94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
Size 11.8MB
Sample261018-sdl3cses2j
SHA256 94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e
MD5 0020ca27378099fdfc80e83bc6b3fb4c
SHA1 25d063556addcdd08e6734c8a2dee3971f9e24c2
SHA512 ffd489d4eafd3c750514202be68b7094dab0bdefed28f1126c1b65925d42289dfcb4bd94e49a99c1763208645fc5295c6fd0f1b4ec2b20555590f8f7c7cad14d
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muq71EB7:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkc
TLSH
T1CCC633DA685F5B6FC10E5C798D068E7239BC17B1C7688CD7EFC67EB20840D921622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2968	DesktopWindowManager.exe

Executes dropped EXE 22 IoCs

pid	Process
5932	DesktopWindowManager.exe
2968	DesktopWindowManager.exe
3324	WindowsHost.exe
1388	WindowsHost.exe
2372	RuntimeBroker32.exe
2264	RuntimeBroker32.exe
4464	DesktopWindowManager.exe
2260	DesktopWindowManager.exe
3420	WindowsShell.exe
4576	WindowsShell.exe
3264	CoreSystem.exe
4660	CoreSystem.exe
5196	BackgroundTask.exe
4604	BackgroundTask.exe
5864	InputService.exe
2072	InputService.exe
2304	WindowsInternal.exe
1880	WindowsInternal.exe
2028	BackgroundTask.exe
5368	BackgroundTask.exe
1368	WindowsInternal.exe
4548	WindowsInternal.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\DesktopWindowManager.exe\""	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsHost.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsShell.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\BackgroundTask.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\WindowsInternal.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsInternal.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\RuntimeBroker32.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\DesktopWindowManager.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\CoreSystem.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\InputService.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\BackgroundTask.exe\""	WindowsInternal.exe

Contacts third-party web service commonly abused for C2 1 TTPs 16 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
49	raw.githubusercontent.com
54	raw.githubusercontent.com
84	raw.githubusercontent.com
120	raw.githubusercontent.com
131	raw.githubusercontent.com
14	raw.githubusercontent.com
27	raw.githubusercontent.com
64	raw.githubusercontent.com
67	raw.githubusercontent.com
81	raw.githubusercontent.com
96	raw.githubusercontent.com
109	raw.githubusercontent.com
143	raw.githubusercontent.com
40	raw.githubusercontent.com
155	raw.githubusercontent.com

Detect suspicious telegram bot 11 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c48e-27.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c48f-99.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c493-134.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c494-168.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af1-201.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af5-236.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016af1-270.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016af5-274.dat	suspicious_telegram_bot
behavioral2/files/0x0006000000016af1-279.dat	suspicious_telegram_bot
behavioral2/files/0x0008000000016af6-317.dat	suspicious_telegram_bot
behavioral2/files/0x0007000000016af1-351.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 46 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4292	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
4292	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
4292	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
4292	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
4292	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
4292	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
4292	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
4292	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
2968	DesktopWindowManager.exe
2968	DesktopWindowManager.exe
5932	DesktopWindowManager.exe
5932	DesktopWindowManager.exe
2968	DesktopWindowManager.exe
2968	DesktopWindowManager.exe
5932	DesktopWindowManager.exe
5932	DesktopWindowManager.exe
5932	DesktopWindowManager.exe
5932	DesktopWindowManager.exe
5932	DesktopWindowManager.exe
5932	DesktopWindowManager.exe
3324	WindowsHost.exe
3324	WindowsHost.exe
3324	WindowsHost.exe
3324	WindowsHost.exe
1388	WindowsHost.exe
1388	WindowsHost.exe
1388	WindowsHost.exe
1388	WindowsHost.exe
1388	WindowsHost.exe
1388	WindowsHost.exe
1388	WindowsHost.exe
1388	WindowsHost.exe
2372	RuntimeBroker32.exe
2372	RuntimeBroker32.exe
2372	RuntimeBroker32.exe
2372	RuntimeBroker32.exe
2264	RuntimeBroker32.exe
2264	RuntimeBroker32.exe
2264	RuntimeBroker32.exe
2264	RuntimeBroker32.exe
2264	RuntimeBroker32.exe
2264	RuntimeBroker32.exe
2264	RuntimeBroker32.exe
2264	RuntimeBroker32.exe
4464	DesktopWindowManager.exe
4464	DesktopWindowManager.exe
4464	DesktopWindowManager.exe
4464	DesktopWindowManager.exe
2260	DesktopWindowManager.exe
2260	DesktopWindowManager.exe
2260	DesktopWindowManager.exe
2260	DesktopWindowManager.exe
2260	DesktopWindowManager.exe
2260	DesktopWindowManager.exe
2260	DesktopWindowManager.exe
2260	DesktopWindowManager.exe
4576	WindowsShell.exe
4576	WindowsShell.exe
3420	WindowsShell.exe
3420	WindowsShell.exe
4576	WindowsShell.exe
4576	WindowsShell.exe
3420	WindowsShell.exe
3420	WindowsShell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 2968	4292	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe	91
PID 5932 wrote to memory of 3324	5932	DesktopWindowManager.exe	92
PID 1388 wrote to memory of 2372	1388	WindowsHost.exe	96
PID 2264 wrote to memory of 4464	2264	RuntimeBroker32.exe	99
PID 2260 wrote to memory of 4576	2260	DesktopWindowManager.exe	104
PID 3420 wrote to memory of 3264	3420	WindowsShell.exe	105
PID 4660 wrote to memory of 5196	4660	CoreSystem.exe	108
PID 4604 wrote to memory of 2072	4604	BackgroundTask.exe	113
PID 5864 wrote to memory of 1880	5864	InputService.exe	116
PID 2304 wrote to memory of 2028	2304	WindowsInternal.exe	117
PID 5368 wrote to memory of 1368	5368	BackgroundTask.exe	120

C:\Users\Admin\AppData\Local\Temp\94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
"C:\Users\Admin\AppData\Local\Temp\94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2968

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3324

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2372

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4464

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4576

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3264

C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5196

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2072

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1880

C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2028

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1368

C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 312B
SHA256 f81c4d14e873614514725d56abd8f0be34b6f5d4477cd74ca95c932b5983b14b
MD5 0227e28c5d089b59e4d0861b677bd89d
SHA1 7cb7b790d9d3c5abb7127e2c4e472490554db2f5
SHA512 53f9b98fe942c6cd7ced07851b93000da0f866d115b17752fb3fabc8da3ff5e238e07645bf902f960d7da00b809e0f5b63bbca0dd63c4c3ba2236eba97c42989
TLSH
T17AE0E716F70D58943B76CF5DCDA1196F7C73301950C44509282D54E44C031E64407498
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 4547662d95ffc6ea63e0bd4c6c75463c95d594c7239e111791a1debfbe75513d
MD5 6e3001ed97ef86477e390f9a610b311d
SHA1 fe32dfc96fd3e54ddbccc89b78df22abe8396af2
SHA512 14026ccf65e8c7a9009af766e180543791a6ad31b532280afbe017ea7081ea7fd89d922296486f004eb4a58149f7a0a93c8f270e05b7c873fcc3d0ef9088501b
TLSH
T14A41B8ED2B3C3824FF86CFC14939DB372E79B1D49544645532FA85623045BE52E1549C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 97e8275b1265f18faa1c822b003da554dc4f197c3ef7e8d7b4e6f954a57592f5
MD5 51247251ca18ff9d40f011c533b0831c
SHA1 df10b4463b52638d64f3a534e7206be9b92754d5
SHA512 123959014a85fbb83f01c1f726852ded60a542a1e45c0544d6dcd522c6daca513b378fd40f99cb6dde38e0d66b02238a8dd3e3d91a4b23731976d0a4914a7eda
TLSH
T120D02B16C2BD24923D63DCA1D981786570B39A7A63A6551A7498801A9806AEA1D09298
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 185KB
SHA256 752a3be6aa420194142f366b3840491646a843e46e3c9f6562f1b946f9723dcb
MD5 22bcfc307899b47371e87a3bb3d2198e
SHA1 8865149fee3a9b9ebd7a509eb93adb37b408fd2e
SHA512 c1d42010d4816d7642c92100d21ff3f4bfa8ab0419b8e6941e1048ede2238cd2d7ad514000efba8eaf6b1aea0656790c9b89d071ef908106095d22229d25b3db
SSDEEP 3072:pO909JXxqzrYgNGuPFj0CxK1YlM10RKfgYdgghuch:pOgc4CGuPFj1xKItaDh
TLSH
T1C0042D186DBBB1619F4ACDA24C9AA95E03F571DF2312331B4EB76E901D43A9BCE0744C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 2c65fe8529a61d5cc1afdb06dfc967b9f37eeb990b48429ca01e53bb025e1730
MD5 6c5363f6a24862199d9e4fc7c51525bb
SHA1 706ca3488bc9e0a1a11065e0b33fa8fe6284a3d5
SHA512 01b431413358b6dee565915138564dea3fc892edb85590f919f4041ca99e422b143ff0847cf3d68ea7f4793200c4ef0b1aa460d741de4dd458d1b976ffae4ef9
TLSH
T1C111258B9EA4B0D15AE256E1C7A8D9327DB434C52DDA34C02CD1C4C720AA7593B0C03F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 dd12d0d67f3440da867b363b6409c70919627eae4ac673febedbf3a6557ed1f3
MD5 7d604b92b237c36bc0102ce90f4b9121
SHA1 1242a8f5743ed31e489fabac08bc01a3e8d4e713
SHA512 790f42e7dde75db266ce511c688f5af8607a4b3849edbbb372ab51b242ae228dad4813c12d74256b4de9ad17e7d2ac8774272d578c9fb8ab8da2abfdbee60ad2
TLSH
T1F041FAE71B5938A07F819F9A19F4C97D2E3898785184888279F3C4D610DABD56C0A44C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 c49898e3c09b50e5eebe32afd76c8d966125df448ab186b2843222d674307f8d
MD5 806f4853532b711054b1ae675a73be41
SHA1 4d26e300ab6fd4122649467bc02388f8ba0fb1a5
SHA512 dc29cb37f65ae2a692f18866ad53fcdd4708cba560e1fec5a31c2b6f3e00bdd1d993d7f498637d0b22bf9ec843ed053ce16423f0ab35f7969591d5a65ccb759c
TLSH
T151C08C2C1AA60A16F6E8437C02C179039B208141E2418F051AF12A08CA9AB16A838D2E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 893dfc8a422c5f0751f621ef28be0be7c563de86188b18b8993f868a0711b159
MD5 24db539fdf99bf353dfc0b0f6ba9c08b
SHA1 1c276a243052b2c3d5379799dde443b883348443
SHA512 32ddfdb13b8f755e2f24f62f4523a5c520fbaf7dc6711fd4ce5cf4a26e39c60134c8210b2125cdadf0829aa611dce3909b26950e9326058ba1e1c417b9b94858
TLSH
T10DF05C3C1AFC457DE0B3DE7DA7D8B7D25D59F1162804059856E24F08E940F412CD1528
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 e02d06a6e96d7672d2ef5dcea3b9eee747a82dd48f48e5765df27c5f6b1f8a24
MD5 d558310824c3786fff6bf57df1a96fac
SHA1 35a87a052b316b542e9f7de4a5bafdb459bdc023
SHA512 a59ba80575eb6365a664ff689b6583925732ea14f315867f9e8c64408632d1b8abde5c9f7dba34b1c32609200bdc4cc10269f101dfe5fc610cb3268e0ebe521b
TLSH
T194F0221939FA957BF137EEB863C632740A36E20A3001657827B133093E16F207C22205
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 0db88d1a4e271bd5cd3a18e975110c22ba6023dda4be36c281666b3c43ca78fe
MD5 cc96644b1772e448272e43ec3763c36d
SHA1 fbd10d2397f9f2c4b9cdcc438b505ae8b94b0aca
SHA512 13c61fcd3f67bf0011e6d8203c982212e120eaf0926e8fb4c36d740388a2e27aa9cedf931ae3e1b27731c701cb3f13a8a06944d3760c32a2cd92eebd154fa75f
TLSH
T1FDF0AB19057C406FF4B2F87AC2D522BAF626F116B8059EFA86D70B06AA01A002D51A6F
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 e079325410f332015a7c26cbb9c6398a01562a19f9db10fb5d810517d38ae4ef
MD5 02ecbe85ad15b3c4bffb4d5aef80ca3a
SHA1 8fcdea0bc1df10088940d07e9cac5364663d971b
SHA512 992dd720738ab0b5ec231572f9ebc873b0a32f0e98c6f08f8273d11df334717cf50af259ff24d3037537355719777565be602f5df4caaef42228ea1f58e249ae
TLSH
T108D0A9380F220134F120A2BE98630E8149A02807A282AB0D0AE10008882AE020C9290E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 670069d92454e946ab7e8fe2cf6750d59b3ff1c6901a354166f29a801ea7855e
MD5 195b79d03d9e391327fa7329f03529f1
SHA1 644c842b3d5daae9d89169146811b8ec6427c912
SHA512 b571ccf44ecdaf5541f89e72afe1bc67708c6931398383ac86d274f06c18a74e1d77e7466cf90dbf6808460811e8c3330e4c727759d2dd87e4e32945f822de1a
TLSH
T134F0A32425F1401DF23227354FF8939BAD19B2573404C8B92995030EEA07E015D1273C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 d962fc235e8ffb95c5ed5a1afacbd3cad8bccfcca24a89b1dcb98d14fba9fd64
MD5 7419eddd4fb0092a70eb5a88f383d992
SHA1 4a84f8f15bfbedfa1a0a556550be360e8de4f400
SHA512 55f1b4cdf3a9f64977ea83b99dbb321711a58243a576483f951e8851b1fc583072bfda91785fbc20f95e23e038c271213b3ed2d0851a88c39ca9c6e0b453c211
TLSH
T172F02B3924EB014FF173E6BC43D416D54A33F23321482A6E6BB162895E47E41FD73915
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 77861c26f14b0b12a8277e8f373207a4e12d54cdff4671de6b895ae8696436b4
MD5 e3c0f6f0697f8de3df05d9eeaa48d951
SHA1 0ef02f1911f81b5466c948a5780c36f256486d49
SHA512 7d61fc3810ff30d0f8b8e619ee12ce7c07c24ee2a228868613e233623173d0cb394f70c650c2058fae38699369e0459f4ef687a5b1cca940bad1b5a58ae41f2f
TLSH
T148C08C1C06650616F2A883B802C729838A218110F3819F052AB12A08CE24F226834C29
MD5 SHA1 SHA512 TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\DesktopWindowManager.exe
Size 11.9MB
SHA256 43327f6cec4b7d660b3369bfe7b94f46e3a8f602067b5a95a6090ba1728b0710
MD5 cfce85ef729208cc95f75b2fd04e5e88
SHA1 7abb8d231dda611cee1774652f0bdd18d1526c54
SHA512 ed01068e43d7afe20086702fffc6f659008cb1440bc3cc4a880147b6177977b9bfd645f8befe685c7193dcdd17d6799b2deb927ed366f6b09794c9d40b6dc37f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muq71EBd:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkY
TLSH
T1FAC633DA685F576FC10D5C7A8D068E7239BC17B2C7688CD7EFC67EB20840D921622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe
Size 12.4MB
SHA256 93a77546cd17687efcc87920ce1d6fe4265eb47074ece0f7d8271cfad3889652
MD5 1199d87fcbbb7e4fc5ce0dec230fcf41
SHA1 c3bb74a6d8de571cfbf0d9170b4b70f0571d9372
SHA512 27fb86ee8d0c9f90d0adc48189cc675dd0dad35ab2980adb20c9ddcc222c971ea17e6ef5baddc2e1c7cc9093a535684519986e66c6f91f9392374b202889fc8c
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDjv:4JwMrcMGL9gG
TLSH
T1E4D633DA682F576FC21D5C798D068E7239BC17B2C76888C7FFD67EB20850C921622D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
Size 12.8MB
SHA256 8bbebb300ddadc1e5531eb2fd9df1a680608fb7fd1860e886372513e71288f9d
MD5 9c1d66f546019dba8cfdf8a1d23877a7
SHA1 9f2d9c52d69f7a6f959194fde70a9aa83f2a6372
SHA512 cc652f7851c09ca98309426085e46084cb2cf996d811350531f0909a7f81a8a514562e4471971d276e55e9914997088befcb417de22b65559055612b5d30d004
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDjbZ:4JwMrcMGL9gw
TLSH
T1C9D633DB682F576BC21D5C398D068E7239BC17B2C76488C7FFD67EB20850D921622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
Size 13.0MB
SHA256 b44aa2e42fe4d0be5c1b3b734ff58f2032c42dab3ac6de148db682623c4c9d56
MD5 973c295204b44413eab8996578f42d3f
SHA1 4466f96df85c82a81a7398b7640315091dad6386
SHA512 2b40be9f346dd413d7b39001f588633e732d8c3cb8bb401b3d07844a2a62352fb757487e090cd470b517c8f917605061bb0b1dea6c2d6e0e49d2440b71b6b893
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDjbhX:4JwMrcMGL9gG
TLSH
T1FDD633DB686F57ABC10D5C798D068E7239BC57B2C76488C3FFD67E720850C922622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\DesktopWindowManager.exe
Size 12.2MB
SHA256 fe1cd69e5e96a0e02795b1cdb110e92cf26a3104395a46b1df6e844001ee7208
MD5 b19f2b846a2377bc6aa7c6169dc2b34a
SHA1 b6543d78b377c079ea382fe924a7976e4527ca2d
SHA512 4f4376ccb0b66ded4f3cda9d8ca686b685a44df8ecda92fb09b309729434c1259bac4a2ad6da56d5eb391f786a3cbd706c8a3d8879b115d072e4d1c434d627cd
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDje:4JwMrcMGL9g/
TLSH
T1B7D633DB686F576BC21D1C398D068E7239AC17B2C7688CD3FFD67EB20850D921622D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\BackgroundTask.exe
Size 12.5MB
SHA256 fccb2ab385a7b8a6ead16b0b5f9917c4f69cd4ad8e94bbc110c242d5cc0106e2
MD5 e7db9a27cf9a0c10885185a57ee46bc7
SHA1 d963a71cdcd5215ab9dd0658973f282e6000e2af
SHA512 4c2a96c19ac405cb4923621c5cb87d1ec7d09fa97873a455d6890586037b53a0f882b36d9b6632f5978b479c3a6b76638e90c220456c6744c7ab285cabbbb3fc
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDjZ:4JwMrcMGL9gU
TLSH
T19ED633D6682F576BC21D5C79CD068E7239BC17B2C76888C3FFD67EB20850D921622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\RuntimeBroker32.exe
Size 12.1MB
SHA256 216e474487f53b2f2ea7943b65a73f9ff8d3db4006a1464e0883dba75ffbc913
MD5 1095cb2434e2531f7ada4b46904dab51
SHA1 58380df390c7e9e9d5e97248e32b3a35110d2552
SHA512 2e2df4975fe65c0bf05b894ffcb5515e9a2285f108e151620055fb3d142c88e113d73c2e34ff26859b6c87cfd89806bcc7788779bbf0c2ccc45d2774598ad981
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDja:4JwMrcMGL9gN
TLSH
T168D633DB686F576BC20D1C398D068E7239AC57B2C7688CD7FFC67EB20850D921622D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\InputService.exe
Size 12.7MB
SHA256 00576e902d0237a92c800501fee44cd85ed78219cc1ab140852f2c33d85f844b
MD5 62c67183b8168afe0fe880c8b6ee762b
SHA1 5a7b4dcd6203188506bfdd7a97ab03fb25ed651d
SHA512 988e63a1de4c9c3ea5c21c95b6909679c986aadf1f3768d8d4a0bb7b4705bc1f8c1c0851c99de8096ebbb679d2d9a9e2a8fe6e66321d6c8cc90b66015cf9a499
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDju:4JwMrcMGL9gN
TLSH
T1DED633D7682F57ABC20D5C798D068E7239BC57B2C76488C3FFD67EB20850D921622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
Size 12.0MB
SHA256 483bd9d6d7c169a690a214f385750db46f4b390243dfcd46a6aa41a9eca17960
MD5 8f82c9c53e6c2996d8d1d02e59ba0957
SHA1 0b929edc2747ca27fbd8f4fddf90af2d4cb839a8
SHA512 24ff9b40c7941291071dff8a209dfc91459fc93bb4caf376235661cbeb3f072330fd53ec30991001b0b84b481737d57bf20314aec5ec7d456e741e3a8ba8c0af
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muq71EB/:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEk2
TLSH
T1ABC633DB682F576FC20D5C798D068E7239AC17B1C7688CD7EFC67EB20850D921622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
Size 12.3MB
SHA256 3fa6384248efd37f3fe2de033ca791375319c828baa7898ef37ecfdce36c90f9
MD5 d24c709f219e144f8d673fabb144ab29
SHA1 614b096d201ef98b3158ed9d1b8d3db8d696c0d5
SHA512 f018421a3a352888f4d65487fdd37a3b328fe0a22b170b74feb8b11392167d8936a5264edc0920545aa339457b8dd98a71e439ef9828649ad0f8287ddc5e90fb
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDjZ:4JwMrcMGL9gW
TLSH
T17DD633DA682F576FC11D1C398D068E7239BC57B2C76888D7FFD67EB20850C921622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\BackgroundTask.exe
Size 12.9MB
SHA256 3126d9fb89f0c7cbe4e717db4ed2710159c8365f37a6b593b7f74944623712d2
MD5 33b119f47fb1e2cb6df936738ed8b656
SHA1 55f3baf1b6c25908c8648f8a8eb7aae5e5f7eaed
SHA512 39111dd572fd3c74859fd04e9a275ef84f94c739b70716d458c4efe80d50837aa4fdf9ff1a69201b8a1ce313799cf9e69b808685a211f52a488c274bfc455075
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDjbM:4JwMrcMGL9gn
TLSH
T122D633DB786F57ABC10D5C798D068E7239BC17B2C7648887FFD67EB20850C921622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download