ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
Size 4.8MB
Sample260826-wqsx8aef42
SHA256 ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c
MD5 27f157eee754c83388f1186973a9c192
SHA1 64357275817fc61efc3c4a4c3acd4775f010b3c2
SHA512 e1c01e3620c93b6f8f44dbc83a9d4ccbf894cef29145a7bc01aa5d6e2b53f21ca034df5771c0b7d3734833a47ca48cf8dd11f1f50e8f1e77d7c826b73d74a6df
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C8s:+0s420bTjzGlBrJTJb8QAMQ/ZH8s
TLSH
T1AF3623D6785E6AABC10D2C7E8E168E2675AC5B71C7644CA3FFC53DB70810D932633922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1336	UpdateService.exe

Executes dropped EXE 16 IoCs

pid	Process
1336	UpdateService.exe
932	UpdateService.exe
4456	BackgroundTask.exe
4816	BackgroundTask.exe
940	UserSession.exe
4120	UserSession.exe
2504	SecurityCore.exe
5520	SecurityCore.exe
6116	ServiceHost.exe
2568	ServiceHost.exe
5576	ServiceHost.exe
5560	ServiceHost.exe
2364	ServiceHost.exe
612	ServiceHost.exe
1436	DesktopWindowManager.exe
2160	DesktopWindowManager.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\ServiceHost.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\UserSession.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\SecurityCore.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\UpdateService.exe\""	ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
66	raw.githubusercontent.com
78	raw.githubusercontent.com
1	raw.githubusercontent.com
28	raw.githubusercontent.com
41	raw.githubusercontent.com
53	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c528-12.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c52b-72.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c52f-109.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016ab2-166.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af3-202.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016af6-237.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016af3-271.dat	suspicious_telegram_bot
behavioral2/files/0x0006000000016af6-305.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
552	ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
552	ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
552	ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
552	ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
552	ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
552	ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
552	ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
552	ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
1336	UpdateService.exe
1336	UpdateService.exe
1336	UpdateService.exe
1336	UpdateService.exe
1336	UpdateService.exe
1336	UpdateService.exe
1336	UpdateService.exe
1336	UpdateService.exe
1336	UpdateService.exe
1336	UpdateService.exe
4816	BackgroundTask.exe
4816	BackgroundTask.exe
4816	BackgroundTask.exe
4816	BackgroundTask.exe
4456	BackgroundTask.exe
4456	BackgroundTask.exe
4456	BackgroundTask.exe
4456	BackgroundTask.exe
4456	BackgroundTask.exe
4456	BackgroundTask.exe
4456	BackgroundTask.exe
4456	BackgroundTask.exe
940	UserSession.exe
940	UserSession.exe
940	UserSession.exe
940	UserSession.exe
940	UserSession.exe
940	UserSession.exe
940	UserSession.exe
940	UserSession.exe
940	UserSession.exe
940	UserSession.exe
940	UserSession.exe
940	UserSession.exe
4120	UserSession.exe
4120	UserSession.exe
4120	UserSession.exe
4120	UserSession.exe
4120	UserSession.exe
4120	UserSession.exe
4120	UserSession.exe
4120	UserSession.exe
5520	SecurityCore.exe
5520	SecurityCore.exe
5520	SecurityCore.exe
5520	SecurityCore.exe
5520	SecurityCore.exe
5520	SecurityCore.exe
5520	SecurityCore.exe
5520	SecurityCore.exe
6116	ServiceHost.exe
6116	ServiceHost.exe
6116	ServiceHost.exe
6116	ServiceHost.exe
2568	ServiceHost.exe
2568	ServiceHost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 932	552	ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe	91
PID 1336 wrote to memory of 4816	1336	UpdateService.exe	94
PID 4456 wrote to memory of 940	4456	BackgroundTask.exe	96
PID 4120 wrote to memory of 2504	4120	UserSession.exe	99
PID 5520 wrote to memory of 6116	5520	SecurityCore.exe	103
PID 2568 wrote to memory of 5576	2568	ServiceHost.exe	105
PID 5560 wrote to memory of 2364	5560	ServiceHost.exe	108
PID 612 wrote to memory of 1436	612	ServiceHost.exe	111

C:\Users\Admin\AppData\Local\Temp\ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe
"C:\Users\Admin\AppData\Local\Temp\ed78eb9d77930292072ef275ff4b323581d3b09e131485233219878f31a5ed3c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Temp\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:932

C:\Users\Admin\AppData\Local\Temp\UpdateService.exe
"C:\Users\Admin\AppData\Local\Temp\\UpdateService.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4816

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:940

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2504

C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Temp\\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6116

C:\Users\Admin\AppData\Local\Temp\Diagnostics\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5576

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2364

C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Temp\\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:612
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1436

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 282B
SHA256 55fc8e1cdf129ad0a0206ec4abb9519e7ad53b812897eb11a2c62d6bb15f62c3
MD5 bc7468705f79afa8503bb51682f2b8c3
SHA1 d1ad73df3213f4e1ef816b66105eb7106ba453a1
SHA512 62b0d1b157602c7e2d3b0254567d6ea446d1d92bba31e09ac4054e612e9d2392737ff3779f65fa9ab85485231485f45a7a3e24fbd1ed6fed7e33e7938eb64e13
TLSH
T1DFD02B46A9BBA412BE72D99044D1F530740124B215E029323C2C8AAAA930569D707D64
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 4ac6be04c3b7edda3d1e5fcd4e5d3df0661b440da4f0d3010c104bb731b57e5f
MD5 009230906fddac45d4b61a284d9d6da7
SHA1 6a7e9872464e04d99b1c38bcbb50f12c907d34bf
SHA512 2484dfc965146ca552d2e87fda4e63966b4c2a541f57be3d4672734d869c23af431e75d0bd17c8b1672323fbc42c4afcc2458d6f2d74d3e716a0aaf50ff73137
TLSH
T117E07D0E072C45C7E622C6100B9245B63C91144D04C2452A74289BD7CD421278907090
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 36a8f4ca7ad3f8871f83af4174cea8c55d797e2b180e14e4b5f5a42e1eaaa2c8
MD5 1459f097bdbf5b8d1431c7596bc2e961
SHA1 94913daa2113ad1ae9e6eaba83b9e3b32a74144d
SHA512 8a86e33d7d67037f8c4f91b4e1f3f83ea92e8cb1f94071269e9551c1fd08ef629849dbf289a0f0f0afd0175c1f0725f7bc934947426df76ed2eccd3441ed0f51
TLSH
T1BC41F8DB2E6C3065FF41CF486878CA362E3CF2D15998150665F784B26456BE01E0B89C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 178KB
SHA256 fc41156e55275564480f408ce567a436e9dd06c18cb64ee204f2c9d039d5fca1
MD5 5e8ee0d45dc675c966f7804e030c188b
SHA1 67e0d239b31a421ec8f607fcbe60e49f61cb8235
SHA512 7f9ab17bbabffd6e1f72229526bc4e3bd98de8ed8a64b494cbde6a3570489664927c01065d8b317876ea50d9368d897bd9427726e5f8b03f06b3d7fccef0e702
SSDEEP 3072:X6xn47Q+K35Bgjr+CYHB4J/5m7mtsHMDhaZl:X6yU+K8XJCB4J/5OsDh8l
TLSH
T181041BA45C3BB6A3AD07CF524DAEB69612E591C52912732E3E347E505C13ABFDB13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 06e16fc816cd78ffb99afac3ddb8b50e6aec5ca8ccc83e66de02bdcaae6d3567
MD5 51184e69ed2cb5631bf01411ef13d33d
SHA1 84c61f6ada63505cd720ca6ee0ac30270c5acb41
SHA512 15b935ce752932e8289f8523ed04c757bc6d4b011d385b170321b1ac6361cf7d413e43e9b355393e7fb14e276476ebbf58638670d1513fb9065755b7e0752296
TLSH
T1E91121C29FE4A09085F786B0CBF8D5337C7870C62DEB30C12C81C59220967186B1903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 9b7177232adc73630abaf5e8a9e6b6869d638ee0bdf36d811393a51977e67845
MD5 fed02a48ae8e7b952b8c1655be299255
SHA1 18efd452a8337ebef6e2f1564ecf4b34a45562af
SHA512 dda0843c09f093d54679474e32a10936628442e5e01ea046210dec838f56bece00e8e08da3ec821e426273e40068297fceb6b72de5ecdd2c1b170797bca91549
TLSH
T17641E9E71B063591FF02DF9519B5CA771D3CC890A1C00941B977C4D200CDB86661ECCC
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 d5c9981ca497021cfa5b6abb7059280ff6cae6505d94813290f60e62c2186055
MD5 e2fc68cb020e84284a624da06252f7d2
SHA1 b5684c7bd3c1dbd52aab17d9b697b34bd97b9bad
SHA512 7d2889a8f874f41b459d5faf2a9d65a851fa1cdc3149e8640c6c97c1de71f56ffca6fbf5bac653db96925ae7a5015d80293c47a12990d323bb0f797674609685
TLSH
T1FDF0A31034BC4218E072DC7DD6E472EAF517F1013808DEF61D570609AB469015D69A3D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a836df802dfad94cdd6f0c41ebf0e7f0b9ec86e02f5b9e6f523dee0b748b9af8
MD5 185b316ed7cfcf6c446e1275e1361585
SHA1 0bd39c7f123e1561e0f319de08ab07396f396b1e
SHA512 5bcc6ab13b6763bf0b0c7c7c31d51538634a5cb36fc92c87159ad05b100bfc722f4e1a2e35612c7a1f71b96ae13d478e438b3d4de540386cd5d7677ba2248629
TLSH
T118C08C2C1AA20A46F2A8437C02C139939B208101F6458F251AF53A08C996B163878C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 93e0554851d35f9e55db6c09cbb6c6918593a445ccc5562134022f1df99cdd8b
MD5 500f007ac3e06e4af256a8337c38158b
SHA1 8556273dc3d1b583adbacdd75ae7ef07dc67c1c6
SHA512 f97ec154d217804101c7fb0d34de1274478b19d5450c2f7eefb9e0d404939d1a58ac65cbbd3eb8f5c228d5ebc2565c7327d6f1a40f5545af818a20f365ecf788
TLSH
T191F05C3C1AF880AEE436DA795ED5A2F36D1EF112340802AC1ED48748DA06E006D5142A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 169eeaca6f326857b814006311e7819ff2bf3edd205a3ee9e5a81f4cff0bc070
MD5 eaee4a97373cb1f92543f05f0d5f683b
SHA1 494c277869f0c93c967ae4fd27b2d4598b21da52
SHA512 533b6b85a16cd9539d8a8eb86134e09cec7fe12aad2486e088aa7e2ea990aa6478f69f809fedf1c959befb801e1e97235d3bd14def4182c2a5ccac6ead75c90d
TLSH
T1B8F092643DFE913BF9379B3C13D572B44929F21735062ABA1A6013046E25F502C55509
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 39674ecffe529492e10b3b69a6d66f5c70b2f1822f30d7541a12abd2b9ab2010
MD5 a68b2dd2cc387a8d9a66f1a3f0178d85
SHA1 e31ee73118921709145903bb368cff228f4d59da
SHA512 373708c5d8b0787b45da6ac8f814182f4038c62573717e5bf863694aa952714e0c6c6cb66b3e3bc756c966f34114bb0592045b5f4b74e2d01025007a3623c4e4
TLSH
T11CD022202BC2021FF424063CACB40292EA603000F5434B8F5B23069C881EE620CD2C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 5af8556bb066ba8eb6c66257795c5ef1db548c8a3cddc99a551cd5fef631c888
MD5 e154145615d9cdc7ff0d17c1a278e80f
SHA1 ba03d5fbb7f2ca236bc8b43dc60a8818cb560666
SHA512 4ec2cbad0f4f76882ca38cdb3311a01cc1d71d359f0461d26536f8b8142499e9cd4c4a3567d691e2c3614e9b77744e0031c955ef200cab6495d3ad4ad5ce0a79
TLSH
T1AAF0A32417D1401EF27236794EFD53AADD15B1623401CCA416E6070AEA57F105D1153D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 a5e074accf575466edf85de50d232acfa27e16602549d345431b53ec05fc3cf4
MD5 6c6ca348173cce15d6b5a8ad3742df24
SHA1 4a22d6df608b578a54e480e24e4bcad261c98b49
SHA512 7428d046cfe7fd5714cef2e06caa3c025e2683681d3565e3c9f858acc50c02c6fda79d386aeb86db050f65820a3a84250a69114d1c109954ec458f434414fe12
TLSH
T1F3F0AB2A20EB020FF2A2E67802D49385C927F1773408366D76B213069D56E01B860918
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 3078b5535016737527fb67656736e6715e46150f16a8899e430df4bfe202b166
MD5 2467e2781a46c8dd9709bd9c01db604f
SHA1 7779fdd0954100d160b3a8de16b09e05661e01a7
SHA512 728af36450cc225860c02a6a966671d7cda650a741191a7c4af9aacccfe6fd64c8e5e686677fc9ccd77d3dc4b8745485463770ded895114243b9a1190bcd1835
TLSH
T1DAC08C1C06618716F2E887B812C229839A208110F381AF2126B12A08CD24F122835C29
MD5 SHA1 SHA512 TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
Size 5.1MB
SHA256 a6fd2a69db000345788c598d4869c86ab5781ab7f0c9adfe7af577dc640bb45f
MD5 2ed4df8dde2778e30ac02430f5cc87e2
SHA1 d7cff899fcaf4a231b17109469fffc014506e128
SHA512 f380077be58191e8724a7a9d0acf1552e3008f038795111b5f17901c7b3eeca1e99400e39923eb0645e9a017444e1fca4378f7c3bdc5b67974238c1841308360
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C8HKxVQG:+0s420bTjzGlBrJTJb8QAMQ/ZH8HyGG
TLSH
T1184623D6785E6AABC10D2C7E8D168E2675AC1B61C7604CE3FFC53EB74850D932633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\ServiceHost.exe
Size 5.4MB
SHA256 6616efd7bd0c94985e5987e537cb1aaec5b60dec073e566b92147381d1a66b11
MD5 ddb92629d312095bdf7576f1372ce050
SHA1 7812f59a57e9c61087c28a9780d545575b163603
SHA512 98144ebf9fe14e907ce86cb9bf8df564a6e58eab8a45ee181e7a854695f225deb14495cf894bf78c2eb456a4716dbef4d283d285d9b40f1bb046478efa4c7330
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C8HKxVQRP1R:+0s420bTjzGlBrJTJb8QAMQ/ZH8HyGRv
TLSH
T12B4623D6789E6AABC10D2C7E8D168E2675AC5B71C7644C93FFC53EB74810C932632D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
Size 5.3MB
SHA256 c417aec8f7638e3cd0dc0b604f86147ae3d6fb292e288780f196a30b7b8024e5
MD5 cfab812737fb66aebaa82ea22274e782
SHA1 372d9295df4dd55636db232c0cad033a0b7924dd
SHA512 88c78cf0f50320503c24d9fde67fbdc80b5e13830fa4e7ef2d36d8f8b3f9d6a9f1ea0e95c0621dfa5bc6d4ff98cf635636414325f300457028bce0eb893e4bf3
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C8HKxVQRP13:+0s420bTjzGlBrJTJb8QAMQ/ZH8HyGRp
TLSH
T1CA4623D6785E6AABC10D2C7E8D168E2675AC5B61C7644CE3FFC53EB74810C932632D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
Size 5.6MB
SHA256 89e461f8a0eeebbadf62187e8efbc65ef471cab307bc88d513e16ea81cac5951
MD5 d09a07e467deddd512b4876bedd9433f
SHA1 93e4e0897f44f68b6497ae4be6db996a01974ff4
SHA512 52f616ba073e41f8acf5f27b138aa31371902dda1c040c99c5a9ed0391c538714e5eb7e05e712b8c2c4658c8e35dc753159232027eceaaa764d00f2fc631eb1a
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C8HKxVQRP1ucNn:+0s420bTjzGlBrJTJb8QAMQ/ZH8HyGRR
TLSH
T1D14623D6789E6AABC10D6C7A8E168E2635AC5B71C7644CA3FFC53DB70850CD31632D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Temp\UpdateService.exe
Size 4.9MB
SHA256 1945708e9d9ce409c48be38c4455c7d25b2235764f78891aaf58e288d745ddcb
MD5 daaabd8eb1099c5d42731e5579cb38c3
SHA1 0a3943d5ba332b47084d054292751175913b0781
SHA512 7bee9595d711b949dd4887639805336f6a006f68ea8c9d5306604554fd70f2eec2f62c5ee4343b56e9d084f46f2e34ee7321f9ff0c41754b7860edf92be86545
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C8p:+0s420bTjzGlBrJTJb8QAMQ/ZH8p
TLSH
T1A43623D6789E6AABC10D2C7E8D168E2675AC5B71C7644CA3FFC53DB70810D932633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
Size 5.5MB
SHA256 e2e823fc63f3ce614443e5c24afc7f3372a9747830e27d3ef4d2d2c3a976e890
MD5 fa9fbcc17ddaa625f44931e84b11a484
SHA1 3a06635542ee1f12480e137d5cd270338b561658
SHA512 43d18c32f441d183e02c2abe7147ac444aa1cc5d6e2efefd21b58f18abca0ff962b8eab6774d05e91a9944104c7f0cb20ee54043b38ed9cb995def23182ae887
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C8HKxVQRP1uv:+0s420bTjzGlBrJTJb8QAMQ/ZH8HyGR6
TLSH
T1A84623D6789E6AABC10D2C7A8D168E2635AC5B71C7644CA3FFC53DB74850C932732D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
Size 5.0MB
SHA256 7057f428e6038188790e997d439abfdb63ba51978e712ccab14eb9ad2eb0e14e
MD5 96c51d553551665508ef27f06bcf3fb8
SHA1 7ba988f9efc6acf9a8ce4156621234a8e0e4fc18
SHA512 d18a3add3d74804399149e41aac3451bf3596e32bde3146bd2574e2909f43b9681e187ac40233eef3c87cf5d28605477679dc1380dce65c20880e32275551f70
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C8HK9:+0s420bTjzGlBrJTJb8QAMQ/ZH8Ho
TLSH
T1AC3623D6785E6AABC10D2C7E8E168E2575AC5B71C7644CA3FFC53EB74810C932633922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 5.7MB
SHA256 2d9d6053ea372af11b05c304c36931edb9fb1678e2d04490174eaaa4e301e556
MD5 8681069cb6256d4a2e8d3758860fbf4c
SHA1 7482b8d9498b9f1c869a556ff0cf6216f5417b9e
SHA512 90c95f333458389488eb722855286d9aff8453cde0f75bf3c5dc498508651995c501391da6a54533c1270ba6b2d980597b5c81d563f516e89d7cebc0feb18e3b
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0C8HKxVQRP1ucNMG:+0s420bTjzGlBrJTJb8QAMQ/ZH8HyGRf
TLSH
T1165623D578AE6AABC10D6C7E8E168E2675AC5B71C7744CA3FFC43DB74810C931632922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download