11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
Size 5.5MB
Sample260905-tkwe2svwds
SHA256 11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc
MD5 04319f0c5cefb74e5b179d171aa283d8
SHA1 d95e070d5cf514c2efb51917ad2619447f0dfa42
SHA512 88ff875da9dd6017e9b2d8bab04dc72a22795f50f6321dfb144c1444b0783eb215e99399bc7de91c7010a5aad961853302305b9df6cbeaf7a3898de666fb4922
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT66wNeyCVQSCHM/Pp7:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGG
TLSH
T1784623E5786E5AABC10E1C7E8E4ACE6275EC5BB187545C97FFC53EB70810C831623922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	InputService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	BackgroundTask.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	WindowsHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	UserSession.exe

Deletes itself 1 IoCs

pid	Process
4748	InputService.exe

Executes dropped EXE 10 IoCs

pid	Process
4140	InputService.exe
4748	InputService.exe
5048	BackgroundTask.exe
4592	BackgroundTask.exe
4220	WindowsHost.exe
3736	WindowsHost.exe
2300	UserSession.exe
3844	UserSession.exe
3168	WindowsShell.exe
4900	WindowsShell.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsHost.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\UserSession.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsShell.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\InputService.exe\""	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\BackgroundTask.exe\""	InputService.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
43	raw.githubusercontent.com
44	raw.githubusercontent.com
71	raw.githubusercontent.com
87	raw.githubusercontent.com
108	raw.githubusercontent.com

Detect suspicious telegram bot 5 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x0007000000024587-10.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024599-95.dat	suspicious_telegram_bot
behavioral1/files/0x00070000000245a6-130.dat	suspicious_telegram_bot
behavioral1/files/0x00070000000245aa-177.dat	suspicious_telegram_bot
behavioral1/files/0x0003000000000729-214.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	InputService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	BackgroundTask.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UserSession.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4364	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4364	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4364	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4364	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4364	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4364	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4364	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4364	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4140	InputService.exe
4140	InputService.exe
4140	InputService.exe
4140	InputService.exe
4748	InputService.exe
4748	InputService.exe
4748	InputService.exe
4748	InputService.exe
4748	InputService.exe
4748	InputService.exe
4748	InputService.exe
4748	InputService.exe
4748	InputService.exe
4748	InputService.exe
5048	BackgroundTask.exe
5048	BackgroundTask.exe
5048	BackgroundTask.exe
5048	BackgroundTask.exe
4592	BackgroundTask.exe
4592	BackgroundTask.exe
4592	BackgroundTask.exe
4592	BackgroundTask.exe
4592	BackgroundTask.exe
4592	BackgroundTask.exe
4592	BackgroundTask.exe
4592	BackgroundTask.exe
4220	WindowsHost.exe
4220	WindowsHost.exe
4220	WindowsHost.exe
4220	WindowsHost.exe
3736	WindowsHost.exe
3736	WindowsHost.exe
3736	WindowsHost.exe
3736	WindowsHost.exe
3736	WindowsHost.exe
3736	WindowsHost.exe
3736	WindowsHost.exe
3736	WindowsHost.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
3844	UserSession.exe
3844	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe
2300	UserSession.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4140	4364	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe	88
PID 4748 wrote to memory of 5048	4748	InputService.exe	99
PID 4592 wrote to memory of 4220	4592	BackgroundTask.exe	101
PID 3736 wrote to memory of 2300	3736	WindowsHost.exe	104
PID 3844 wrote to memory of 3168	3844	UserSession.exe	108

C:\Users\Admin\AppData\Local\Temp\11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
"C:\Users\Admin\AppData\Local\Temp\11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe"
1⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5048

C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\BackgroundTask.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4220

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3168

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 98b08bf802d3d70ca602982880b93dbb801c895753dba08530d7e48711c3b546
MD5 768e6de192ca683c67c5e614eeb9d0a1
SHA1 c5911d32089d885b4335e20c6f6c7f18fec9e551
SHA512 682b20036b82c777ccc6cce0280675b7a746a5f7193c6d4a5d014dbe2542b460498306b7165672fa33f19e11b9de5f53421c1e1615f86826c1326beeb0d6d4e1
TLSH
T10AE07D12676DC2C862538A248DF4A4B57CA9320F14974288592E77C109156BDD10F11B
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 60f59a399a0529e2ab79b05afc360652ee7a438e0a91c06b0182fc56a181958e
MD5 230459805282ab4afbe6d94f4daafc87
SHA1 f15fb0191b7e7f6cd35c1d6686847de8f8007577
SHA512 081f1adf167fdb2a176efada662fea0eba9e518f63dc14cbfed97de8d4185fa0c3e6e58a2c85b4a22c3fda184d6521226e586d2fc64e2afb144d4bbdeab98392
TLSH
T1AC41D7D96E68B425BFC48F45A978CF317E38F290899914A530FFC4A3B886B941C0EC5C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 282B
SHA256 08a447ef3dd66240110691dc7174d29d4713d55ba3d3dec4176a5d46ce38ef6a
MD5 38883942b39a34806ead8be5151db2c1
SHA1 d1463bff0fef81b3dd244e5e2c9097e8ef88a008
SHA512 f617f80fd886e3acce20d7dbb323d9064774dcc949bb8ee5a8bbcdddaf92e38a7edfb88100c7d79d2b0109714f2bbcea0f6bb0193775d5f4cae6941aa51eecac
TLSH
T131D02B1794F5C4A73912DD0019CDF93075135A7B13D8595A780DA9559D119785F0206C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 180KB
SHA256 2c30ddd9ff9a83f76f63ec3841f0c577a17640115afe4cfdfae69a2c46bf0ec0
MD5 774f98d2436af6f16ab7da7f31ca7ee6
SHA1 0a6b0faa616e6a7e982b73d1b395d8845faae68c
SHA512 7baf5304dc701f45f4aff142899f329c80f865d0035b214ad37f9f885d8ec03bff86f79ddae64ddd2409c0b5bc2a034999cb2034e3366d477d2d694cea37120a
SSDEEP 3072:QrX7agxEAXwPxTmG/HCYSAvyTGVeqJqtvE:QrP20OxTT/QpyVeOaM
TLSH
T1A6043AA45C7BB6A35D4BCE624CAEF69612F551D92812732A7E307E505C03ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 30f504672eae158fef37cea05717efaf81542874bb9df13e837cfaa5c1ac98f0
MD5 3fdaa97d3627ca74e0f5c805829d6940
SHA1 4f729b8e34548e910fa9d9176d3835cc65a6c0bb
SHA512 92b15425620781884540003fec93a1286d997c2b9500f0227a1681a5fe153df22991c952b255852b400705ee12bb0944e7668da661a52c70261190617d05240f
TLSH
T1EC1121821FB5E09085E656B4CAE8C1357C75748768EB74D12C9288932856B2DAB0643F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 48a71ec1ad54675b6ff6b9bdbc936ae42a6d12ccfa358439377e9281dbfdc764
MD5 191501f5fdcda850c2151355051205e4
SHA1 3d7f5c222a4743b8bcb2aaa6a5a16bdde3359f44
SHA512 427ef21d475580b60e3410f962e4d6897dcee3c1d73e26249e048d20e5264e15f30c1ff7508e4195674cd04fe526277f9bfe569d5e1c1dfea2b272d3345ace98
TLSH
T14741C7E76A093474BE418F8A55F8C5311E3C82ACA1801981F47AC0D1009EB956C4E4CC
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 25765ac1999e42c3f82ddca691938d42fa0849716303eab9a70c99d59b9e1b4e
MD5 fd8049a6de49b486151f347d72fffa2a
SHA1 dbaa206e9ea8bcbb2b559e479aa9f4f8f6e35dad
SHA512 1b5a87af0a69cb5dff32f4e75378f6bc205272bba108b3689641428e3d85971810910f86e95818fbf0ba612783bd5073509223b88c7a3a1bdd48716af536bcf2
TLSH
T1DDC08C1C1AA20A16F2A8437C02C17903AB218101E6418F191AF22A08CA96B162838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 3f6966904fa09dcceb18f104290993cbe00c0d4182b342e65fb3ffeb63ed1d1e
MD5 4d8185dcba48aa6739d63b1d8f937b24
SHA1 7aa0e9fa8c7ee429d8f2bbdad889be4e3395da9f
SHA512 0985c5a0ccfdd26ade6a7ce6d87a32a08792268eff351b267a1bacf97e0a106a58a878a6d8c22a0d2d653290c01acfb65dc38bf2f683106fa356755545b6abb4
TLSH
T128F05C2C07FC402CE032CFB9C6E5B266ED16F117240446EA0E93470C5E02F011C5153E
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 833a1d8997725a146dd6d706f049e4d31f1bb20302d491e5558b9817367237f3
MD5 9b2d6d020ed0ee85a7168dcd3cd15d2c
SHA1 e3e979b7fd36cebe5fdd8dd5d6b7b05a63e1a5d0
SHA512 44474d85ca4fbab9505e24c6bf522998b0e015db7f4110e3e870855407ff00643f5245bf9ca2580cd28d2c4b52d08bc6c1cdb2eb378f2e264ff97d007f3607ec
TLSH
T1B3F0683038FE403FF132AA3A47C133F1A836F20A3C066BBA697103056F5AE252C9151A
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 0555ede8d8875b9bc85edc773dd3c6fb969529c61fba62f34e4b4108d543e0aa
MD5 ed3a85771499cf8c9be48f117b6f26bf
SHA1 9e22367fc9083abba46a5da8c034dbff5a87e016
SHA512 7e720c4b64a54889478e35d31ae3f39bb2b508f1159762c1aece37bff69337659243e7fea31f23b7a1b21e4474674e7b6ffecbeff8db045a266734488dc91701
TLSH
T1D8F0230415BC4059F0F2F978C2E567FBD935F125681A5AF60EA607095B12A421E5192E
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 e9942a5f056c27ef21318b714817561a311c480edf58794ecd6bfff8719ed45d
MD5 a710b6ad0761f4c2a283cb6d7bda5069
SHA1 b2c7f85b46ad11dafd7957952ec147d8e01c230a
SHA512 9093775c80476282c861045d49a4919728beb06c1225be59713127e054d7e97433024c8a45968a6644c8d0cacf9029fadee4769717b75d16bc1f929a43cd9288
TLSH
T117D022382B821329F03A833E8CE026102EB02428F5808B0C3FB0420D8C28B220CD0D0E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 2e6f5ba3df5eae2759c3a6b3bdbda672f05ab74c26e6eab7a673f76de48aa324
MD5 d7ebed40e7c816826fe9b1efe4b2add8
SHA1 d87602ce86b9a1778ee3da86cd10ff369e2c9ade
SHA512 137a5af13b59fc7334d7f9b2c18c3ce188af8552a066c63fac949fbf0b032ce5cf067d347e73af38f06cdde1fe685e49890c6051b19851e13cd1ce28be7dce3e
TLSH
T148F055242AE640BEE631277586F4D399D90AB2563801DA6616E60A0AFB0BE002D1243D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 7828795289de1cf0ae7069d30379e654f6ca1403d49a3f7d6dd7e032186ca8a1
MD5 844a6b18f37de8599081bb3634ff1fbc
SHA1 24b4a8acd070a5312893f5144ded2ace7b42325d
SHA512 ee6bdf196729f7ac9694ba964cbbb154e9e11c51db15922bba4cf994aea95f691f8b50d2e8c93812a5e4308d89e651a07a29d8c97e25fbbd3cd4b346f00d7a9a
TLSH
T161F0EC3D15EB065FF132D5BC06C096D59512E13B31452B697BB1520D5E55A01A960D11
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 1f3c173b02d2fc9e82dc13e00f38f65ded957a25ea3d2a85f4272504561cd4dc
MD5 d94e2110464561d4d286f8caf94cba04
SHA1 1c8795000e38a97aefe984ee89d4226aff5672a9
SHA512 a298c6733d9e44c65e0951d44639b98f8404a397ed3e80ab412319b0b80011edbbad748b0dfaaf74ece25ada70ef8e7c76aa4a8dfd35be64770ba7331ecc9fbd
TLSH
T140C08C1C0A610A06F2A893BC02D239838A208110F7829F0126B22A1CCE24F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
Size 5.6MB
SHA256 d7f0af3184c56e6fba97b49bccf4423e3734878e591ebf40a0c75d6aa6f473d2
MD5 5880be4e05caada0abba193af0f2dce4
SHA1 ec9dbb80c3462d80846581f949797594329cc78e
SHA512 b64b46579bb871e9549e2de144e04f991802b914c90d003390c22fd4e8e770dc2c6bbddd00e4bef455422a0768c15d0128a5e46f20919fbe13cba8f675996772
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT66wNeyCVQSCHM/Ppif:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGr
TLSH
T1124623E57C6E5AABC10E1C7E8E4ACE6275EC5BB1C7545CA7FFC53EB70810C421622922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
Size 5.9MB
SHA256 09c8ede0f29ce4fe4e793c4bd1e68462f2a2b90e62b14269f192cab8d48fab4a
MD5 44ebd14a51db03b7c134d36ce50ea310
SHA1 cfc31c4d15a1241ac278cfe530e63f13e3a37020
SHA512 3d5971fc97ae68282f0fa2834ec5838c6e1e8e7983c5688e19279abab7fd4cc9f4801b63bbe68033baf869ccee589583998d204c7b258fa8cac9c21c07a2b33f
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT66wNeyCVQSCHM/Ppi72f6f:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGj
TLSH
T12B5623E57C6E5AABC10E1C7E8E4BCE2235EC5BB1C7544CA7FFC53EB64850C521622922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\BackgroundTask.exe
Size 5.7MB
SHA256 fcbc6b6a4f801c93efef91d2e4ac496a5e6647419249c2818a4270cb8b7cbed6
MD5 c9a522fc4207365a74e93b4c1560762e
SHA1 55bc2ca7267d2aa9d521d75b797e4dfab1937810
SHA512 0c0960135a5123008ac4dfc38b626add504ad19bfa9f2bc921e75f8d94f8f02d55742535d748321c97d824b8ee908d8a503d6ee1f8a7ebeb144b29eadb57f2ce
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT66wNeyCVQSCHM/PpiF:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGh
TLSH
T1D85623E57C5E5AABC10E1C7E8E4BCE2235EC5BB1C7545CA7FFC63EB60850C521622922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
Size 6.0MB
SHA256 a128d6bdb11a78b48528362a61f188a5cbc2f8c4e0d5fd6d35b56e2f7d262784
MD5 a77cb37649f4c51cf81f697430bde1e8
SHA1 a196d591e3b981a83f0ee1e75b7890bc6bbedfc6
SHA512 170c90d4d17085ee61e5d6e74b21f7dc99ff4a4cbe6cf1c8f9baefe9d6a337f77826d9730e3542b1e27c367071fb1f94fb2dfcf2fa85fd2c88c75b04a4cb453f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGSCHgjko:TDpbgBr/4QAMQWvcyo7v
TLSH
T1025623E57C6E5AABC10E1C7E8E4BCE2235EC5BB1C7544CA7FFC53EB64850C521622922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
Size 5.8MB
SHA256 2463e30bcf7b18a5ed11c8d8a480a0ab879f0671a358f5031e8379bf2cd99c3a
MD5 352a269b0d4d73fcacd572d927a15733
SHA1 de4395017eabd72104fb20be58a2c1afc2d84013
SHA512 572b045df5d82e9a6d926be36abca0f8f490d906607845372f1a576ff3d17ccd023e3a3ad0a22018ae498870dc43aeb3241ed37c904bde39cc9768f8baf09146
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT66wNeyCVQSCHM/Ppi72fq:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGb
TLSH
T1695623E57C5E5AABC10E1C7E8E4BCE2235EC5BB1C7544CA7FFC53EB64850C521622A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download