afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d

Analysis

max time kernel
146s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
Size 5.1MB
Sample260825-vang5awdkd
SHA256 afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d
MD5 20f00ed014ffed0dd57d16f710b51d24
SHA1 bfcaac6f78e9ce22025aacd4ef520984ceb0d399
SHA512 1e81f1887a3e54c84619dd5cec6a2261518611411c9a5c872bc54e63ecd6bdd75a309f3a6a8e225e85ae2965a8dd6c537f751049bb4f049c5e6ea8acab4cfdc6
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ06PjZ92yYCW0:+0s420bTjzGlBrJTJb8QAMQ/ZpFQyY+
TLSH
T1D13623D6785E6AABC10D1C7A8E168E2575AC5BB1C7604CA3FFD43EB74850C932732932
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3784	WindowsHost.exe

Executes dropped EXE 18 IoCs

pid	Process
3784	WindowsHost.exe
2344	WindowsHost.exe
1732	DesktopWindowManager.exe
1244	DesktopWindowManager.exe
4720	ServiceHost.exe
3260	ServiceHost.exe
1680	InputService.exe
4420	InputService.exe
1072	RuntimeBroker32.exe
5800	RuntimeBroker32.exe
1184	SystemHost.exe
6000	SystemHost.exe
1864	WindowsShell.exe
4076	WindowsShell.exe
4956	BackgroundTask.exe
6124	BackgroundTask.exe
1428	ServiceHost.exe
5948	ServiceHost.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\InputService.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\RuntimeBroker32.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsShell.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsHost.exe\""	afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SystemHost.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\BackgroundTask.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\ServiceHost.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ServiceHost.exe\""	DesktopWindowManager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
31	raw.githubusercontent.com
39	raw.githubusercontent.com
49	raw.githubusercontent.com
59	raw.githubusercontent.com
70	raw.githubusercontent.com
83	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c5c4-13.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5c5-74.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5c4-107.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016ace-118.dat	suspicious_telegram_bot
behavioral2/files/0x000200000001af66-156.dat	suspicious_telegram_bot
behavioral2/files/0x000200000001af68-197.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001af66-234.dat	suspicious_telegram_bot
behavioral2/files/0x000500000001b165-269.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001b226-297.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2764	afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
2764	afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
2764	afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
2764	afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
2764	afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
2764	afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
2764	afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
2764	afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
3784	WindowsHost.exe
3784	WindowsHost.exe
3784	WindowsHost.exe
3784	WindowsHost.exe
3784	WindowsHost.exe
3784	WindowsHost.exe
3784	WindowsHost.exe
3784	WindowsHost.exe
3784	WindowsHost.exe
3784	WindowsHost.exe
1732	DesktopWindowManager.exe
1732	DesktopWindowManager.exe
1244	DesktopWindowManager.exe
1244	DesktopWindowManager.exe
1732	DesktopWindowManager.exe
1732	DesktopWindowManager.exe
1244	DesktopWindowManager.exe
1244	DesktopWindowManager.exe
1244	DesktopWindowManager.exe
1244	DesktopWindowManager.exe
1244	DesktopWindowManager.exe
1244	DesktopWindowManager.exe
3260	ServiceHost.exe
3260	ServiceHost.exe
3260	ServiceHost.exe
3260	ServiceHost.exe
3260	ServiceHost.exe
3260	ServiceHost.exe
3260	ServiceHost.exe
3260	ServiceHost.exe
4720	ServiceHost.exe
4720	ServiceHost.exe
4720	ServiceHost.exe
4720	ServiceHost.exe
4720	ServiceHost.exe
4720	ServiceHost.exe
4720	ServiceHost.exe
4720	ServiceHost.exe
1680	InputService.exe
1680	InputService.exe
1680	InputService.exe
1680	InputService.exe
1680	InputService.exe
1680	InputService.exe
1680	InputService.exe
1680	InputService.exe
1680	InputService.exe
1680	InputService.exe
5800	RuntimeBroker32.exe
5800	RuntimeBroker32.exe
5800	RuntimeBroker32.exe
5800	RuntimeBroker32.exe
1072	RuntimeBroker32.exe
1072	RuntimeBroker32.exe
1072	RuntimeBroker32.exe
1072	RuntimeBroker32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2344	2764	afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe	92
PID 3784 wrote to memory of 1732	3784	WindowsHost.exe	93
PID 1244 wrote to memory of 3260	1244	DesktopWindowManager.exe	98
PID 4720 wrote to memory of 4420	4720	ServiceHost.exe	101
PID 1680 wrote to memory of 5800	1680	InputService.exe	104
PID 1072 wrote to memory of 6000	1072	RuntimeBroker32.exe	107
PID 1184 wrote to memory of 1864	1184	SystemHost.exe	108
PID 4076 wrote to memory of 4956	4076	WindowsShell.exe	111
PID 6124 wrote to memory of 5948	6124	BackgroundTask.exe	116

C:\Users\Admin\AppData\Local\Temp\afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe
"C:\Users\Admin\AppData\Local\Temp\afce534e80a1687d33423e418daacda0a11f8543bc1d4b3a4d589efc54b0271d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2344

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1732

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3260

C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Temp\\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4420

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5800

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6000

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1864

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4956

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5948

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 282B
SHA256 55fc8e1cdf129ad0a0206ec4abb9519e7ad53b812897eb11a2c62d6bb15f62c3
MD5 bc7468705f79afa8503bb51682f2b8c3
SHA1 d1ad73df3213f4e1ef816b66105eb7106ba453a1
SHA512 62b0d1b157602c7e2d3b0254567d6ea446d1d92bba31e09ac4054e612e9d2392737ff3779f65fa9ab85485231485f45a7a3e24fbd1ed6fed7e33e7938eb64e13
TLSH
T1DFD02B46A9BBA412BE72D99044D1F530740124B215E029323C2C8AAAA930569D707D64
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 9066534b093088a317bb7df20fec902d509d2b711c016a7d7600e2716cb4a79f
MD5 89d8bd33620c0cc6a7066158cc9551a9
SHA1 f358fa3cd3fc34fdc112817e3ac8489ac78de970
SHA512 d34f5dec12f5487e260ec7e5f257341e8bac0bcab006bb98e6a0b7b8c244cb330c2254529dd6dd0a1ea6c48c485a1a481aeae71d1c6e5091b2c39843fa85728d
TLSH
T1B1E0722A6B0C46843AA3CF2407E89C733C6A518964921215681897E20A426EEC30F29A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 46192fd99dd14ff84abbad0a5fe7f97bd5c0f69f6ccece10e35b752d5fdf0001
MD5 fa8c7b1c908e099bcc09dbf52a4197a4
SHA1 25dc527d3ffe7ac297410026b64a085492f91838
SHA512 224766911ec6fa418fc96f316f9a8b5883d7de4a719034c68bf651b7c65c08946c3b5efe22de9b781f6dacd936ff6eef477f3023c083ffe4271719c09771d2db
TLSH
T17F41F7D96B2C3464FF85CF8560BCC7362D7CF0806940A1A675FB84A13097FA44E0A88C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 175KB
SHA256 773121b352694c89359d8f1a20439a25a08375742d2082056a8822676c2c7d99
MD5 90a26b9fefbbc27f5424237bf25038d1
SHA1 0d853e9487a0bbb2395610e41324fa4ba77c8dbf
SHA512 59642457aad97d0be364a48d978302f6f3cb157729acac420fbdf3703167f5da90ef6de0ca48bbaa8caf51306a15856d65c5f7dd03a0ee7b56222a7b9e95855d
SSDEEP 3072:V6xnuMF+K35BgXrLCYHB4U/Am7R8sHMbhuJ4:V64u+K87WCB4U/Llsbh04
TLSH
T19E041BA85C3BB6A3AD07CF524DAEF69612E591C52912732E3E347E505C13ABFDA13C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 06e16fc816cd78ffb99afac3ddb8b50e6aec5ca8ccc83e66de02bdcaae6d3567
MD5 51184e69ed2cb5631bf01411ef13d33d
SHA1 84c61f6ada63505cd720ca6ee0ac30270c5acb41
SHA512 15b935ce752932e8289f8523ed04c757bc6d4b011d385b170321b1ac6361cf7d413e43e9b355393e7fb14e276476ebbf58638670d1513fb9065755b7e0752296
TLSH
T1E91121C29FE4A09085F786B0CBF8D5337C7870C62DEB30C12C81C59220967186B1903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 a76a7ad4c4e2370c88684ae00494244a210406d32358c6c2708ff0aac176b640
MD5 31ae3ba81d68fd29b1bf7ec888a2ad2d
SHA1 2a9908e8d0db9654091aea5cfefb406f167042f3
SHA512 7eed588fca686546b8758bcf2d2a21d1a8f5364c524b6323ff2ca6b1c4f1fc3267a36ba38cd94fc1f92b9314a11f3159ca90a5a37ca7b3aff76a1752df696877
TLSH
T14C41E7F71B493494FE46CF4F6AA8C4372E7AD490B284094279BBC9D504AF7802A4684C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 5ec16ea4959a4fb5dc9160e98ab2558b57e92250757c1776c4823fc4064c6eaa
MD5 c6d96fe036c5b658a09f4e9ab6148331
SHA1 3be6decbb9efda4ec5cc9b2b93cf5498a5692698
SHA512 1fae297a4fad1adfe0a74a7b5c055b6b9b724089892b9d2a2e559028baab1235f75ab65bd90ac5fa1815df773c22ee3fd00ff43523a66d010ba7c31560b438cb
TLSH
T1F0F0A31034BC425CD0B2DCBDD6E8B2E6FA16F1117808DAB61DA70605AB06D015D55A3D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 e3fcd0555bf35160a4321731130e3efb15f0bdeebdf9931480a008d29cc396fe
MD5 d15889948a06e923c2270175f5923d68
SHA1 449066b9a4b31fa26b96d6f4367d89c889831dc7
SHA512 b57b005b6de92fa4ac1f8bee2212e2266f5f8304e412fb5877644c536945d48c224f07cec5ab3bf7e12a2bac0c4735e86c70e7ce31e21f7fafaf3ef441faaf8c
TLSH
T1E9C08C2C1AA20A06F2A8837C12C13A039B208111E2428F091AF16A08D996B162838C6E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 5749d2f1e2864e48edf7a743260176f016d8f34c9f007c49e125a7ade09940f0
MD5 f8e4cf795d158019126a7bd1e5319e22
SHA1 648ca0ba3d82de853074901e1f091f5f59b75986
SHA512 59c128411deebf0f9d0dd9cb4e4456d3e1ce0445f56cfd3397775ddb8cc0ff4edb446be121cdd91cc2f4f295bfcda217a1502a8f679b07659f0e7a87375bb10a
TLSH
T109F05C2C06FC51BDE07ADA389FD9A7965C15F6331404469F16E1574D9B02F025C41465
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 28e233fff56044eb944457f2a9b0e758e39a3c19656f11852744fec0a0bc667c
MD5 a917c7407745548603086b2f029f1b27
SHA1 fd6b68d612bc68d838e88f36ea520678154f5332
SHA512 9ec6a0c48a28101238ae39dc554d7e456f1f0e3026557aa4a996c544d456fe63e0cfc7be682cd83e7bc6fbd08a8d5f2d6159632d05bfe4defcc8179394d0b8ca
TLSH
T1F9F02B1939FF5177F13AD97853C53071892AE21620412AB629F117096A41F607C41508
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 d6d20895b4564036f5f71cc43994f067257d9c82d9ee093576b15c408e11134b
MD5 e05ccd3935b58130ce4331506716d434
SHA1 333775f86414dfe2e3ad204cb5ff3ca54709ba4f
SHA512 90032a9157b86af645f967f42aef55810b1d5d2a174da221228a76d82a0320a36580c8979b00d685c4cea0dd54eb9075402fe0ab780de5cdb4898c5a8098dbe2
TLSH
T1CDD0223DAB520212FAA6C23D22B506C0AEB09032B0C03F199BF3254C4828D012E62C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 0053ec8af023cda74898bdec618441e8556c6fe86936b6c10dcc8c4faf15502e
MD5 e26d9cf8196399ff5b71319175269b38
SHA1 04cbcd8ba527e678508cb6e575bfb1101ade446c
SHA512 be103d9a80ca18ab981e65363266f42e26509012d1150f9691934543044d92160bb937811c6319458990ea3bcda2f4aa48c46c8d62801a215e6c2d0e4f5c4fbf
TLSH
T1B9F0A33516D3401EF27336394EFD53ABDD15B1663401CC9416F6470AEA17E105E1053D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 f367372122b7f8bdcb21f7ae149a6a287eea0ee4c142f671ebb20c7c5169fa41
MD5 40aef198c83694d06bd98fb8e1f546df
SHA1 443b8d149d5fed024e3e4912d988f567466ed483
SHA512 893e596185e77152a7b7fbd68fbc854c45857b0097de9dd5132417e835cf6c9978b0352ed59a4b06706c5951c97b1fd06d75c138f7ddc0a5fff438cc7a14713c
TLSH
T1BDF0AB3925F7011EF233DA7D43C403974123F1323248326A7AB023092F02D807970921
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 7b4e747dccfbfb39efc96d68f10e5644bae2131d3d8bb1ceb1d98e5b37c72258
MD5 75471979768b074e8eaa5b304a5b1bfa
SHA1 74b6d256172d81d2a0d28517418e40178d895741
SHA512 d267c48c7945bd348027298c27541174102b320bccceaf0aec890b4838e2e16e1a8fb2d558e5e16f9c5a41bdc88b6755f1becf5623f2ed3b5c9b172c6eea89f5
TLSH
T16AC08C2C06620606F2A883B812CA2E838B218510F3829F012AB56A08CD25F122834C69
MD5 SHA1 SHA512 TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
Size 6.0MB
SHA256 34521bb300aada90b759c8438bda43c57959ddb41cdb82e7533704bf1958f6fa
MD5 daf86d91708e71238e5e8a805da3fad6
SHA1 2ea7a5e29b7cb6ada69934cc0a25b556eff290d8
SHA512 c685a2780eabac749ac81317a58c47edeaad4699098ef2cb57d142f56b2780767949c705417ec9d244b9c6ea06b0de3f9c10f8e0a4dc7ffb075cb5fc09129e07
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ06PjZ92yYCWkAs6q:+0s420bTjzGlBrJTJb8QAMQ/ZpFQyYGZ
TLSH
T11C5623D6785E6AABC10D2C794E168E2675AC1BB1C7704CA3FFD52EF74900D932632932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
Size 5.4MB
SHA256 c28d4b050cbe60d81e9443e543eb3178373a6a86b24234a644d027b7dbc3583f
MD5 6cfd136614bde111b3c31130c9a0dde9
SHA1 8c3df1dc0bc7a33659479da789500316fa69c369
SHA512 d86ad6aad44bb160554db306631b34a7d0e89fd6bb8bf7b8f82d4fa3afdfcb80403dd8a668455650d1c78cddb41edf11ae05d3667f1ea7bd5401cd7198e90e50
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ06PjZ92yYCWk0:+0s420bTjzGlBrJTJb8QAMQ/ZpFQyYG0
TLSH
T1C14623E6789E6AABC10D1C7A4D168E2675AC0BB1C7604CA3FFD53DB74940D932732932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
Size 5.2MB
SHA256 13c84e158fb00782910b61ffe01d2603378651b8ac8672bd5d8253cbd12e3481
MD5 fd6b1fba6fd4b8fbc0c31414f2e4b49d
SHA1 391f836e711c006c2b4f6da354c8dedc6735eec3
SHA512 7b7804714ab332a12926201a3f1697c43c9e1c470a417117948ee1a804e8151dc964c2fb41aa02fed0edb3fca67bc14ace6d8cef5e30ad24c6000a9650ee1c38
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ06PjZ92yYCWB:+0s420bTjzGlBrJTJb8QAMQ/ZpFQyYP
TLSH
T1154623E6785E6AABC10D1C798D168E2675AC4BB1C7604CA3FFD53EF74840D932722932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\InputService.exe
Size 5.5MB
SHA256 37799392b76a843fab4a4a425fa034fbcbc94306d8338b7097081a3177998299
MD5 bf6352659c6d5744c243fc28b7963128
SHA1 f9f39bb451999424bb7714a73db2767739024447
SHA512 8309046fbe050b2c3ec395bb3a6b922456c75a207b83b933c056ee4dd5709786089d1b504ab7992065f44896b57ec84117818d41803a4f0173555ddee9c01b32
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ06PjZ92yYCWkAf:+0s420bTjzGlBrJTJb8QAMQ/ZpFQyYGM
TLSH
T1924623E6789E6AABC10D1C798D168E2675AC0BB1C7604CA3FFD53DB74940D932633932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
Size 5.7MB
SHA256 84658e9733f605da46fe6125794eda912689b700ba8a7b2a3ccacd092ed4df59
MD5 9b613504ca51a62f4cd3aee4ae0313f8
SHA1 89001aa35c37ada554fbf905b80f965bace61954
SHA512 f7de847b112105768efd654b413736488ac1c8f959598a8aacb29451d8ad69a070cd1926bf78fa2b742dc664ae29809611c42dde799a46a48d9cde32f0a4d549
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ06PjZ92yYCWkAW:+0s420bTjzGlBrJTJb8QAMQ/ZpFQyYGj
TLSH
T13D5623E6785E6AABC10D1C794E168E2675AC0BB1C7604CA3FFD53EF74840D932672932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
Size 5.6MB
SHA256 179c193d5c90fbe06e45f4a1aea925700181025da5972d58c3ea3404a3804a53
MD5 65bfa84faf86c7f36f118e82c82a14af
SHA1 ac73bdd72bf7cb9767b4486b0a4cbdce62accd9a
SHA512 937ef6950e5dc7c51ce8e82aad86d61c1c8653348f9aa3767aba26de75f90a61a3542dcbb0cfcd594c0b4875a8d95fe9d3363e3adc450f438c4eb0503fad68c6
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ06PjZ92yYCWkAO:+0s420bTjzGlBrJTJb8QAMQ/ZpFQyYGN
TLSH
T1935623E6789E6ABBC10D1C794D168E2675AC0BB1C7604CA3FFD53EF74840D932662932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
Size 5.8MB
SHA256 c333f84b7c17841f96b4822b5024130d709d2c8854c7c9f1295a02e0d031baf8
MD5 59eface2e573de0cc42f97389338e904
SHA1 6786fa648067310f01fa450ac8ec830d94b1bc38
SHA512 cd940b4fd9ff42982514c50e9d179163d79e7de510acee9c1293fda8962d97bb2f1082335ad43ca98bd2a5ed0ee18324d5f192a9819c40c2788646b60fa817f6
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ06PjZ92yYCWkAsN:+0s420bTjzGlBrJTJb8QAMQ/ZpFQyYGj
TLSH
T1EB5623E6785E6AABC10D1C794E168E2675AC0BB1C7604CA3FFD53EF74940D932632932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\ServiceHost.exe
Size 6.1MB
SHA256 9cffcace816a3640b739990641e0375c2b89baca5d551f1c1e761bf98c5f547c
MD5 3dd3270318fab2e3442401732f549663
SHA1 655e66ca9f53c200cd40a91a635763731a598327
SHA512 d923ceb57d0fcb5b63b4ffcbda6f36d859c2b2516815710a55e20df7899404c7c8aeec69ddcbd8df4b537b545d89a5d049c20d82747d3ca5927bfe8082ed67e1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZpFQyYGAd:TDpbgBr/4QAMQ/ZoXGi
TLSH
T1655623D6785E6AABC10D2C794E168E2675AC1BB1C7704CA3FFD13EB74900D932672932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 5.3MB
SHA256 609189fcbed63247413b9d4cb853b549ef367e92132e3c31c9565d2c3670e8fc
MD5 76fffafabcd61929601cf11f671a5fb5
SHA1 80c677284c165071c3411ec330cc785fa9ad732a
SHA512 e77605d9f48fbcfac96076b1da990ae2956c3f318960a6eaa5f16d4b98725758e714cd58f7067ac86c3f86a74dafcf8961b26b6bf0c257074ddc1d3bf37c39b6
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ06PjZ92yYCWr:+0s420bTjzGlBrJTJb8QAMQ/ZpFQyYR
TLSH
T1764623E6785E6AABC10D1C7A8D168E2675AC0BB1C7604CA3FFD53DF64940D932732932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download