a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 13:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
Size 1.8MB
Sample260727-q923catflc
SHA256 a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16
MD5 1dcd762f76a0e3fc71363a3550255bd0
SHA1 72306fb9d5556811414af02ca2796d61d7240551
SHA512 75c3d77d2074f3cf2c10726d64537b8dd286832c66b8315c80b0271f817d1ac1af499bd9b59bef84f2fad66dfbfa0cffa8b9faf7605e40781ae07308dfacd4b0
SSDEEP 49152:+eWUGHITpj2h0VZar75fynVG6q/qGBCMTbz2:+ebGH420Zar756nVTgx1K
TLSH
T1069501D5795E76BAC10A1CBA8E16CE6274AC57B2C7504CA3FFC53E7B4910D930623A32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2612	BackgroundTask.exe

Executes dropped EXE 8 IoCs

pid	Process
2612	BackgroundTask.exe
700	BackgroundTask.exe
5980	RuntimeBroker32.exe
2820	RuntimeBroker32.exe
3524	WindowsShell.exe
2352	WindowsShell.exe
4696	NetworkHelper.exe
5416	NetworkHelper.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\BackgroundTask.exe\""	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\RuntimeBroker32.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\WindowsShell.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\NetworkHelper.exe\""	WindowsShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
36	raw.githubusercontent.com
45	raw.githubusercontent.com
3	raw.githubusercontent.com
24	raw.githubusercontent.com

Detect suspicious telegram bot 4 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c54b-10.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c557-81.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c559-122.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c55b-160.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3424	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
3424	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
3424	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
3424	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
3424	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
3424	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
3424	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
3424	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
700	BackgroundTask.exe
700	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
2612	BackgroundTask.exe
700	BackgroundTask.exe
700	BackgroundTask.exe
700	BackgroundTask.exe
700	BackgroundTask.exe
700	BackgroundTask.exe
700	BackgroundTask.exe
5980	RuntimeBroker32.exe
5980	RuntimeBroker32.exe
5980	RuntimeBroker32.exe
5980	RuntimeBroker32.exe
5980	RuntimeBroker32.exe
5980	RuntimeBroker32.exe
5980	RuntimeBroker32.exe
5980	RuntimeBroker32.exe
5980	RuntimeBroker32.exe
5980	RuntimeBroker32.exe
5980	RuntimeBroker32.exe
5980	RuntimeBroker32.exe
3524	WindowsShell.exe
3524	WindowsShell.exe
3524	WindowsShell.exe
3524	WindowsShell.exe
3524	WindowsShell.exe
3524	WindowsShell.exe
3524	WindowsShell.exe
3524	WindowsShell.exe
4696	NetworkHelper.exe
4696	NetworkHelper.exe
4696	NetworkHelper.exe
4696	NetworkHelper.exe
4696	NetworkHelper.exe
4696	NetworkHelper.exe
4696	NetworkHelper.exe
4696	NetworkHelper.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2612	3424	a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe	89
PID 700 wrote to memory of 2820	700	BackgroundTask.exe	95
PID 5980 wrote to memory of 2352	5980	RuntimeBroker32.exe	97
PID 3524 wrote to memory of 4696	3524	WindowsShell.exe	99

C:\Users\Admin\AppData\Local\Temp\a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe
"C:\Users\Admin\AppData\Local\Temp\a310e2fa12e946b9ab554ca7ab0c554a371bdb75185e391c4a002f7ece844c16.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2612

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:700
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2820

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2352

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Local\Temp\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4696

C:\Users\Admin\AppData\Local\Temp\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 282B
SHA256 25b5b04f78f2c54fa0d7e083313f0e9396812c873bd9a4190edd3d826a9e2b72
MD5 90bda4b803e1202a0fd31f9d1f25586d
SHA1 bc57678dbe6a3f157134e3b0691c3e8d5f732552
SHA512 7e7f45ec71571c5c8acfbd42a8fd719895ae820c43621f089803854a3055361ae1f51d01a792879eeab434eb17e317609e30133b88a4dfd61d6296b8babf180b
TLSH
T16DD02B8552B594A27E73CEA068D5E1BC3106307626E069211C1C800A5D2063E361A620
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 a577ae515c59e657451a9821583b278fe09f8ce0b86794fc9a8f176b542e9724
MD5 9d800ed75e8cbfdb4ca5c716cc3a9f62
SHA1 78a6ec6ea68474093c11c7d2fb0fe0cba5d7922f
SHA512 04a75b28201c636d7dafb5fa74e6134775980c95531cb503bd70fe192e6fef8a7335e7c56cd5667630ae91de281fb5612be27762be4f596c986e25a5101263e9
TLSH
T178E07D0DEB4DE4667B679D102FD690BB3821205E48D64B05382606D68D0132C430F229
MD5 SHA1 SHA512 TLSH

Submit Download

67F6625BC22310D5C99DDE12020DBD90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90
Size 584B
SHA256 6d473796c6f906f567e4837a54161097d0bbc0f662ade87705e46237d7c1160c
MD5 dd53e71a76a3ff61d16963c00af0e241
SHA1 4b8da97d8448de02f98f1a09019544e43519554a
SHA512 97eb6cb088bf81a51ef00bfedc8baeafd8219b20fb9522b29ea857f3de2e65a29df887065456eacce77a4f5ebde8ceeedbddfcd16d21760b68c3de53dbb54b5b
TLSH
T1C1F047721A183118EED0FF6851ECE763AC343671A8C37A1165DFD4401811F50154148F
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 9c533a053a9ea9a49777c8f1dd05061e5d2947cdbc48510789c6f1aae6a0bf53
MD5 a4434c43ba2c770c2b5c810c5931e020
SHA1 b8c7a630b74283b82cb178404f67e8c15e71c0a1
SHA512 952e38d0ec578d7438ef5330e547e9d9a7ddaed367219972fca4fd8f97b8426f7eef08eeebdf6f634eac07099ab72b9078cca3af85b915e1ac593e39364aeba7
TLSH
T1781121C25EE4E1909AE39760C6E8D2367CB460C629EA71D22880C4D3106A71E6F5903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 2c3d9b2e971b7c3f1650e7c73f7589db03f33054115680ea086e0ef8c56020a4
MD5 0e4298c54a048968795cd5f612f242ce
SHA1 005d8408edb91d482ac934a39a22906fb1adf555
SHA512 2ac8dbd160dd6b18005cf842cce29f4693defcfb64539e20acf93460b631ea45fb9141c08388d8253ae9ca28038fcc990c624f3861d9d3156e639cf0d89945bd
TLSH
T1A341D8EB1B0A78E8BF02CF8559F5C53B3D3895A46280198276B7C992006E7882A4B5CC
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 4876d7817e755ca4f8e610001d8145a9cb9bbab7676e7b6f99539a2dca1ca1d9
MD5 1daa3538e5ae9d3945ff4c71e4d403a9
SHA1 504ac81df3168e2f0e9b2825343f2791073cb0e0
SHA512 313f37db84defddbc53855de016356fbf45d0e9153620b4286e65fc5616b4a63616be2a283ab37dabdc50e09e6ae501be2a15060dc2cfcaa447a6819dff83074
TLSH
T1E7F0A32425FD4114E071E979C6E671A5FC15F12778055BFF0AD757057A15C800C9A52D
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 0e625d954f54d4c69e6ced8461acfa85f2211e6967c6da449ea76186c4569de9
MD5 dfa302f9cb0bbb7260aeee024b693a38
SHA1 f16e3df7e81631ba5fe7fea6574e76470cf6137d
SHA512 4b43cf3d33be275bba3384da54103b9b667bbd12112bc6ea5843a53ffa5ec193a14e73a4ceddfd70a61896831993184d3cd0b7232b2cfae660797516e0c26269
TLSH
T1F1F05C3C46FC81ADF532CE785AD5E2A62D24F226280445EC1BE007499942F011C40526
MD5 SHA1 SHA512 TLSH

Submit Download

67F6625BC22310D5C99DDE12020DBD90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90
Size 230B
SHA256 4ca4c972b420a415a651503415a67f3b9fb5e1063e44a533db36ffc193126e05
MD5 1ba1805557c2e2d179dbb110ffda8e43
SHA1 02d0364d570ac5156bfd3df6a1aaec3e298736a1
SHA512 1c705d5dc6e8ecfb6f7a529868739159df38a380bfa80028ff4c83d7dc39747cef2a6cde0e0c7a017cd9f697f9f041c8a2948cdc09b4c4cd584ed7d8b9ad984c
TLSH
T1A8D022582F769A1BF001D13BC8A106111E747010D201C785072005484CBBF462C31D02
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 7599968f4becdf0aa666029d4652d09ac8e91d3710594736b9fd470a7569f84d
MD5 d86888c5581033328b7290b91c3dd400
SHA1 7cb46e5ff640364f819e03f2e0a69162450a377e
SHA512 40065a1cab216130fcf0e51ccfc13f9ca4637dace2f77c0f884ca0199dc238746359fe97737b76b0f7ba048961c7a6b96879f702504a4dcaeb969d8e78c7dc7a
TLSH
T1A6F0A33C57D7914DF73167B5C7F553D66D04B2533405C9E669D10B0AE607E409D5143C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 8bd54cc78f15b1d7d2c8862cb966cc4645e9a03845f37fbd1b53137b1a29a843
MD5 46fbb9fa3e9ea78fc1b085378e101702
SHA1 10d7ab2cddeb9ee6abbb1bc92ea0510106602333
SHA512 8ce0d5f7fcfc0cdaaec2706ed2d7a08a45384abae65a98d229d09cb43724a78f71e208aacaa1d58f01347b9890adf6a591c5a79d0af899e5494bf3fd056b400b
TLSH
T12DF0A33C35EB011EF133C67C03C017974533E136224C3669677303095E02A417920A15
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsShell.exe
Size 2.1MB
SHA256 604abfee1818a4d9539ee984d9c606b07ad6a36c3512dcf26842709df642433e
MD5 f307c4d887b62e3e5e1c6a8d6965aa62
SHA1 bcd57b1b86ee35e0154112aac525e8bd9f10c9a1
SHA512 617182d573e1adf546474eedcc9ba13ec3ab87b9f6f297c8e8bec56b8f245926eb4449b199233d1448093467aa3ed40523f72ded266008f925e159821f326500
SSDEEP 49152:+eWUGHITpj2h0VZar75fynVG6q/qGBCMTbzdmHY87:+ebGH420Zar756nVTgx1hmV
TLSH
T19BA502E5795E76BAC10A1CBA8E16CE6274AC57B1C7504CA3FFC93E764910D930633A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
Size 1.9MB
SHA256 eaa213370fb29a210b1d792329eb42678d800ea85bd10d9b95e1e2ee4656efe7
MD5 25edc213641d7443e9901ede6488885b
SHA1 2ff4860032481905a6b7936b13a155cf6025669a
SHA512 51f43ecf1b7c4dae5389e8c33b32c15bdbd294370ca00a6c3eff6a6ff76ea407aebc15d582f7b5e697e526ec6636c00395d66a4a3834485be1b7f72fe2c8c54e
SSDEEP 49152:+eWUGHITpj2h0VZar75fynVG6q/qGBCMTbzdX:+ebGH420Zar756nVTgx1hX
TLSH
T1CD9502D5795E76BAC00A1CBA8E16CE6275AC57B2C7504C67FFC93EB64900D930633A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\NetworkHelper.exe
Size 2.2MB
SHA256 23bc7ee9bd69277f8f44cc9f27ebb864f41e11348d067b3a49dbc3cbb333bb6e
MD5 3a2642b34a53df0805dd4f4462b62c30
SHA1 61919ffe3510b60fc6bb214b8fb267a23d1192dc
SHA512 e4269fa3220c38b762679f34866a21023e3dec3a82c427268f4f37c6a822252f26a69a48bc75d78e6d93293dd605d50e3756b99711683eb72471c3c5cc4bd06e
SSDEEP 49152:+eWUGHITpj2h0VZar75fynVG6q/qGBCMTbzdmHY8BsmD:+ebGH420Zar756nVTgx1hmUQ
TLSH
T1F8B502E5795E76BAC10A1CBA8E16CE6274AC57B2C7504C63FFC93EB64910D930632932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
Size 2.0MB
SHA256 b3c5296d004c7e578a848eee4d00c3edb0f91a072d9978b08f96351b3eb84f86
MD5 39a23b6c010896454a312ca29d135992
SHA1 f4f5f260319be35831c4653e3e89e665ae64b8ab
SHA512 bb7196536544ba0016e566ccb5ee197624a758c0dc8e0b6387d84321ed3f5946d8181879140838d6b0e0bf172998fc3a4ca4847886a61055da5031c80036b2f9
SSDEEP 49152:+eWUGHITpj2h0VZar75fynVG6q/qGBCMTbzdmHYF:+ebGH420Zar756nVTgx1hma
TLSH
T11FA501E5795E76BBC10A1CBA8A16CE6274AC57B2C7504CA3FFC53E764910D930633A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download