11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
Size 5.5MB
Sample260905-tkwe2svwds
SHA256 11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc
MD5 04319f0c5cefb74e5b179d171aa283d8
SHA1 d95e070d5cf514c2efb51917ad2619447f0dfa42
SHA512 88ff875da9dd6017e9b2d8bab04dc72a22795f50f6321dfb144c1444b0783eb215e99399bc7de91c7010a5aad961853302305b9df6cbeaf7a3898de666fb4922
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT66wNeyCVQSCHM/Pp7:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGG
TLSH
T1784623E5786E5AABC10E1C7E8E4ACE6275EC5BB187545C97FFC53EB70810C831623922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1196	UpdateService.exe

Executes dropped EXE 10 IoCs

pid	Process
1196	UpdateService.exe
2764	UpdateService.exe
1260	UserSession.exe
4512	UserSession.exe
4688	WindowsHost.exe
5968	WindowsHost.exe
2092	NetworkHelper.exe
480	NetworkHelper.exe
2560	SecurityCore.exe
3376	SecurityCore.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UpdateService.exe\""	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\UserSession.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsHost.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\NetworkHelper.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\SecurityCore.exe\""	NetworkHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
22	raw.githubusercontent.com
23	raw.githubusercontent.com
45	raw.githubusercontent.com
64	raw.githubusercontent.com
81	raw.githubusercontent.com

Detect suspicious telegram bot 5 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c4b8-18.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4c3-45.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016ab0-85.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af2-118.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016ab0-125.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4140	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4140	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4140	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4140	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4140	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4140	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4140	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
4140	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
1196	UpdateService.exe
1196	UpdateService.exe
1196	UpdateService.exe
1196	UpdateService.exe
1196	UpdateService.exe
1196	UpdateService.exe
2764	UpdateService.exe
2764	UpdateService.exe
2764	UpdateService.exe
2764	UpdateService.exe
1196	UpdateService.exe
1196	UpdateService.exe
2764	UpdateService.exe
2764	UpdateService.exe
1196	UpdateService.exe
1196	UpdateService.exe
2764	UpdateService.exe
2764	UpdateService.exe
4512	UserSession.exe
4512	UserSession.exe
4512	UserSession.exe
4512	UserSession.exe
2764	UpdateService.exe
2764	UpdateService.exe
4512	UserSession.exe
4512	UserSession.exe
2764	UpdateService.exe
2764	UpdateService.exe
4512	UserSession.exe
4512	UserSession.exe
2764	UpdateService.exe
2764	UpdateService.exe
4512	UserSession.exe
4512	UserSession.exe
2764	UpdateService.exe
2764	UpdateService.exe
4512	UserSession.exe
4512	UserSession.exe
1260	UserSession.exe
1260	UserSession.exe
2764	UpdateService.exe
2764	UpdateService.exe
4512	UserSession.exe
4512	UserSession.exe
2764	UpdateService.exe
2764	UpdateService.exe
4512	UserSession.exe
4512	UserSession.exe
2764	UpdateService.exe
2764	UpdateService.exe
4512	UserSession.exe
4512	UserSession.exe
2764	UpdateService.exe
2764	UpdateService.exe
4512	UserSession.exe
4512	UserSession.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2764	4140	11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe	92
PID 1196 wrote to memory of 4512	1196	UpdateService.exe	95
PID 1260 wrote to memory of 5968	1260	UserSession.exe	98
PID 4688 wrote to memory of 480	4688	WindowsHost.exe	101
PID 2092 wrote to memory of 3376	2092	NetworkHelper.exe	104

C:\Users\Admin\AppData\Local\Temp\11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe
"C:\Users\Admin\AppData\Local\Temp\11116f8f05c19c3f51d2597cbf7fd76567ca8e7331a995a5aa19fc6b49bcb1dc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2764

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4512

C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5968

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:480

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3376

C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SecurityCore.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 98b08bf802d3d70ca602982880b93dbb801c895753dba08530d7e48711c3b546
MD5 768e6de192ca683c67c5e614eeb9d0a1
SHA1 c5911d32089d885b4335e20c6f6c7f18fec9e551
SHA512 682b20036b82c777ccc6cce0280675b7a746a5f7193c6d4a5d014dbe2542b460498306b7165672fa33f19e11b9de5f53421c1e1615f86826c1326beeb0d6d4e1
TLSH
T10AE07D12676DC2C862538A248DF4A4B57CA9320F14974288592E77C109156BDD10F11B
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 60f59a399a0529e2ab79b05afc360652ee7a438e0a91c06b0182fc56a181958e
MD5 230459805282ab4afbe6d94f4daafc87
SHA1 f15fb0191b7e7f6cd35c1d6686847de8f8007577
SHA512 081f1adf167fdb2a176efada662fea0eba9e518f63dc14cbfed97de8d4185fa0c3e6e58a2c85b4a22c3fda184d6521226e586d2fc64e2afb144d4bbdeab98392
TLSH
T1AC41D7D96E68B425BFC48F45A978CF317E38F290899914A530FFC4A3B886B941C0EC5C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 282B
SHA256 08a447ef3dd66240110691dc7174d29d4713d55ba3d3dec4176a5d46ce38ef6a
MD5 38883942b39a34806ead8be5151db2c1
SHA1 d1463bff0fef81b3dd244e5e2c9097e8ef88a008
SHA512 f617f80fd886e3acce20d7dbb323d9064774dcc949bb8ee5a8bbcdddaf92e38a7edfb88100c7d79d2b0109714f2bbcea0f6bb0193775d5f4cae6941aa51eecac
TLSH
T131D02B1794F5C4A73912DD0019CDF93075135A7B13D8595A780DA9559D119785F0206C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 180KB
SHA256 2c30ddd9ff9a83f76f63ec3841f0c577a17640115afe4cfdfae69a2c46bf0ec0
MD5 774f98d2436af6f16ab7da7f31ca7ee6
SHA1 0a6b0faa616e6a7e982b73d1b395d8845faae68c
SHA512 7baf5304dc701f45f4aff142899f329c80f865d0035b214ad37f9f885d8ec03bff86f79ddae64ddd2409c0b5bc2a034999cb2034e3366d477d2d694cea37120a
SSDEEP 3072:QrX7agxEAXwPxTmG/HCYSAvyTGVeqJqtvE:QrP20OxTT/QpyVeOaM
TLSH
T1A6043AA45C7BB6A35D4BCE624CAEF69612F551D92812732A7E307E505C03ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 30f504672eae158fef37cea05717efaf81542874bb9df13e837cfaa5c1ac98f0
MD5 3fdaa97d3627ca74e0f5c805829d6940
SHA1 4f729b8e34548e910fa9d9176d3835cc65a6c0bb
SHA512 92b15425620781884540003fec93a1286d997c2b9500f0227a1681a5fe153df22991c952b255852b400705ee12bb0944e7668da661a52c70261190617d05240f
TLSH
T1EC1121821FB5E09085E656B4CAE8C1357C75748768EB74D12C9288932856B2DAB0643F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 48a71ec1ad54675b6ff6b9bdbc936ae42a6d12ccfa358439377e9281dbfdc764
MD5 191501f5fdcda850c2151355051205e4
SHA1 3d7f5c222a4743b8bcb2aaa6a5a16bdde3359f44
SHA512 427ef21d475580b60e3410f962e4d6897dcee3c1d73e26249e048d20e5264e15f30c1ff7508e4195674cd04fe526277f9bfe569d5e1c1dfea2b272d3345ace98
TLSH
T14741C7E76A093474BE418F8A55F8C5311E3C82ACA1801981F47AC0D1009EB956C4E4CC
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 e6138a72339d8ff9225fef5690f6321fb7526a4e1385aecd5e2e5064d49f08c9
MD5 2bceeac1e808b2e747cc25ae0f386121
SHA1 416c96d18c3359b60c2391c7b6bf51f6f3b1e0ec
SHA512 b1422ae7d1fc469a9def42909785cd82c60fe64c39105995ee5da433d77b5d171a44cebffed1b214da2818131fd41577e99e5bea5d8d8a51d9502116231efa69
TLSH
T1C6C08C1C1AAA0E06F2A8437C02C139039B608101F6418F151AF22A08CA97B162D38C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 8517ec4dbb877ab34af1a396b50630cabb865865f5595eb1e537af9f0a8edc01
MD5 16739d7b5a64a8dade34f75e7a7dabe4
SHA1 d538ca4cbe8ad6a266ff9b3274fdc1653e0def70
SHA512 25830edc911c7ead23774ebc752942731f76b18c1aec82c5a5ff365a62e748194c3df07f7980174893a942a9e86f6bcd0bb52953d0b544a392228859cb3526f8
TLSH
T15BF05C2C07FC402CE132CFB9D6E5B265AD16F117240445EA0E92474C5E02F011C5153D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 6bf2bec1c4bb129011a57d553b184e5e2676564112dea65931062b459db3c005
MD5 6f58a305861f354f6bb029e7c1143ded
SHA1 13008ef9ec9ee49479ad97e13e70357acf56972c
SHA512 d57eb0d172eee0b40e0ce77e4c6dafaa9cc728781100e3bab75705a018e95d9e9b0e79caecc1d6585859bbef9891c44f41b7270f2689d58cd913732afb974ec2
TLSH
T146F0682038FE403AF136AA3A4BC133F29836F21A38065BBA653103096F5AE212C9151A
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 8f04f9df75886460bbe07296302ed3ff69e5a65c65e7491cea0d4385306fa63d
MD5 2640868cc68e33e4c6273983290bcaf7
SHA1 4dd83b5f2810d98a98af908cd51499dda1f6c029
SHA512 9abf90b803d6bd315cddf603acc16b194e20d38cfbf81ed75f011cfebd5aac70f9db7142e7c15e629b530fda255bb6c4caf65a7e0e069634b23b8af2a0f145ed
TLSH
T1E4F0230415FC4019F0B2F9B8C2E567FBD935F115681A5AF60AD517095B13A411D51D2E
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 0093c5be3151f3a301bd02b6192450467771ed5e6170f491bb7a33bb00673e05
MD5 7edc6e8cbd7fc4e6a00a20054440f749
SHA1 a08fdf503b657641535a8cd0d565dda30cab0740
SHA512 b5fd8169940355aa2bb6b2ab0312d9009764b8d9740d2995b8d1eceb2c615b089ee5b59ef9cc469159f7cfc26010ce21e269c2808de90e2a9a488123d45afdc0
TLSH
T188D0123827D61729F17A833D9CE025603AB0A925F585CF5D3F75564D9C28B560CE0D1E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 43dbac89eca33a90f7698f1d6a20b24b50858d7b905f89876764ad9858f03f35
MD5 eb8862459330747730023989a600915e
SHA1 76bad7805dc0e90284a71d13d7bcb25acf4ed0cd
SHA512 f303ca32c4f1344d18723f00776ce8080eaaab9a0681a3c90d7a05ece14148fb8e767c26a4b930798827f99c30918a348ddbb92a88df6427a904b54cfed02d4b
TLSH
T152F055242BE240BEE631277489F4D3D9D90AB2573801CA6616E60A0AFB0BE002D1143D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 11acf58c57157cf715af617757fad290d5d1cc02738ec9447cf8a986ca64e427
MD5 e07f4b98a23b0cf15e044bb39475b464
SHA1 65c9f0b50d1137276a6b1b8d55005f0d8763441e
SHA512 781e75045064e2b7cbf91b17674d648dcd7f394a2693c6ca723cb5b7fbcf291707cbf86aba30d692a51be6c5b59fb57d22e4806e5f77954984d5911eea2196f6
TLSH
T150F0EC3D15EB065FF132D5BC07C097D58512D13B31052B696BB1520D5D55941A960D11
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 523d98139ac68244bf54faa4aa6a9a7d5596891ec3b8433c0ec49a1adf3f4686
MD5 af270d9e2a0c7a4765cf3dd3ae2f6fc8
SHA1 42d61f4d6d72d17ccc850cefc2564ce423fb7ea9
SHA512 6d1c8b5caf263cccd312ce28d64c073d8cfa9f833829bfdb84bee0926b51c7d71efd544ec3622036a82434c5cbafa71d12f30f789c14aba54490f189b974c017
TLSH
T16EC08C2C06A10E07F2A893B812C2A9838A209110F7819F0226B23A0CCE28F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
Size 6.0MB
SHA256 9f2d94052f55dd9b9f5fe508966db10bc485738ff876a651885a7f1eb3f7436b
MD5 bcf81482558292beff6a1974543e1852
SHA1 affa88e2d564beca4b634e3504c2f33a1b660552
SHA512 2b379872c59fd1985eef9e57e8cf2d632a5da9991b319f941a3bece742e464cadf981ff13cdf1a5119f5335bb96a590c9437f0051bce083d8dc4542ad0508795
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGSCHg4KJ:TDpbgBr/4QAMQWvcyoPJ
TLSH
T1535623E5785E5AABC10E1C7E8E47CE6275EC5BB187545CA7FFC53EFA0810C821623922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
Size 5.7MB
SHA256 ea24e105dd8b406367ca3eaef208a5ddeaa016e794fba47d2a83d9bf8df2e35b
MD5 53efcea70a20b781ab6558b4bc01e80b
SHA1 f51af943b316b7d30fcec03a3055042f0d1738f1
SHA512 ddc4f98cff464a080a70e67c1aa8290b06c4b1b4be45fb4ecf749e720902e224dbc0e5cbc399fb287e6f991cece2ed9aa117f6ec20454896e33747792b0080af
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT66wNeyCVQSCHM/PpW5Mx:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGM
TLSH
T1105623E57C5E5AABC10E1C7E8E478E6275EC5BB187544CA7FFC53EBB0850C821623922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe
Size 5.9MB
SHA256 4cc6080ec75dfd6981866bcadec930fc85b9d7a15917bc929cc5f1fc4e8f075a
MD5 4c2bd200e5921da0cae8085495df47da
SHA1 77df28642d9eddb01fe03e063eb103cf7e07b8b8
SHA512 51cfa8606baf46cc47e45be1942ecf70019a16be25eac898cf1e05dc1225e437a1fa7a747997a17ac8be497dcf84f732c1dbf43b48b10f09147b560e393d9752
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT66wNeyCVQSCHM/PpW5MXi:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGn
TLSH
T1D05623E5785E6AABC10E1C7D8E4BCE6275EC5BB1C7545CA7FFC53EBA0810C421623922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
Size 5.8MB
SHA256 9b2aff6aa36a0f3a43b92c2f5633f0d9d9b7607eddbd5186fdc7bb506c639d6e
MD5 a05791e1c7bde0f72b67e0f95a782882
SHA1 9525477993dd3006498a87c717a5a928d003d12f
SHA512 5c93fef8847a27f708c1a064dca9c8e3bd9174d3ec2f99069c692125ecb16e1f71d93fd2c4fbaa8fdb6879b8bea4a0e6d072278e0136f51b8269c0982bf1742e
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT66wNeyCVQSCHM/PpW5MP:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGc
TLSH
T1475623E5785E5AABC10E1C7E8E4BCE6275EC5BB1C7545CA7FFC53EBA0810C421623922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
Size 5.6MB
SHA256 0fcd48819aa0daf41cafece293707e028335d6259c79c5ef400aa0720f137cfa
MD5 3b10f837527dc99b5fc556f237f09bde
SHA1 dcc9fb156e96f2670a62ba27064c5fc6125c3224
SHA512 9e7ab02a7d3dca71ea9d82d3453f469a3780a8afb32c24cafd030bf6f8a0dc3369f82ee0ac537a9f9d0a2b8659425ee6c5d86e96f93b23f83dc60206f8233601
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT66wNeyCVQSCHM/PpWQ:+0s420bTjzGlBrJTJb8QAMQCgGvcyCGO
TLSH
T1324623E5786E5AABC10E1C7E8E4ACE6275EC5BB187544C97FFC53EB70850C831623922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download