b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5

Analysis

max time kernel
147s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
Size 9.8MB
Sample260910-ydqcnsed93
SHA256 b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5
MD5 18711387ba651892b6dc550230a8a53f
SHA1 a08c21bd310b0a2329665c79eea057cf7cd8fd49
SHA512 0682c47fa64bfa2772584849e36996eb6721dda552c440558a77dbd8925ba248807ceac9e800f0f15110b6e1e98ea5e137f853996ec0334d844504582e20314b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+Qy/:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrD
TLSH
T129A633D6785F66ABC20D1C798D16CD22396C5BB1CB548CA3FFD53EB20C10C936A22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3400	WindowsInternal.exe

Executes dropped EXE 14 IoCs

pid	Process
3476	WindowsInternal.exe
3400	WindowsInternal.exe
692	SystemTrayHelper.exe
752	SystemTrayHelper.exe
3396	BackgroundTask.exe
2484	BackgroundTask.exe
3316	WindowsHost.exe
2384	WindowsHost.exe
2544	WindowsShell.exe
696	WindowsShell.exe
2448	WindowsShell.exe
3412	WindowsShell.exe
4128	WindowsInternal.exe
3628	WindowsInternal.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemTrayHelper.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\BackgroundTask.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsHost.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsShell.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsInternal.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsInternal.exe\""	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
46	raw.githubusercontent.com
64	raw.githubusercontent.com
78	raw.githubusercontent.com
85	raw.githubusercontent.com
3	raw.githubusercontent.com
40	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c4b2-12.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4b9-79.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4ba-119.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016ace-153.dat	suspicious_telegram_bot
behavioral2/files/0x000200000001af68-195.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016ace-235.dat	suspicious_telegram_bot
behavioral2/files/0x000300000001af68-269.dat	suspicious_telegram_bot
behavioral2/files/0x0006000000016ace-302.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5788	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
5788	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
5788	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
5788	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
5788	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
5788	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
5788	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
5788	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
3400	WindowsInternal.exe
3400	WindowsInternal.exe
3400	WindowsInternal.exe
3400	WindowsInternal.exe
3400	WindowsInternal.exe
3400	WindowsInternal.exe
3400	WindowsInternal.exe
3400	WindowsInternal.exe
3400	WindowsInternal.exe
3400	WindowsInternal.exe
3400	WindowsInternal.exe
3400	WindowsInternal.exe
3476	WindowsInternal.exe
3476	WindowsInternal.exe
3476	WindowsInternal.exe
3476	WindowsInternal.exe
3476	WindowsInternal.exe
3476	WindowsInternal.exe
3476	WindowsInternal.exe
3476	WindowsInternal.exe
692	SystemTrayHelper.exe
692	SystemTrayHelper.exe
752	SystemTrayHelper.exe
752	SystemTrayHelper.exe
752	SystemTrayHelper.exe
752	SystemTrayHelper.exe
692	SystemTrayHelper.exe
692	SystemTrayHelper.exe
692	SystemTrayHelper.exe
692	SystemTrayHelper.exe
692	SystemTrayHelper.exe
692	SystemTrayHelper.exe
2484	BackgroundTask.exe
2484	BackgroundTask.exe
3396	BackgroundTask.exe
3396	BackgroundTask.exe
3396	BackgroundTask.exe
3396	BackgroundTask.exe
2484	BackgroundTask.exe
2484	BackgroundTask.exe
2484	BackgroundTask.exe
2484	BackgroundTask.exe
2484	BackgroundTask.exe
2484	BackgroundTask.exe
3316	WindowsHost.exe
3316	WindowsHost.exe
3316	WindowsHost.exe
3316	WindowsHost.exe
3316	WindowsHost.exe
3316	WindowsHost.exe
3316	WindowsHost.exe
3316	WindowsHost.exe
696	WindowsShell.exe
696	WindowsShell.exe
696	WindowsShell.exe
696	WindowsShell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 3400	5788	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe	92
PID 3476 wrote to memory of 752	3476	WindowsInternal.exe	95
PID 692 wrote to memory of 3396	692	SystemTrayHelper.exe	96
PID 2484 wrote to memory of 2384	2484	BackgroundTask.exe	101
PID 3316 wrote to memory of 696	3316	WindowsHost.exe	104
PID 2544 wrote to memory of 3412	2544	WindowsShell.exe	107
PID 2448 wrote to memory of 4128	2448	WindowsShell.exe	108

C:\Users\Admin\AppData\Local\Temp\b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
"C:\Users\Admin\AppData\Local\Temp\b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3400

C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:752

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:692
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3396

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2384

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:696

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3412

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4128

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3628
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe" --monitor
  2⤵
  PID:1224

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe"
1⤵
PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 6ac45142693bd1c458512e3b8def1881e3fe3a81b85425044c0f460d67eac362
MD5 c10ea189c98d33ce0e871d19b27d2ee8
SHA1 b8e07c52568b0b8ac43d24df87ce133dedc95e96
SHA512 fa95426053eb82e9c3468f3bdf385197b306b22556ae80e4d255de3a1b6c7ded2b605a67dbac0f9295cd922e395aa2e0e0401d4057b15eaa1d26aec4d3524e3e
TLSH
T1B4E07D0E572CC3C3BD164C1026E5857A3AF270AF44D2150E643517C9CD42137C847049
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 407466a7bf7a775973c4c9f5277feec33d64debdc13b130e25446b9b5af3893d
MD5 415bc882f76a7b3e971dc0f091c9e07c
SHA1 37e4314fdbdd38a097d7371dbcd9f06f0becbbcf
SHA512 2ed928ae36c0e8cf7573c495786e80c6025f58a0972de548bc11eca029059e6c8bf7f7bf498e5cfbddaf40626fccbbd859d43a65e18b3a059b1ca0c59fa4a28e
TLSH
T16041A9DA2E187422AF814F805874CB353D7CF1D49988505974FA84E36495BA46D1A85D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 0e88a5f0db492c6d183a9c530238a34b60ddf8e643d59bb067a8bed73f3b04d7
MD5 ca45821f82f18cbccb347fd3d2edbdd0
SHA1 3c0bbcc22bc271a84cee8414221d42d021d221e3
SHA512 85a9f6c20f07e9bb0ba9aeaad0ed6dde142cc456dd82f56db61ea2b8b1f6ac821d6921fd59aef0530ac8cb3ac1ce2ba85a4108c3780fc861e81c4090bd7a1425
TLSH
T13ED0951715F6C9553B53DD044DD0D170B423AEB773D36C1AA48FD0D65800D2D3F0A215
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 177KB
SHA256 7d0f6df5f36e062a516cedcbfd4ef40616adcd767ec1d8b14ef85961122408d2
MD5 1a266210e74b768c7c5f1e87c3c04556
SHA1 947e95122d39b61d8fe7f803fd9c4114a1a41978
SHA512 bb11fb4b14ca0ced323712922f53d748347141fa1c80f76edd0417413b6deaa11bedd3e34722f29e10460e86a6db615830c8d5bfce0f088c3194ae9f805b0a97
SSDEEP 3072:MHlcm9KPx74X/pCh8ycyMGBeDvu6tizLF:u+AEx7I/fcrBeiqa5
TLSH
T105043C645C7BB6A35D4BCE524CAEF69612F591D92812732ABE347E005C13ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 d47f36305c57a449d1209353c65cf916990d10c10bbb8dce40387ad034ead9fe
MD5 da2321ede03f4a5aa95d46060ca64ab0
SHA1 426f6b6524e6e41e03b9d2897076c8d0a2fdfa43
SHA512 d30bc6ed1e2abf680fcd8a7902f8e931ba1b7c64f3d794e9ea55fdbad2282ee766386816ce8dd0cd5782526e61b61d5eb17817d8affbb31ba58a43724ef579dd
TLSH
T18B1125C35FB5E19045F65765C6E4D5313D78708638E938C15C939842245772C670943F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 05f55cd741ebf04fa6143cc1279f95b44c856f1efbd611312ea2cd1793a0b673
MD5 c2f9f75d444f05b448f600f9f498972f
SHA1 73efed1f442da35a14c31316406bbd1dbc14b9fe
SHA512 533226cb07ebc8d0f7ca310bd09c478deb65bc93d0dd6a1806c03d2a1bb475c31baffab1ca3a7980feb230b7d67a6905441efed6fb02e8d99439a878da91ddfc
TLSH
T15141E7EB6B1A3968BF469F866E79CD355C38D4B981800885B9A3C4DA10CE7C16E0698C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a3a8ac73537b0542339a9524f7e0ebb38b8a29df536d89ed5087abef6de34fff
MD5 6766d34b1d009a75cf0df15f92099a7e
SHA1 96d9d1bcb82a674af33d01565bf0a2244401fd24
SHA512 f4ea5a2fd4c7fbb4e8ef64770d1bb1635212c2590973205c3edbb71a111783957533f514c514c79aa2fbe6c3d1c65e27c92d50dec32d9e1bb37eec137fc33a40
TLSH
T1BCC08C1C2AA20A06F2A8437C02C139439B208152E2418F162AF12A08CA96F1A6878CAA
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 e148114e9d2f7ca593399cce7b967c4bb0c867f2a614d05804c381de8acdeb04
MD5 2f70691a5df567993f01e566213c57e1
SHA1 6e7c9416417cab4fe935766dec2057ee2e2de81e
SHA512 dd8aedb937129d8735c77c873da0d9e4ef217475413b3dd58a3c89bf4c80ae2a66912a6c5ec8ba69e6222cbcb9ec73d477b2588a20eecfa252188e791a2c2761
TLSH
T1F9F05C2C1AFC811CE436DBB98ED5E6E75C16F227284405E90A914B099A02F441C5043C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 48cd62895f46c72bc249fc7d0b02a7b0790814d8351a7c48d53734411c5972fd
MD5 3e30aa1a94ecf9884b84fddb1ac10de2
SHA1 35a3257446211d5f44db8b31fb6fc40a97d3eb3e
SHA512 a30fbda7e6e8dba0991ab996ee0b7615c413d7f7e61db3435d72936b771ab3889dda8efdeb806855a78c618fc353004b0e3f238bdbe8160634d08bf4e4804e10
TLSH
T123F0222039FA953AF023AABA43C561B1096AE21674026AB62A6027042E24F206DC3511
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 ed15880f6cb6b971bb89511e3ed498404c50bd5233823d8608826ca30e2fdebf
MD5 e0fe899776085e9133fa306a289d958a
SHA1 a7f7a4e99ec4dd39d0e6106699e98c646e36ffbd
SHA512 7eb514c4942260e13eda38300b53f745b913d1b5ef04fa19e2da660f6a41e0716c39204a265b30232f30f049f2e5f2c40e36b90d6881f8e91b40a7ccf68799b4
TLSH
T17EF0550C15B8800EF0B2E8B8C2D425F6AC35F209680482F707E6114A9A07E117E22ABA
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 89530b858e6906899956b85de3c1601aa9648b342d4567d866a7477959118ba2
MD5 f589f1c666dd96ece01049ceea59246f
SHA1 062853c884f8e88af6562bbe02c2115b522b38df
SHA512 84e6fc3ba15829c68dc6914e2c582b2599697a479d70a73eb9cf0345e8f59caff979a7775d4c6b3987a1a982ed03fec0fab12161d25b5d3d87a431d079e5c9a4
TLSH
T1EED0223C3769031DF0B042384AA245C2BFA25881B9C1933D4BB3130D442EC825DE1C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 ff3a021dca521a27bb51b225cf2b69edbf1eab063b943a4e27b50a54c1d288c3
MD5 fe3a848197e720d8f41fbeecccfd611e
SHA1 a6629a4334248127fb9074e694308970d5a06cc0
SHA512 0ec53817d623d3cef3f82c5f5d7d025ccb782c097b7878c3b1f2dc36b7356d8e7e637594aa8bc6601e116ab2adc91e0cf6dd6675a9ebaaa2eb446588a328a9b7
TLSH
T1D1F0AB281BEB411EE23267794AF553ABA82AF3533408C5651AE91309EF53F406E12434
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 da15422eaba6e175a2fc7a78691256ff96d226ba0ca688d1ebe03c27c982db28
MD5 325b6677481d06bfc00bacd8a142b0ba
SHA1 82a1d63c5e2b384e5ab436e035fefc93f66bdfd0
SHA512 664a883bd5247c2d03227b2f3ec64bac7d6eeb6c2b412389b3b188d7f40df90605f35abaf74ac9eb3df7321aa777733565c0bf9f8492f1f7973230c4889d4b4a
TLSH
T1C2F02B3535FB115FF252DBB812E052D58A76F53731086ABC7BF046095D06F40BEA2925
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 d8f4b471d7d343f8011956d9221e2d831c059d68be1b8be62e9bc2bcc2cd8886
MD5 bc739bd2df0a7cf1dd52567995124e26
SHA1 8fc46bd9474d97cfceec9a2cc34f64ebf246e1a3
SHA512 7bf341ad2a5e0f6840157526a09e8932503988f3d91c435ae343f5387a72792850b1d9b2751cd04611a6b5bf97a9db731e713d9fdcda233981549cf0dc12b218
TLSH
T1D4C08C1C17610606F6A883B802C229838A20C111F7829F112BB12A08CE24F166834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
Size 9.9MB
SHA256 90f89f048e85c4d876afe069801a7f84275479d34917985670ecf14f133ce7b5
MD5 e0d106e73ca0a92b82a795fba26b415a
SHA1 508dce1225cd8d21ac1cdfa0941e3d63d6a3be06
SHA512 de760de8cfa28e9bda33f1ce19e4892592f7d00594b2767daf34a8d26670332d7abfc28ca91cfe1b264b757300b01804394cbb61a19ec804849587a2589f00a7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+QyfO:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrq
TLSH
T15DB633E6785F66ABC20D1C798D16CD22396C5BB1C7548CA3EFD53EB20C10C936B22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
Size 10.4MB
SHA256 e07253332cc2c441ba700b14396521afee5090d3f0679031bea8c0182c5598c3
MD5 51c0e25faa5a497b7037bb2c2598e647
SHA1 b49c89015f7164bb914ebfdab3e4ada172a16e6e
SHA512 52f488f36d15e62a7a396426f95265d81ee74522f135d188ef08ab3a236af23bc647360836b12144ce3237b0b543215b78232296183bf8f0bb7db41de7661f0d
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+QyfZ:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrd
TLSH
T128B633D6795F66ABC20D5C798D06CD22396C5BB1C7648CA3FFC53EB20D10C932A22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
Size 10.3MB
SHA256 781b516df927e92f64aa9e39c291cd08dec96b137cf2e9251ec87e92d9942453
MD5 6e23fa169b59cac46fc318d76334f9ab
SHA1 6c3c7fd8809fb459f1774838f55cd54a040d7546
SHA512 059250a7096231f3c06a661cecb2626e0a47e221e9ef79a630821cabda38e5265e903bbf127e9d620f42e664a1c80c06e7a1c38773ec49116bb290dfc870ff84
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+Qyfy:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrm
TLSH
T12EB633D67D5F66ABC20D5C798D06CD22396C5BB1C7548CA3FFC53EB20C10C926A22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
Size 10.1MB
SHA256 7a13c3d1f60925ce17334a5e3f18ef23699ab5f8feeef1c6a2f3826708382457
MD5 7cbbc46fb860f0e355953ee39f25d62e
SHA1 2277ddb068dcce4234a525b2a9a4526c05b02492
SHA512 7fe937c7a265caa98c23a95653c67b9b1e76ca5fa4415a894852b57c51622a819f896de11aba7fc246a983fba981e33ed37b5802419f312bb721943e6af82f73
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+Qyfg:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyr0
TLSH
T150B633D6785F66ABC20D1C798D16CD22396C5BB1CB548CA3FFD53EB20C10C936A22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsInternal.exe
Size 10.6MB
SHA256 2c41c04836829814a4a49b2c2a09dce2d49ac648505992ea66bf23fd7990255c
MD5 dcc3e65d4840734f7dc3d007cfa8b51a
SHA1 f55bb8a3aa2b223dcb9ebf3d8c03a8b2b1ea4538
SHA512 fca85fa1971e6abc312f7de40e115e7b8ca2b11177fdbe9d9076661be4405bf67062acedbb4fee33dfe6afbd35023caf95b4834cd6c8aa430652d286b10c8f3b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+QyfF:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrh
TLSH
T1B0B633D6785F666BC20D5C798D06CD22396C5BB1CB648CA3FFC53EB20D10C932A22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
Size 10.2MB
SHA256 c7eb133269269cbeb5cdde799fb7a6ff88bdc4759f78aa407ba89ac788b382cd
MD5 a17922a6d9fad26e84fef350dcf8f974
SHA1 79b54e4855664e5b8532a76d27dd407f36e26176
SHA512 43558e00df54492025066f53f573448963fdec849ab06a99f7613e21a1d06df59b8e4cce4e74bbc1911c7279ab6cd89a1d220cc32d7778cd7172e2292dc20ab1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+Qyf3:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrD
TLSH
T1D7B633D6795F66ABC20E5C798D06CD22396C5BB1C7548CA3FFC53EB20C10C936A22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
Size 10.8MB
SHA256 9fa7ce32189daad8d18807cd1cd81b842e6124ab33212d22f29df1a664b16c69
MD5 e51c1724262907a4ab58b4dae15fdf5a
SHA1 bfb972890ec99e11bfc3eb8868978feae78e12ed
SHA512 1afbc363221a3e4a214bd1dbe624cf949bff8ba3b6fcdbafc77fe910b650386ccc92fb51c4b8c3c2362998cb028f7ba30404f20b5f0b006addd65a6f2bfa9eff
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+Qyfi:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyre
TLSH
T1A6B633D67D5F666BC20D5C798D06CD22396C5BB1CB648CA3FFC53EB20D10C922A22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
Size 10.5MB
SHA256 aa4911f53ac39fecd8cdf2f861852a8ae2820ea00fd809537a7d802ceb75f7a0
MD5 068d7741431b0e5c4d6d066e11d69a2a
SHA1 aceebe0c358ace01328ce217d721cf044be640f2
SHA512 ef1c2d1771c4e6484fcda81652cac40a1f930003062baf2d76db8e2c9f40438a0fdb7f025163bf727986fda75cd063c0b6c702e23926c849364528d83f8ffd73
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+QyfO:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyr6
TLSH
T1BBB633D6795F66ABC20D5C798D06CD22396C5BB1C7648CA3FFC53EB20D10C932A22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download