b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
Size 4.5MB
Sample260910-ycnsfsed88
SHA256 b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd
MD5 1b41b548c4ff400f36e5e15f59337163
SHA1 e49663ee10230eb2c49ded4e540a4c39c50b2962
SHA512 d4cf19306f6e9dc86eb6602797c00bb2127b3d23b5a460581e673e64a60a7e159ea87cbd6d5eaf24870465a2fd4eacd88a826c8b464b649c2035f08a0dbb120b
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEQ:+0s420/3uzufNDPQnSZGiQ
TLSH
T1C02623E4785E26EEC01A1CBA8E62CE6275EC577187501DA3FFD53EBA0454DD20722A33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2468	BackgroundTask.exe

Executes dropped EXE 20 IoCs

pid	Process
2468	BackgroundTask.exe
5336	BackgroundTask.exe
1016	InputService.exe
2460	InputService.exe
1988	RuntimeBroker32.exe
3928	RuntimeBroker32.exe
1352	RuntimeBroker32.exe
4728	RuntimeBroker32.exe
3152	SecurityCore.exe
124	SecurityCore.exe
2052	SystemTrayHelper.exe
5092	SystemTrayHelper.exe
1164	BackgroundTask.exe
4920	BackgroundTask.exe
5692	WindowsHost.exe
3036	WindowsHost.exe
2920	SecurityCore.exe
5596	SecurityCore.exe
1648	UpdateService.exe
4512	UpdateService.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\BackgroundTask.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\WindowsHost.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\BackgroundTask.exe\""	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SystemTrayHelper.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\SecurityCore.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\UpdateService.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\InputService.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\RuntimeBroker32.exe\""	InputService.exe

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
27	raw.githubusercontent.com
37	raw.githubusercontent.com
48	raw.githubusercontent.com
73	raw.githubusercontent.com
104	raw.githubusercontent.com
126	raw.githubusercontent.com
1	raw.githubusercontent.com
58	raw.githubusercontent.com
88	raw.githubusercontent.com
115	raw.githubusercontent.com

Detect suspicious telegram bot 10 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c5ee-28.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5dc-47.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c5f0-106.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c5f3-140.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5f4-174.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016ace-208.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001a20e-241.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001a223-276.dat	suspicious_telegram_bot
behavioral2/files/0x000400000001a20e-310.dat	suspicious_telegram_bot
behavioral2/files/0x000500000001a223-345.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3028	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3028	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3028	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3028	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3028	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3028	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3028	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
3028	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
2468	BackgroundTask.exe
2468	BackgroundTask.exe
5336	BackgroundTask.exe
5336	BackgroundTask.exe
2468	BackgroundTask.exe
2468	BackgroundTask.exe
2468	BackgroundTask.exe
2468	BackgroundTask.exe
2468	BackgroundTask.exe
2468	BackgroundTask.exe
2468	BackgroundTask.exe
2468	BackgroundTask.exe
2460	InputService.exe
2460	InputService.exe
1016	InputService.exe
1016	InputService.exe
2460	InputService.exe
2460	InputService.exe
1016	InputService.exe
1016	InputService.exe
1016	InputService.exe
1016	InputService.exe
1016	InputService.exe
1016	InputService.exe
3928	RuntimeBroker32.exe
3928	RuntimeBroker32.exe
3928	RuntimeBroker32.exe
3928	RuntimeBroker32.exe
1988	RuntimeBroker32.exe
1988	RuntimeBroker32.exe
1988	RuntimeBroker32.exe
1988	RuntimeBroker32.exe
1988	RuntimeBroker32.exe
1988	RuntimeBroker32.exe
1988	RuntimeBroker32.exe
1988	RuntimeBroker32.exe
1352	RuntimeBroker32.exe
1352	RuntimeBroker32.exe
1352	RuntimeBroker32.exe
1352	RuntimeBroker32.exe
4728	RuntimeBroker32.exe
4728	RuntimeBroker32.exe
4728	RuntimeBroker32.exe
4728	RuntimeBroker32.exe
4728	RuntimeBroker32.exe
4728	RuntimeBroker32.exe
4728	RuntimeBroker32.exe
4728	RuntimeBroker32.exe
3152	SecurityCore.exe
3152	SecurityCore.exe
3152	SecurityCore.exe
3152	SecurityCore.exe
124	SecurityCore.exe
124	SecurityCore.exe
124	SecurityCore.exe
124	SecurityCore.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 5336	3028	b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe	91
PID 2468 wrote to memory of 2460	2468	BackgroundTask.exe	94
PID 1016 wrote to memory of 3928	1016	InputService.exe	98
PID 1988 wrote to memory of 1352	1988	RuntimeBroker32.exe	99
PID 4728 wrote to memory of 3152	4728	RuntimeBroker32.exe	102
PID 124 wrote to memory of 2052	124	SecurityCore.exe	105
PID 5092 wrote to memory of 4920	5092	SystemTrayHelper.exe	110
PID 1164 wrote to memory of 5692	1164	BackgroundTask.exe	111
PID 3036 wrote to memory of 2920	3036	WindowsHost.exe	114
PID 5596 wrote to memory of 1648	5596	SecurityCore.exe	117

C:\Users\Admin\AppData\Local\Temp\b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe
"C:\Users\Admin\AppData\Local\Temp\b061ec527a2f74150a52be83243a73795b7f56edac11f8aea67ae6c34c5cc6fd.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5336

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\InputService.exe
  "C:\Users\Admin\AppData\Local\Temp\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2460

C:\Users\Admin\AppData\Local\Temp\InputService.exe
"C:\Users\Admin\AppData\Local\Temp\\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3928

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Temp\\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1352

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3152

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:124
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2052

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4920

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5692

C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2920

C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1648

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 6ac45142693bd1c458512e3b8def1881e3fe3a81b85425044c0f460d67eac362
MD5 c10ea189c98d33ce0e871d19b27d2ee8
SHA1 b8e07c52568b0b8ac43d24df87ce133dedc95e96
SHA512 fa95426053eb82e9c3468f3bdf385197b306b22556ae80e4d255de3a1b6c7ded2b605a67dbac0f9295cd922e395aa2e0e0401d4057b15eaa1d26aec4d3524e3e
TLSH
T1B4E07D0E572CC3C3BD164C1026E5857A3AF270AF44D2150E643517C9CD42137C847049
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 407466a7bf7a775973c4c9f5277feec33d64debdc13b130e25446b9b5af3893d
MD5 415bc882f76a7b3e971dc0f091c9e07c
SHA1 37e4314fdbdd38a097d7371dbcd9f06f0becbbcf
SHA512 2ed928ae36c0e8cf7573c495786e80c6025f58a0972de548bc11eca029059e6c8bf7f7bf498e5cfbddaf40626fccbbd859d43a65e18b3a059b1ca0c59fa4a28e
TLSH
T16041A9DA2E187422AF814F805874CB353D7CF1D49988505974FA84E36495BA46D1A85D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 0e88a5f0db492c6d183a9c530238a34b60ddf8e643d59bb067a8bed73f3b04d7
MD5 ca45821f82f18cbccb347fd3d2edbdd0
SHA1 3c0bbcc22bc271a84cee8414221d42d021d221e3
SHA512 85a9f6c20f07e9bb0ba9aeaad0ed6dde142cc456dd82f56db61ea2b8b1f6ac821d6921fd59aef0530ac8cb3ac1ce2ba85a4108c3780fc861e81c4090bd7a1425
TLSH
T13ED0951715F6C9553B53DD044DD0D170B423AEB773D36C1AA48FD0D65800D2D3F0A215
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 177KB
SHA256 7d0f6df5f36e062a516cedcbfd4ef40616adcd767ec1d8b14ef85961122408d2
MD5 1a266210e74b768c7c5f1e87c3c04556
SHA1 947e95122d39b61d8fe7f803fd9c4114a1a41978
SHA512 bb11fb4b14ca0ced323712922f53d748347141fa1c80f76edd0417413b6deaa11bedd3e34722f29e10460e86a6db615830c8d5bfce0f088c3194ae9f805b0a97
SSDEEP 3072:MHlcm9KPx74X/pCh8ycyMGBeDvu6tizLF:u+AEx7I/fcrBeiqa5
TLSH
T105043C645C7BB6A35D4BCE524CAEF69612F591D92812732ABE347E005C13ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 d47f36305c57a449d1209353c65cf916990d10c10bbb8dce40387ad034ead9fe
MD5 da2321ede03f4a5aa95d46060ca64ab0
SHA1 426f6b6524e6e41e03b9d2897076c8d0a2fdfa43
SHA512 d30bc6ed1e2abf680fcd8a7902f8e931ba1b7c64f3d794e9ea55fdbad2282ee766386816ce8dd0cd5782526e61b61d5eb17817d8affbb31ba58a43724ef579dd
TLSH
T18B1125C35FB5E19045F65765C6E4D5313D78708638E938C15C939842245772C670943F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 f38d96786bd6c666347abdee0f69f50848ed6702f7d9b73485da564b84aa9a0b
MD5 be6e0072d59511894c2a14958121b04a
SHA1 8727081701ad59a1b8fb4c7ed045354dac35f51d
SHA512 6e33c6591cbe2a5d5c6bfd5dc0b0cd86a3a5d78e6052654e460582454cce3b6107069aa4af04ff8a03f40482e489a122251f407aa7b93a5a22b018f93608728a
TLSH
T1AA41D8EB1A4D7568BE854F4A5DFCCA395E7CD0A881800E52B9FBC5E7209EB40690B49C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 d9fb19ff0b0f7fe3cbea860df3105c0a2cca3b68c90cd6ebb2c84181a941f565
MD5 d09b50bf597c86a034d7a6d678f7392b
SHA1 1f993fc5595f8e1810f0607c3ffbf34a373fd53b
SHA512 260cd90cef79ea680ced70d228376c4ead9993dc9a48a6e66350e4fb04654f814478a44b7d4182ebb61038df8dad75b72464a5342bcf3ac059555d5218624add
TLSH
T139C0801C19510906F594437C01C13D0357505101E2418F1516F13504C956B152C34C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 db98328417724d2ad52d2b68c79639c04bb2b4b6a1f4c68d55b7078c52325bbb
MD5 78d221dbfbfdbba6cd97df1a743c626e
SHA1 ffe19dc28c0b5bdb9ba4023d1ab5d7da09849a6e
SHA512 e0121993b13fef730089a13851ca69a8ae3bdf0550360682a4eb9c03430a3d06f52adcf8e979f87586b5ed6b4c95d9c29af78e73539d7e49217fe6cabf0bd611
TLSH
T110F05C2C1AFC811CE036DAB98ED5E6E65D16F227380405E90B914B099A02F441C9043C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 ebcad495e3053e98f84981b46ba32d5a85ac289c424e11a507cbc0e8728b1a75
MD5 82b2418e13d260fd4c4197fc0ae373a5
SHA1 c5b88b2c78c225c7371a551141bf52f0b535e46d
SHA512 09d20a5483848e6be690d8084fa26a1951f4fb931a2e0fdbbc1775d6d45ed0b3c8d25c8f9eebc2fd8b6b777d052b89e0f42c05b47c6a55c95a33e294a2849fb3
TLSH
T169F0682039FF903BF133AABB43C571B6096AE30674026BB62B7027046F24F20ADC3511
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 0e569c2296dbe63f33a004b7a47be968a77d0482056146f2f69dd6ae501782cb
MD5 5b41c12948085b570bfa2f7f4c1d713a
SHA1 15693d77104456526ffae7988fcf75de992a15b0
SHA512 2a157a917a6baf7e9bc214d6f21db67ed06ebae7b75a6ba4ebd5c31cdf20a05a725ab904ba2f12bbf521c49a08500e37aa1a598dda5a7f7036ed42714be09e2f
TLSH
T151F0E51C15B8800EE4B2E8B8D2D565F6AC35F209680586E707E6114A9A07E513E62ABA
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 9f2f75d5b00bfdfa1ddbd8cb8f8b6724152e6eda5c86755207b0d0b3162bdc58
MD5 f2bdc61f38934fd11588a850967ed608
SHA1 3ead9846882f548cad4b1228d452af428798efef
SHA512 728015a603c95e589ed2dcda09715ac173edace6cd9424604a76ba9bb2ed303e74724eda676697e53b98c1ad6a83a38bfee487f40c1b1ed10e819d875e8f28e5
TLSH
T14ED0223C3399071DF0B0823856A245C27FA22481B9C1A72D0BB3170C442ED821EE1D0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 ca19bcd27c436fcc860e9ae54e41d6dec15f1d146b0faa2d1e03a32defd897ab
MD5 fc8e65a898fbb62b5e17dcbafb3bdedc
SHA1 bc04843c6d34071a7974ffb587e28b7d7667bb1e
SHA512 020345c05e62d46348c1a4ba1db70c82b660e1d873cad56e4ea2803f952d14749a6230a79b9e195dc8e29c11813c77a6dc57c53b6d0b65f6c214bd82df6a5b65
TLSH
T172F0AB281AEB401EE23267794AF563ABA82AF3523408C5652BE91309EF43F406E12434
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 d1d858b2eed3d015a7bd3b749bba604186ee0327ac5e6ef50a4a420e6d567b01
MD5 73f7ea3fb9ed76a190f27e0a31f7752d
SHA1 3aea7d660d52ceee5340bb17ec78354f7d6d32fd
SHA512 554e4e66868a52bb0b6c9f3a549b58200e021401d6585532df92ba9596dcc9d9ff108fa442c03b37480288edf49b35ea565b8edc780bb868a63e22bb85f944c9
TLSH
T1CEF0553420FB002EF133EABA02C101CA8422E13732083BA92662560D5E42A01ADB1D1D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 4ad4d6fb36fb58ad5bafcb56412c78a6adac96610ff7651f204ab571b2a2c639
MD5 ffcd441c2d21d0c49539b82abfdac4da
SHA1 9689324212e2cc434ffe9606ffa98c24d797728a
SHA512 40dd4c7db9413802ed62d988a7d8d549191d57f0742bc4610a2e5f4ff5e60bc4cb8765fa8baad27a7e316505a98e2a254d743902790a9e5e7688190850557cdf
TLSH
T114C08C1C16A14616F2A883BC02C27D839A209210F381AF112AB16A18CE25F122834D69
MD5 SHA1 SHA512 TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
Size 5.3MB
SHA256 fadd704b1b07d2fce1c64d19d142167b490e49d5f55ce74286cb1d3b23afa574
MD5 c43edbd2b8c3d29db11a9531fb6b7d76
SHA1 114847f164c12f21a0daa39054c135cb9e49c65f
SHA512 264cac7330cea2b2fcad832d973b64de76501b0c0473ca9aa8dc57add0e87838b4e46c4554c394436ef61539a31a2d40541a0966679b62c5d52d8b576830e2b5
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEJpn3T3mqZD:+0s420/3uzufNDPQnSZGiJF3DmyD
TLSH
T14F4623E4786E26EEC01A1CBB8D528E62B5AC5B7187401DE7FFD53EBA4454CD20722933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
Size 5.6MB
SHA256 76df087ad31a4b2bc48405b5ad5e1c393c5edf3159a423541442fd6ef96d2f1b
MD5 460d4a775942c74c24c6846adeb76bc3
SHA1 17c9b21e94f17e9d0db844932cbb67780c5bca7a
SHA512 5c6003b153efd08313a2cb4a794c2a62448d02ecc4fe36a3950f78a76e7df737ebf54383f908e1a802460469479bf7f1b8ce6560e550711cffc1afc140c0e0b7
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEJpn3T3mqZrd02fz:+0s420/3uzufNDPQnSZGiJF3DmyrdbL
TLSH
T1D65623E4786E26EEC01A1CBA8D16CE62B9AC5B7187501DE7FFD53DBA4454CD20322933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\RuntimeBroker32.exe
Size 4.9MB
SHA256 49b4e4430d0d0c95705c8cc51ca68a4c0bea02c0e83017e7c7c41dbe18d15ed2
MD5 14b1c86e7bc2b0783378245c1199e66c
SHA1 4850a1382e02ea1ee7d39bf22cc06dd5a7663883
SHA512 2cb3048005ef1f7f5d946e160f22c8d35c42d11980ca12bf9f3f713c3d6195c6bf8201b500f6277308459c2be56b11bf55258c299d109ebc3103f803eca0e8c6
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEJpnA:+0s420/3uzufNDPQnSZGiJFA
TLSH
T1DB3623E4786E36EEC00A1CBA8D628E6275EC5B7197401DA7FFD53EBA0454DD20722933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
Size 5.5MB
SHA256 a26059e2723785d75007750f3c3cf02629ec1a9eab7f9df244f2da266ffb7ac9
MD5 98005bfeee3bf2ce111a17b2fb6fe7c0
SHA1 e2081e3945993da2f0ecf25ffc05efecf462429a
SHA512 6e8534b19536cfa4dfc7f9b708ee804491aadce18c52c31eb4a2a71c307195f14eefa7d8b92970c532327d1731c31e5c664cece3638d68ea0c4314df835ac9c2
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEJpn3T3mqZrdU:+0s420/3uzufNDPQnSZGiJF3DmyrdU
TLSH
T1804623E4796E26EEC00A1CBA8D528F62B9AC5B7187401DE7FFD53DBA4454CD20722933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsHost.exe
Size 5.4MB
SHA256 a97c727850608bf06465b5e7596b7ed73995b46c202cbd414ebdb25728b7023b
MD5 f91aec6e4d2f3aad7d41bec6409ad754
SHA1 ad0088885b5ce5a84ac69705e632a8beac308cb2
SHA512 dca7fa4568cf6f7ad74bedc050e5418df0cd8c1b2a04526900f6e073b1e144dc686dfedad16f462360e9b0c0a267b3a7de623c233960954a4e318fad47275ec0
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEJpn3T3mqZrJ:+0s420/3uzufNDPQnSZGiJF3DmyrJ
TLSH
T10C4623E4786E26EEC00A1CBA8D528F62B9AC5B7187401DE7FFD53DBA4454CD20722933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Temp\InputService.exe
Size 4.7MB
SHA256 aaaaeeed4214f43b7adb7da9ffa8d91139c1e4716526271dbe3492deddbbe7e1
MD5 024f89716ca2a6b2b266b83c2fd519c5
SHA1 5059fa2f1a52fc00217b570ccb4af61af4c59041
SHA512 04eb8d0820f55f70bebc8390d477f490ec8e9a475c5ac5ac48614f3fb6675f3053f131058dc9052ae92e2cc7fae9ae91b3dd4ffc43f66636fe53418e084290c9
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEJm:+0s420/3uzufNDPQnSZGiJm
TLSH
T11F3623E4785E36EEC00A1CBA8E628E6275EC5B7197501CA7FFD53EBA0454DD20712A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker32.exe
Size 4.8MB
SHA256 d30bb16281f097e2b93a1f4beb0c470efaad19c7b997f9f3809e3446be77cb81
MD5 756bd2200dc1ae061b2758fd48ec73ba
SHA1 fe9773be69762dbe9c8d9582d1f5ae006aa5a02f
SHA512 a84ef0e2c1ce8cfff35c3ec7aabc7c161f21e2afdd663a27a09bf96f722d04e6b6ddf739a41b4c000f330268ae60795f585a0ac9e813be99ff41c63925bce98b
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEJpnI:+0s420/3uzufNDPQnSZGiJFI
TLSH
T11D3623E4785E26EEC00A1CBA8D628E6279EC577197400DA7FFD53EBA4454DD20723A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 5.0MB
SHA256 269f7e178891c115cd0e3886c0c0306f20ff1c584f28a572da26ac2473bdee80
MD5 8d97139e580c77ee57f3599e35a591d7
SHA1 914971f1ed5deca3ec54e7812911b2e4a00fd85c
SHA512 92ff3f8c7a530eecdb5ef39fc9f82e5055292259818f6acbebb3965375783436096397def63a5c1afe430818c5ac017828cb98a94669b2c33059e61d09faa71f
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEJpn3T:+0s420/3uzufNDPQnSZGiJF3T
TLSH
T1CB3623E4786E36EEC00A1CBA8D528E62B5AC5B7197401DE7FFD53EBA4454CD20722933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
Size 5.1MB
SHA256 613e340a3509ab528917861bc31a18406b3d2edd18a17fbb8aaf18e3e868206b
MD5 96ab5fc3d6c90f79c321fbe4a7b3c920
SHA1 32438cccdee781a2287f2e30a3ce26dcd28f8f78
SHA512 c85c559da59e532fbf7b6327aa69c78a22fb5a810fb4d8580c772c2e5eba141654656ad6e4dd8d8e39703243413a1541db9ab0d12ef0842d80a54b9306668fa1
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEJpn3T3Z:+0s420/3uzufNDPQnSZGiJF3DZ
TLSH
T1204623E4786E26EEC00A1CBA8D628F62B5AC577187401DE7FFD53EBA4454DD20722933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
Size 4.6MB
SHA256 19842d37c54378a133ad9935122f4ba430650b337fd5a60ea72bf89645cf1327
MD5 2526b11e3128bebebfa68c7b84f8e2d5
SHA1 753a790e93d148c3dabbd5e78f5f833a95266da4
SHA512 389de78a9f791006ae848186a5a57ed32f667d43df6891c81f5d1d4bdb1c97ae0ef2e4c293ba34a214995efbf2cf3d591393f2f15eb5275afa9640ffebeffd60
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUf3QnypZGNEJB:+0s420/3uzufNDPQnSZGiJB
TLSH
T1922623E4785E76EEC00A1CBA8E628E6279AC577187501DA3FFD53EBA0454DD20723933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download