498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
Size 5.5MB
Sample260912-vsctcatvaz
SHA256 498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088
MD5 0d8b1a27bb8a08b0bc3240287bedeb45
SHA1 894f82c3486638d15150dd505b9f87ef91c20aec
SHA512 3dda653c64474b2a95fcf3774938a76586a2ebdb463d041bb89923aff18c7e5602b8dfeb02e6261029aca898d5a0c7368631a29ad86ac8262eed3d0ab8abffb7
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3z6ccL5l5cv:+0s420bTjzGlBrJTJb8QAMQ/ZRuzPWf8
TLSH
T1014623E5785E6AABC10E2C7D8E1A8E3135AC57B1C7605CA3FFD53DB60810D932663932
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3524	BackgroundTask.exe

Executes dropped EXE 14 IoCs

pid	Process
3524	BackgroundTask.exe
1692	BackgroundTask.exe
796	UserSession.exe
3456	UserSession.exe
2584	ServiceHost.exe
1964	ServiceHost.exe
3644	BackgroundTask.exe
3540	BackgroundTask.exe
2896	RuntimeBroker32.exe
3164	RuntimeBroker32.exe
1696	SystemTrayHelper.exe
2768	SystemTrayHelper.exe
1480	DesktopWindowManager.exe
5880	DesktopWindowManager.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\BackgroundTask.exe\""	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\ServiceHost.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\BackgroundTask.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SystemTrayHelper.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UserSession.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
56	raw.githubusercontent.com
63	raw.githubusercontent.com
1	raw.githubusercontent.com
27	raw.githubusercontent.com
36	raw.githubusercontent.com

Detect suspicious telegram bot 7 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c548-11.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c550-29.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c551-101.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c55b-149.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c55d-184.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c55e-218.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c55d-252.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3404	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
3404	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
3404	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
3404	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
3404	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
3404	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
3404	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
3404	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
3524	BackgroundTask.exe
3524	BackgroundTask.exe
3524	BackgroundTask.exe
3524	BackgroundTask.exe
3524	BackgroundTask.exe
3524	BackgroundTask.exe
3524	BackgroundTask.exe
3524	BackgroundTask.exe
3524	BackgroundTask.exe
3524	BackgroundTask.exe
796	UserSession.exe
796	UserSession.exe
3456	UserSession.exe
3456	UserSession.exe
3456	UserSession.exe
3456	UserSession.exe
3456	UserSession.exe
3456	UserSession.exe
3456	UserSession.exe
3456	UserSession.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
1964	ServiceHost.exe
1964	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
2584	ServiceHost.exe
1964	ServiceHost.exe
1964	ServiceHost.exe
1964	ServiceHost.exe
1964	ServiceHost.exe
1964	ServiceHost.exe
1964	ServiceHost.exe
3644	BackgroundTask.exe
3644	BackgroundTask.exe
3540	BackgroundTask.exe
3540	BackgroundTask.exe
3540	BackgroundTask.exe
3540	BackgroundTask.exe
3644	BackgroundTask.exe
3644	BackgroundTask.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1692	3404	498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe	88
PID 3524 wrote to memory of 796	3524	BackgroundTask.exe	89
PID 3456 wrote to memory of 2584	3456	UserSession.exe	92
PID 1964 wrote to memory of 3540	1964	ServiceHost.exe	97
PID 3644 wrote to memory of 3164	3644	BackgroundTask.exe	99
PID 2896 wrote to memory of 1696	2896	RuntimeBroker32.exe	101
PID 2768 wrote to memory of 1480	2768	SystemTrayHelper.exe	104

C:\Users\Admin\AppData\Local\Temp\498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe
"C:\Users\Admin\AppData\Local\Temp\498752858a31c9ea17b9ca56fe6d36dd332a06b375e9c7d75af0a9624ade6088.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1692

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:796

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2584

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3164

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1696

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1480

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 c4f967c6bf8395e191bc1cae9ec7698305ec01848df166bff48881a24c41cb49
MD5 8f26e8cf3c85927d43f9b41bdd5a3898
SHA1 267d2db8943d268ca0f189616c64703306667dc4
SHA512 89957c7b2efa3c45650235a723fc20e860b60a23dfa845edd38263c71d331262f365e83b7aa3f6cdf76c40ebc3cea2ef18b0ffbf7e145389b65b4a5992d545c4
TLSH
T172E0E71A77ECD1D47123DA2047D940353C30356E3886454C740D93D74E41378D7072D8
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 17cf3ea57e4f15ee4c6895b048856a2e90765cb548a7af69eaf53592f3293a90
MD5 7ca1af8562e3d4d37fa4759cec872584
SHA1 f427ffcdbf9aa271170552031ac9099a2ab6710d
SHA512 0399887aa80a0c9c22587036f482321198219f022f4c63fe2fa0b9a6231bc75ee25ebf40c385b2ab31fdb9f0566c3b15545eeff5152164267ffe0a972b4ee77e
TLSH
T14B41A7ED6B3C3058FF818F816535DA362D7CB1D49BC4112976FB88A260D5BD12E0A45C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 282B
SHA256 36408e52c9acbe4615b115121e4f1915f3764104d7c07f69863305c5a40f9d9d
MD5 888c6e57a832096daf55993a9aa0a1bb
SHA1 c85b5739d1bdb71185093a608ada73a66cf22b43
SHA512 7231500e5f8f8e7664a4409ce6e83ad902b7ecf5cb7c9f690b75a9b0e408d9a03e57927892af75616751e70cc07267c1db2005c2863ab0713ce4b0277683a785
TLSH
T1A6D02B07F5F48C613D32DD101AD6A5347113B53F11D4560DB818819D5E11A3C8A46258
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 174KB
SHA256 c250fbc35b7e847b2c03aed9deca4e6d87d6af19effa660415702c657a07f18e
MD5 d13d22f476b8702c66312d6ae7887824
SHA1 8ad6180c6b8634f1e16e617a94a033d824feb320
SHA512 1eb59f19e8e2c165b06c683c5399c640f74e37d00c4ab886ab023176bed1ce7debb24707fa33dc07e43ea2747c288711869268119f0649cb6e7ce27daab9f2a1
SSDEEP 3072:fUjPN/KPm74O/PCvOjfy3IwePv56tiVen:c79Em7//ZuYwe5qog
TLSH
T192043C646C7BB6A35D4BCE524CAEFA9612F551D92412732ABE347E005C13ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 d47f36305c57a449d1209353c65cf916990d10c10bbb8dce40387ad034ead9fe
MD5 da2321ede03f4a5aa95d46060ca64ab0
SHA1 426f6b6524e6e41e03b9d2897076c8d0a2fdfa43
SHA512 d30bc6ed1e2abf680fcd8a7902f8e931ba1b7c64f3d794e9ea55fdbad2282ee766386816ce8dd0cd5782526e61b61d5eb17817d8affbb31ba58a43724ef579dd
TLSH
T18B1125C35FB5E19045F65765C6E4D5313D78708638E938C15C939842245772C670943F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 8b06ac7611029b30d6e69336012c1cbef6b55bd1b49089478ba042f65453dc1e
MD5 0a0bafb9a1f2059cd494d9316c739b7e
SHA1 eb656b4e371b308dcbe5465c191d85df3d74f807
SHA512 d57794424aef9edbec3da7ff8337cb0bc34d19bbdd90805a581906e15d88db839321cf484222d5b1d75f1758ad91aee2ee7c2af61029b1cf9b9b921573eff3f0
TLSH
T17D411AEB1B4775B07F02CF594E79CD352D7C90AD91D00441B1F7C8D228EA7546806A8C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 21cf1d23e3dd6537ebffcd26ba23ffcabd7dacc411f30a2fe8e6bd32352b2f9f
MD5 ed6bad417de5505867bf45ddd0ef9aac
SHA1 11bf52d4883d5fe8fe65f177a991701b50ccf663
SHA512 30a7dfb2a5da14f030a24f4935feb7bab994f1af67a70363a67184529ded00a5d75a41cb8efbf878048dff511614eb0877bf7ae467ad24d36a65a4044e7a1c62
TLSH
T1A9C08C1C1EA61A06F2A8437C02C139439B609201F2418F061AF16A08CAA6B1A6D38C6E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 0efe1abe216d3c320d8104cb7119234909454946a8cada1b1fe3d928676a9a6e
MD5 883d84aa713bb0fad3f274365b09a0c0
SHA1 2ffc26388c466d794d78d8d8e9820e016ebf5831
SHA512 6c65031a8a3f310fefeaaf1a98bd56940ced5c0a7d4b53928ba171ef838e80880900d8f82e0798340d25eb585eb044caeb7b6fa2ac9645f519a1ea101d6395ab
TLSH
T102F0A73C56BC846DE572DE78C6C8A2D23E26E213744845D51EA147085A06F01AC52565
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 8abcf3adf4e6114aba1fd4909a834b0baac8123a87adcb2d79d17301057112e5
MD5 8fa280f1dfa082151530618a282353b7
SHA1 44ac46819800f18b4d6c4193067bf664c2ae38ed
SHA512 479ddb6820706c890a325f9dfc566efc16d5e196fbe0be76db147d28523fdf180dbabe3dd98b905d94371e831e0aa71ae45424a8ba0967c40880df8987c611fe
TLSH
T1ABF026283DFF957BF137E97803C931B2586AE21A204621FA11B253067E20F203C9161E
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 44c788b6c8c83a24e82b0c3e01d3843ce2600e5a73916e287fe330208dbbf00f
MD5 ca116d8181d414db1599124815b4823f
SHA1 cb956c1c303c43f718b4b7b5cecae3dc6d315ca1
SHA512 bae6f3a8ae9df13278ff000768af3e14a7b73153c967d008cea47ea88e84834212a4ae2f6cab23ab831fb9cf49b452920b381355448253bd9d7ecd714efab4eb
TLSH
T16AF068343CFE947BF037E87803C930B2446AE25A204522FB16B183053A15F103CE090E
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 eaa6b23a7827fd79e5a7d8a062fdb161d6c09c088f2e7bf1b65f583da3a5cd44
MD5 7273e64e2b2c4147ac039269434328a0
SHA1 c8aa1cc005693cc0def68322138f9a9daaa578d4
SHA512 d82942586b328b0f4a622652d37168589f85fd032cd4ac2a69574cd7fba96ebdf30784e3cffaf94ebd0f2e2feb18eb33baec1bb5ebddc72be8a256d67427c77c
TLSH
T152F0AB10087C400CF073ECB9C2C675FABA3BF02A78066AA21A9B17086B02F001D6657F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 f02ee7378bbc9eb168982055ef22f8305116b304040833f99b32d1cc46d41dc1
MD5 d3da6f81ef37470f1e11f89b42b749fe
SHA1 4c27573356026f4f785ea409a958b1daad8440f0
SHA512 f300a576aeff630de2c84ec320d7690a961dd76de9d00bbc8492612976685141964db8ac2b28874234488f520001113638755d7187d367c456155baa98a3e083
TLSH
T1E9D0A939038A0A2AF1B0D2B9ACA542983AA8020AA9424B092FE65A5C481EB02289080D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 ddad45ebe8a3d2318925cf1cfbb29746c6a07ff20ad7d456c38429ee30fe1c1c
MD5 055d6c1586c8f45b669dd5335778fd60
SHA1 6f889673f17ca535aac00b1f8d116bb732a45615
SHA512 5f7e332c7d216fdcdbe0b0e5f9dfabf6a0490a4a828cf7c24ba51dceacb3a5c84b091a27a8eb9c486f1a3767bf2063da092fb2b2448fea37249d9194265d0e64
TLSH
T16DF0AB291AEB041EE631A7B94AF5979BAC26F3573409C4A51AE9130DEF43F40AE12434
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 e2ffb6c103698117d25c6837dd979845641dd00f8d61cd3503c0d280d999a8d9
MD5 8cf20ed34db813c4b0516f7555a7100f
SHA1 33ea9b4880d4158d7dfbf00b7a9a596700f7a0c2
SHA512 1be00ee698bd0bc73468ab1229157ae3fb3875930a370ee2ce9b18775730c2f190b0de47bbd2fc1e11493a8c864f62a54afc404e1dd0866fd1e548de316624d0
TLSH
T14BF02B3635F7051EF321DB7806C01EDA9527F237310826AAAA6193092E86E416AB1E1D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 c486a87065d4136ba79717c122588ef4ce46a69042b7ba0ce57fab7b5eaa91d0
MD5 8ac2059ced2d43a70901e290968332b0
SHA1 fe2d6bad70b2efc67177515f36c6ced7d7aab201
SHA512 565b2755b796f47a4184fabc6a44903e5d0a6175dddf2fa8bbed8d5e9a8720dcd724a1f1a5e540c093fc4aa1b2e65d2a1ba4aa2b3cc52bbd496ee271377ab198
TLSH
T170C08C1C0A620A06F2A893B802C22D838A209110F3819F0126B17A08CD28F162874C69
MD5 SHA1 SHA512 TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
Size 5.9MB
SHA256 1e44d1383ab1562d719a0038124121330f29e5df7403e6787ca855403c91c998
MD5 af3abe0430234077f335c41265cc60ae
SHA1 4215c6850be697965ff7c779a50eee44c79fcbef
SHA512 3fb91915f490ad29b623028a578ba2c70b7b35e79cddff5105e18edbc9091f5d2dd5605e4e91a083b03a31dbb129defcdccdedb8b85cbba35a4c8d863c945b14
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3z6ccL5l5cOUD+SHZ:+0s420bTjzGlBrJTJb8QAMQ/ZRuzPWfA
TLSH
T1CF5623D57C9F6AABC10D2C7D8E2A8E2135AC5B71C7605CA3FFD53DB60810D922663932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
Size 5.6MB
SHA256 a5ae9c6bdc6269fcf11f6f5e3b20fd8bef04720ef7a15b6054bb08b3ecc6b8bf
MD5 ac7e431cce426ddae20972447ee12b2c
SHA1 d485d2e0b96365a09687c33f297e7a10374e42bb
SHA512 3359ded323e348c325ebcfefe97c1e900e159869497965ea5c8c4bc65d52b07297056a4cdf38ddc9e07dca7b3feb560e15d8eb0a494228dd732c3cc2ae8ce046
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3z6ccL5l5cO6:+0s420bTjzGlBrJTJb8QAMQ/ZRuzPWfu
TLSH
T1BC5623D6785F6AABC10E2C7D8E1A8E2135AC57B1C7605CA3FFD53DB60810D932663932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe
Size 6.2MB
SHA256 2ee605f153e0358924caffde60b069e79fc37dc1f8e95ad3b76408bda14a5989
MD5 0c7b6d63a1a04e8534857fc2b781ba8a
SHA1 7f4adc0ea9bd1844ce3d14be0cfe335dd824cb05
SHA512 faa39bcefda0c15d7acce0a339c6408128bf289a576fc83e8ab4d276a8811c770091a1b2f03341ee3708acabc3e94bc972d2fe5500d2dd7ea312905772f83908
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuzPWf5eDbH05D:TDpbgBr/4QAMQ/ZRuzOwDb0l
TLSH
T1776623D57C9F6AABC10D6C7D8E2A8E2135AC5B71C7605CA3FFD43DB60810D922663932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
Size 5.8MB
SHA256 c96c834fe5b06304fa9d5d6cd56fa3f467b12d11c4969fd39e01a3757756a415
MD5 b1b044e78a7c15452452cc94e1f0a53e
SHA1 ed73d2b075bfdc24c82f6f003821f652e6f834a4
SHA512 b37adfa13453d7aaa83386eb419c9ed15fa9758bc55172758aa278e884c3f0cdc56347f78a7de4229f813f273e6a6b2f1f15feb791954e2c023f612787565777
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3z6ccL5l5cOUD+S5:+0s420bTjzGlBrJTJb8QAMQ/ZRuzPWfK
TLSH
T13D5623D57C9F6AABC10E2C7D8E1A8E2135AC5B71C7605CA3FFD53DB60810D922663932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UserSession.exe
Size 5.7MB
SHA256 2dbe67dd030cec50b80e4798c25fe96fe0dec66e1cfdc3de281f89e174a2fbbf
MD5 16e6bdda42bd91ddec3d0f02c590caf7
SHA1 7bb03e94eed997f2e912873807ad576388e771aa
SHA512 3d39cf1fad80e2ce2608f0ac5f5fc4ddeae5ef43fb41a3006153bae5de5541c5ec0a909877b1954c7185a4e28a8fd100537c4cbe5a4fa78ec80606ed4aadd31e
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZYPaNq3z6ccL5l5cOU6:+0s420bTjzGlBrJTJb8QAMQ/ZRuzPWf1
TLSH
T10B5623D5789F6AABC10E2C7D8E1A8E3135AC57B1C7605CA3FFD53DB60810D922663932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 6.3MB
SHA256 3faeee36bd04261f0278c306ee999de3720977002007223aacf71b1d4eb9ac7f
MD5 65dc68919d1b8b634924d6834c2c1996
SHA1 ad9921957e5fb229b773235fed2ea6f1e5cee190
SHA512 f1d7706ad2bb4273611e9b8f0459c531288a74303b79b10fcd0b717bcfb45b249dcc4b1d198b80602e3ccdf8f736b563d79ea2b424b9e19f868f7fd63254aa84
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuzPWf5eDbH05F:TDpbgBr/4QAMQ/ZRuzOwDb0T
TLSH
T1026623D57C9F6AABC10D2C7D8E2A8E2135AC5B71C7605CA3FFD53DB60810D922663932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
Size 6.1MB
SHA256 3682a7d8ff42f5cac13e9a45214a4b2c4dc797a3f0510527e53ab57060f25c3d
MD5 3997f418f04b9fde7eb7f2fa1903d124
SHA1 72551696b72f7254f185572f5bf189747e066c43
SHA512 64d398c3e0d932cfefda82a3f6b77991006c6f06dd921123a3679fc87db9a4a49ebcf986f57c5523fc4988d3fa9f3f04697de8d3b4ab9b8e810b3dbda37218ee
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZRuzPWf5eDbH0:TDpbgBr/4QAMQ/ZRuzOwDb0
TLSH
T1805623D57C9F6AABC10D6C7D8E2A8E2135AC5B71C7605CA3FFD13DB60810D922663932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download