UaS9:4JwMrcMGrra0+
TLSH
T11DF633A9BC1E26AAD20D0C7DCE45CD6635AC6BB287149CD2FFD97DB50810D522B32C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
Size 14.7MB
SHA256 4f5beaef11bc43674cfcfa3d4ff108f4411441ebb46896bb88fa477eae4996df
MD5 b8cfb39887b5102ade725224559ca996
SHA1 4ac96210fddc83ea210db4bd6a6ae1ca1372d313
SHA512 850317921cc6fd20b3c3f6ef368361fda23bc7023a0cab8de044e300e8563ecb8be5d835e2d219f10c60d83fcd538f7f6c1256d0284ee474b3177cc0a8b3074f
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLMDWGGGwukHLa8UaSR:4JwMrcMGrra0O
TLSH
T107F633A97C1E26AAD20D0C7ECE45CD6635AC6BB287149CD2FFD57DB50810D622B32C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
Size 14.6MB
SHA256 481b8a7e9577f387dd839a364259dbc9e357638827ddafb0c06773e3bb728286
MD5 ba7a8cea5de8d9ab3d998e775418b93f
SHA1 b368553a446dd6efe1ee06c849951b8f9214757b
SHA512 35306bf0985160959492dd27f9a5d485362c60259d04f1dd703d619e32850c1caa62bb5e09f3643427b00aa9fa93a3ee81cbda3caaba73767ced195b2127a310
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLMDWGGGwukHLa8UG:4JwMrcMGrraU
TLSH
T1B8F633A97C1E26AAD20D0C7ECE45CD6635AC6BB287149CD2FFC57DB54810D622B32C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
Size 14.5MB
SHA256 bafe9e93e8f20fe6b2f7027d324370c5ad59be1fe5b03075185f7e39fff03a41
MD5 bdba3e76ffe6a63e0e5909476dc58286
SHA1 c4faa9de2cb0ba69e59d514f6c610d6be2a09671
SHA512 90bc531dfca3a55e336198b04930661851765abd4cf34e896bb3ba2d3b624476735541809606cfd2ef12e6a42daca1c1bd11267eca7aaff07eea10efd165f40c
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLMDWGGGwukHLa8P:4JwMrcMGrraq
TLSH
T1D3E633A97C1E26AAD20D0C7ECE45CD6635AC6BB287149CD2FFC57DB54810D622B32C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
Size 14.9MB
SHA256 b2cc2a0d686b1a97b29aa6223307e0b514c1e24267ef29fad0a7254684e2c412
MD5 39e372f1e9feef84eebbac5943e80160
SHA1 582cf22b44ed65b04f4973c27df96236b44fcfec
SHA512 526c19d6d4b9a9f581a34ffcdcdda56fb4cafa0e06dd1d27660303a9258aa05943c5668cc2fe13132499f8a7600cf99154ff2b01453ff7339a6141dd3965a8ff
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLMDWGGGwukHLa8UaS5:4JwMrcMGrra0S
TLSH
T178F633A9BC1E26AAD20D0C7DCE45CD6635AC6BB2871498D2FFC57DB64810D532B32C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download