1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
Size 4.3MB
Sample260807-tpy2qszaqe
SHA256 1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365
MD5 045310b292004e5678d7c15da7c82ab7
SHA1 8bca3307218420e6042b90b3c8c8c09b4a5c47ef
SHA512 95be01cb5f40e531546b03d124b8bb96c504fd1af88a856f07d71c862cc0c8d2058093c2ba8cdebd55cd75f4ff35aeaa18c3c0a31cfc5131bf6843340d56d37b
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0Y:+0s420bTjzGlBrJTJb8QAMQ/Zr
TLSH
T1AE2623D6785E6AABC10D2C7A8E168E2575AC5BB1C7604C93FFD53EB70810D932633932
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6136	WindowsHost.exe

Executes dropped EXE 10 IoCs

pid	Process
4460	WindowsHost.exe
6136	WindowsHost.exe
2660	DesktopWindowManager.exe
2088	DesktopWindowManager.exe
2800	BackgroundTask.exe
2560	BackgroundTask.exe
2928	BackgroundTask.exe
3848	BackgroundTask.exe
4920	SystemHost.exe
2880	SystemHost.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\WindowsHost.exe\""	1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\InputService.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\BackgroundTask.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	SystemHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
15	raw.githubusercontent.com
26	raw.githubusercontent.com
33	raw.githubusercontent.com
51	raw.githubusercontent.com
59	raw.githubusercontent.com

Detect suspicious telegram bot 6 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c585-22.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c588-95.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c58b-126.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c588-154.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c58b-158.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c588-192.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2512	1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
2512	1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
2512	1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
2512	1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
2512	1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
2512	1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
2512	1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
2512	1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
6136	WindowsHost.exe
6136	WindowsHost.exe
6136	WindowsHost.exe
6136	WindowsHost.exe
4460	WindowsHost.exe
4460	WindowsHost.exe
4460	WindowsHost.exe
4460	WindowsHost.exe
4460	WindowsHost.exe
4460	WindowsHost.exe
4460	WindowsHost.exe
4460	WindowsHost.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2088	DesktopWindowManager.exe
2088	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2660	DesktopWindowManager.exe
2088	DesktopWindowManager.exe
2088	DesktopWindowManager.exe
2088	DesktopWindowManager.exe
2088	DesktopWindowManager.exe
2088	DesktopWindowManager.exe
2088	DesktopWindowManager.exe
2800	BackgroundTask.exe
2800	BackgroundTask.exe
2560	BackgroundTask.exe
2560	BackgroundTask.exe
2560	BackgroundTask.exe
2560	BackgroundTask.exe
2800	BackgroundTask.exe
2800	BackgroundTask.exe
2800	BackgroundTask.exe
2800	BackgroundTask.exe
2800	BackgroundTask.exe
2800	BackgroundTask.exe
3848	BackgroundTask.exe
3848	BackgroundTask.exe
3848	BackgroundTask.exe
3848	BackgroundTask.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 6136	2512	1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe	90
PID 4460 wrote to memory of 2660	4460	WindowsHost.exe	93
PID 2088 wrote to memory of 2560	2088	DesktopWindowManager.exe	98
PID 2800 wrote to memory of 3848	2800	BackgroundTask.exe	101
PID 2928 wrote to memory of 2880	2928	BackgroundTask.exe	104

C:\Users\Admin\AppData\Local\Temp\1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe
"C:\Users\Admin\AppData\Local\Temp\1a494c986b8fd31f2df476ee8c4ea008aa86b753d38d2d7490ef897853a15365.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6136

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2660

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2560

C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3848

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2880

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4920
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe" --monitor
  2⤵
  PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 281B
SHA256 33d2f34e0cef9763a21d148343fa5d8250e6763271e54018c976e5db9c78327e
MD5 3bb5def4ddb309e01a0451fa40f7ed99
SHA1 755c9d7b917378a0801a7119cabcf42500f4eb13
SHA512 c206dc3b930529d146db3d89899ce69b9def407c816aa18eef9b0545a969cd418312c9210a88273cb51d144f5380e6d0d72e5ea7d079134c0050854180faadb0
TLSH
T199D02BDE09FAF5652FA3F98185D5E01870163B2506F059205C1CE67F64359299F09100
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 15394b02a9f1502dc7d9cc62ee564fcd2591a397fdd507a114baf44fe2a3c2cf
MD5 ceb5a211e7955c6707fa0bb4312c5b24
SHA1 90c60a9cc2841655f57bcef2f5443a1c28a27ca9
SHA512 3bc36dcb55b1908f81d97bac3637cec8cf2c2628f56847544cac7ace5886925f3af496745d4ed4f4111f46ed5510ea113aa9f1b8917b28ee61421f855e8fa9c1
TLSH
T1B4E07D0E660E8DEFB673DD200657E8BD7C61421988927279241451D5095527B9D07126
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 9420436bc33980323898d989d25fc8efa27dfefea97021caf673efc86d4f01c7
MD5 2d6fb8fe1f9223116c5b6195e909eab6
SHA1 63bceb030b5e78116d63a9c041754cb905f8e508
SHA512 937f7b43a618e765981d6810de93ca5fcf2fc522de945b2812b617ebc6392b8e416b0bccfeb7fea31a39de0969b54f42fbbaf96552f887b95c90222eee75bdd3
TLSH
T14041A5DA9B1E7454FF85CE846678CE362D38F280A6D8906570FB88627488BD44E06C9C
MD5 SHA1 SHA512 TLSH

Submit Download

6EBD0D78D799E307DA6AD4F19004AA0E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6EBD0D78D799E307DA6AD4F19004AA0E
Size 1KB
SHA256 0bdb5c6c0616d562af315a768c5e2f265512434060d31706890a3b23750e79da
MD5 c377f08dc18c23d53e3e94ba49cfa3b3
SHA1 b4fd8673dbbb3f8038f24abde70c7207d407af56
SHA512 da451fbe2303faf4b103c16c377776183acdec34bd0b61018e6bdf57e202550f02680063817b74861602e1ea4c62cbd0620fa7dbba333b0b96b5200acf36a9a0
TLSH
T1B1219EBA5C9521632185BFB1DAA7DD6B6E75046427E0C8DF41618BC41473FC2CED15C8
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 979B
SHA256 50d5095a1f71798fb14962bb33628b48b04dee2cba5ab9a1fa1db9f209009390
MD5 735d5f2b61cf214a6a7715c5a465ce5d
SHA1 ded1fc692803d9557c406f6bae5b286b983a488c
SHA512 7d36194dfdf01bff5744ac9692c706d379305662d25b4baa49adc4d924326967a2b6a68ac77d1dccf5865accbed65099f9d0c40859f66744f56d28b3883c661e
TLSH
T11F1121835E98E18096E3AA61CAF8D2317DB5B48529EA30D11882C892206A75D6B0803F
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 bf0759636c68bd2ba95e86292d5ac7f1f44a9e4ab3ff1710f30fb636cefa0149
MD5 f82467f1b449ec6dccd9c1defef207f8
SHA1 9215afc42500f52157c1d7e2696227ada1949e1b
SHA512 481096326393e29559a8ac2939b9fdf100dbf1fa45e6124a0562b54c36ba1ccbd2ce30bb5bcf9bef15870e5ee4041d9670aeeead8b4d2583cd403013fc365e4a
TLSH
T14AF0AB20747C4118E0B2D879CBD8F87AAC36F126BC0496A60AAB16089745C818DF293E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 6354815cd81b5af09b6d32e9face6aaadb8b3d597a9f314ab3e7ff63cbb44fe6
MD5 72baf30058308961d20b11fc98197fd0
SHA1 bfca176a8ab096ec5df17d563cd2e6925249c755
SHA512 973df33f1a8c0be4446ec96362ed509f2bbee859a7b6169a3831dd9c4fbee113018f9e359995bdea78f562157b219bc6d3f105ed400936e46c2a1be5133c8eba
TLSH
T196C08C1C1EA62A16F2A8437C02C179039B208141F2418F051AF13A08C996B262839C6A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 e713aaa898e23fef9f4566fcecfe0a952597e15e3fa907ea8b39df24c116c919
MD5 fe9406d93a9f20b5a6f6bca0ebcff6e8
SHA1 ae18ed9986f8359abaaa49b8eb3e8cee4b5d339a
SHA512 6201ad6c0085a5c215b0812933d355a97698914cbfed362dc6a8c264fedc0a773a4a4ca5a734df913417300dd9ea334fa43a90720cb35c4c83810f8529fef41e
TLSH
T16EF0AB2C0BFC932DE077EE7A8BD8B6A2AC15F162384805EC1BD6474D9A02E423CD147D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 33d1f53eb7d3fb9890627d065912e7af78c83d13477494f098e4ebc1ed6c5aa1
MD5 01290f55ae73cbcfc33f9a5ab956195e
SHA1 e2d0ade2106a2b64c1e9feaa8835f42ce10c051f
SHA512 fa56852b934aa5185f015560d52fabab54753bf366ace03a29e99932427ddcdb5ee7601528c0c1c721821509beb613c70ac5b660519642010ab576870a77dda5
TLSH
T10EF0C0243BFEA53EF17BA93943C5B1F6A82FF352300565BA1F7913142E16E222C41A1D
MD5 SHA1 SHA512 TLSH

Submit Download

6EBD0D78D799E307DA6AD4F19004AA0E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6EBD0D78D799E307DA6AD4F19004AA0E
Size 238B
SHA256 e5f941f01dacfae3bd8bfe4a395b41b73bb6eab75508fcef8d76e7557baf388c
MD5 0ad25e7b3e8fc4d0a3343250ea81cbff
SHA1 c0d1b526100a0e8794b57e63efb25a65d94347ce
SHA512 2e6a5acf1a5b8d423eb08c878a81ddd464c2a54afa2b71e39f5510a08309188392d33bdd58eb6ec4b3d88363720a977e17769d942617040a2c97d0fe086661da
TLSH
T17AD012747B98911EF0154F7EA9E2C142B66474447653D7060FB51608EC19B851872F19
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 1e79c0bc715a8dec4e3a203dbfa644528f789fa5d6d89e694946f2b0ef899fcd
MD5 7787d26011a027fb3e888bf648d7b867
SHA1 a63011db48e2cc52f7526fe7fee80eb82a373ca3
SHA512 02aa8d24eb3f228db563b7d7118476b33f1894505d7b1191bd9436d72fe9c5c5512a5772b667e8b96f1e9feb04bd1a01d82b5baeb48f79d8cb2878063656ab2a
TLSH
T14FF0AB7916E3566DF731237486F597EAED1AF2A77000C5662EE6060AEA13F402D22538
MD5 SHA1 SHA512 TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
Size 5.0MB
SHA256 b99927468d3fbd0fa1bcad804938a08e441f4a8e3ce2f6c6aa49ea3ff0153981
MD5 a245c2a4dc31a91ab3392062e24827b7
SHA1 4ef2b22e0c9f2e421566dcf50797bc9c5e4a9399
SHA512 b2c976fcfab2d50f897ffa12d867235ce423661881db79d98e71a4ae442d1b17e04b84cb687fddc99e89f3519554906d260d016c80998f2595c9ed54cb106d50
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0eciLC/:+0s420bTjzGlBrJTJb8QAMQ/ZJXC/
TLSH
T18A3623E6789E2AA7C10D1C7E8D168E2635AC5BB1C7604CD3FFD53EB64850D932632932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsHost.exe
Size 4.4MB
SHA256 4376ff1a7b9074dd9877160c56108a2392b15fa03648997f80e601884f015934
MD5 06d49cb77c7f42e3dbbf050f717ce51a
SHA1 e62e1d5c20ef1cf3e59ce393437be1e2c1f36fbe
SHA512 ac233e3a8fc65dcd795cc07f053f4c89e4e9ee92ced4b0f1730b188fbf985af1b7353589a007effcc0a90bf8515b053b159361699d821c133667c0a40e8dcbfc
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0e8:+0s420bTjzGlBrJTJb8QAMQ/ZJ8
TLSH
T1B82623D6785E6AABC10D1C7A8E168E2575AC5BB1C7604CA3FFD53EF60810D932633932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
Size 4.7MB
SHA256 2dc21582fe054c6f3042b9fdf7794e708d5b91d1966a6360111640834f3104aa
MD5 0ba7d5f442ed78acc0f5302d6a1b020e
SHA1 b730c5da25d17f388f638433aabee6397f921739
SHA512 861260628059975275530798248f221a4aec6bbac3629c45fab9fed6601ac3317ce16adb3c6afa01f73ea70aab0e4890e0643fe70063d498efc82f73bba9e2d5
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0ec3:+0s420bTjzGlBrJTJb8QAMQ/ZJM
TLSH
T1393623E6785E6AA7C10D2C7A8E168E2535AC5BB1C7604CD3FFD53EF60850D932632932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
Size 4.8MB
SHA256 c2f6465e8783eda202d75e9022a5f98a74d9707141abc9a7ce0604905a0395fc
MD5 69a2503179bd3f288bd86bc8b34f2501
SHA1 bddf7266db3defabe27534ac8a18329801d6bfea
SHA512 9d4237b3cb7e205c385894f0031637da72302fbf6a694d59a0c7d363899c68a4e4f98814dbf54065a80555ff0a76fa9be81acb00a418b29386b0b62670e1151f
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0ecO:+0s420bTjzGlBrJTJb8QAMQ/ZJZ
TLSH
T1E23623D6789E2AA7C10D2C7E8E168E2575AC5BB1C7604CE3FFD43DB64850D932632932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 4.5MB
SHA256 f8842822183e123a900b3ea06fb57d3cbbb3a181754e8d4e95ef1d7d30db58ac
MD5 441c33ae7d0e713fec081ff2959c1954
SHA1 528b48570fa1db828062c79984f39f32284f314b
SHA512 7545e33647be5a5d3bdd098d14883de031529376f3711225e61eb2caff9ad566220c941480efbed10818d3167b823af6c50afab46f2149339e63193e07e25aab
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0ecD:+0s420bTjzGlBrJTJb8QAMQ/ZJe
TLSH
T10A2623E6785E6AA7C10D1C7A8E168E2675AC5BB1C7604CD3FFD53EB60810D932633932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
Size 4.9MB
SHA256 a5fae1381977c3a45bef0e3f0f5e591bdbf70982a95910846aee7d5b8704b00f
MD5 cd00336af488514f221e7b86fff42323
SHA1 91f01210f85888b1e3e2e7c8a2a124a32483145d
SHA512 59b757a37eb3bacf34dd934f57f2353b01a727db322c3a8fac81c9904c982d2673268a93cef932d2cdaa1cf3354d7c419df4bfa0755e1888cf7c90be2e8f7dfa
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0eciT:+0s420bTjzGlBrJTJb8QAMQ/ZJ/
TLSH
T1B83623E6789E2AA7C10D1C7E8D168E2635AC5BB1C7604CE3FFD53DB64850D932632932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download