256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa

Analysis

max time kernel
47s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
Size 5.1MB
Sample260925-scrapavshs
SHA256 256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa
MD5 14a1f13d1ca5caa224e6bf55c411682f
SHA1 c3cbdd5cf6ea479783fc51684e8bf6bf0fd61a7b
SHA512 29bd83b0ba03883df939a8f09555bcf85351e4f2c99075d83bcebc2e48b2566a3a4c944101f39f4cec8ca65212249ce78afa24798c852cdb6dcac8e032036127
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9G:+0s420/3uzufNDZSH6bhGzGvo
TLSH
T15A4623E57C1E66ABC00A1C7A8A168E6275FC5B7287111CA7FFD63EBA0940DD31713932
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3440	NetworkHelper.exe

Executes dropped EXE 6 IoCs

pid	Process
3440	NetworkHelper.exe
6064	NetworkHelper.exe
3948	SystemTrayHelper.exe
900	SystemTrayHelper.exe
2796	WindowsHost.exe
4540	WindowsHost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\NetworkHelper.exe\""	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SystemTrayHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsHost.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\SystemHost.exe\""	WindowsHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 21 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
89	raw.githubusercontent.com
94	raw.githubusercontent.com
137	raw.githubusercontent.com
1	raw.githubusercontent.com
46	raw.githubusercontent.com
126	raw.githubusercontent.com
9	raw.githubusercontent.com
51	raw.githubusercontent.com
73	raw.githubusercontent.com
114	raw.githubusercontent.com
146	raw.githubusercontent.com
151	raw.githubusercontent.com
78	raw.githubusercontent.com
103	raw.githubusercontent.com
107	raw.githubusercontent.com
163	raw.githubusercontent.com
23	raw.githubusercontent.com
33	raw.githubusercontent.com
38	raw.githubusercontent.com
60	raw.githubusercontent.com
64	raw.githubusercontent.com

Detect suspicious telegram bot 12 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c593-30.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c595-108.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c593-142.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c598-176.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c593-209.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c59b-243.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c59c-278.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c59d-297.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c59c-332.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c59d-366.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c59e-399.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c59d-433.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1500	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
1500	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
1500	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
1500	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
1500	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
1500	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
1500	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
1500	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
3440	NetworkHelper.exe
3440	NetworkHelper.exe
3440	NetworkHelper.exe
3440	NetworkHelper.exe
6064	NetworkHelper.exe
6064	NetworkHelper.exe
6064	NetworkHelper.exe
6064	NetworkHelper.exe
6064	NetworkHelper.exe
6064	NetworkHelper.exe
6064	NetworkHelper.exe
6064	NetworkHelper.exe
3948	SystemTrayHelper.exe
3948	SystemTrayHelper.exe
3948	SystemTrayHelper.exe
3948	SystemTrayHelper.exe
900	SystemTrayHelper.exe
900	SystemTrayHelper.exe
900	SystemTrayHelper.exe
900	SystemTrayHelper.exe
900	SystemTrayHelper.exe
900	SystemTrayHelper.exe
900	SystemTrayHelper.exe
900	SystemTrayHelper.exe
2796	WindowsHost.exe
2796	WindowsHost.exe
2796	WindowsHost.exe
2796	WindowsHost.exe
4540	WindowsHost.exe
4540	WindowsHost.exe
4540	WindowsHost.exe
4540	WindowsHost.exe
4540	WindowsHost.exe
4540	WindowsHost.exe
4540	WindowsHost.exe
4540	WindowsHost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 3440	1500	256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe	90
PID 6064 wrote to memory of 3948	6064	NetworkHelper.exe	93
PID 900 wrote to memory of 2796	900	SystemTrayHelper.exe	97

C:\Users\Admin\AppData\Local\Temp\256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe
"C:\Users\Admin\AppData\Local\Temp\256a8505d423f6fb22fa90c9b60eb2b9a067d7ad82de1ee62fd7d63707ab7ffa.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\NetworkHelper.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3440

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3948

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2796

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4540
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemHost.exe" --monitor
  2⤵
  PID:4876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemHost.exe"
1⤵
PID:5968
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UpdateService.exe" --monitor
  2⤵
  PID:352

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UpdateService.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UpdateService.exe"
1⤵
PID:3492
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe" --monitor
  2⤵
  PID:2148

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe"
1⤵
PID:3280
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe" --monitor
  2⤵
  PID:2160

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe"
1⤵
PID:2472
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\ServiceHost.exe" --monitor
  2⤵
  PID:4608

C:\Users\Admin\AppData\Local\Temp\Diagnostics\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\ServiceHost.exe"
1⤵
PID:4840
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe" --monitor
  2⤵
  PID:3572

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe"
1⤵
PID:2280
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe" --monitor
  2⤵
  PID:4988

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe"
1⤵
PID:1324
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe" --monitor
  2⤵
  PID:4412

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe"
1⤵
PID:6120
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe" --monitor
  2⤵
  PID:3032

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe"
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 f7cb80d8e1e6b0ccfe0b9c679ba312d77f64f9502cff386933ba749d2dce13f5
MD5 b2451bef54b51146480cefc4cd76e63e
SHA1 c23e495150a7796292ecd495e2bf8c0d951792d5
SHA512 76ae8667711a688d7c3c52d3dd15ce6b99e5093645a6db2107e156f24e3d842fe471b645a4a38e83037750f54003a9bb3728454229e15aee57e893fef0b7b4e3
TLSH
T191E07D06077C40827767593499E144363460145F94685E1A291C4AC50E9225FD907101
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 e38bc244b11ec350a2a27887434969fef8687f880e6264327a2545470affbe19
MD5 ce5eda5a11319344be574f19c9a63268
SHA1 b978579bd05621abb1c4e0328ee87ec0a1d247ab
SHA512 699fd03e026ddd2f119e51a980fb354176c01f6bda3668c400b1250f799042c89dc29e12cff06a5687eaf9136f0783b651e427e12f149ccccbbd91c25dd1a062
TLSH
T16841B7D92A1C7424FF818F451CB9CA363C78F1D1D5C490B571FA48F12596FD02D5589D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 a68218899b1a409d5089df3894ec2bdd43f1b0947fb7898fcec41f15bcef9a8c
MD5 6f38a043dcc4b2214c6da350f88d8110
SHA1 02d6fd79fadf76013d173bc18f6cc4f3e0633fd5
SHA512 095abb2e0a9791447a6406f849b3df270c631361a965976d50058f9a7e665ea8746114086b3e77eac1acccff622875ff4e20fcb6bc2c69837d3bc7848ff1d579
TLSH
T1F6D02B1603BA5CF53E259C6096D0A074346354A733C75496501AC796651DE393A02144
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 c99295806f36a1600b570e46623272edc3cc9e32c921b4f5203bcb6381a486b8
MD5 2a37a06988f016998c9666d08bbc661e
SHA1 831e3b8d6d08f1755acb9d22af9003b27f2ccc78
SHA512 6b7a62e3f8b5ba16eebe7ccef2193e1567dc6d89570dd4044bf9c4485a9a5df867ec08c445433430b8dcbb30f26016f699f4140b6a9d3a80978616be1ff9232d
SSDEEP 3072:9exbv7DO/fCoGUyRWWQeGbvHotivSzhBdbh6Odr:k5v7q/eDWpeGLgaShBdtp
TLSH
T163042C646DBBB5A35E4ACE624C99BA9612F561DD2012772F7E307E105C03ABFCE17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 7dd1ff632ddd6df8ebdf2bea038f358372f4d43ed9624a86ca916a0cf1c90287
MD5 17910262c69f48b19ea6220188a16712
SHA1 2836896bb7a343f84082ce5c209fa62e836cc453
SHA512 7d287245f7703f88985fb33d287b96a99ed98c5062f79ebe07d33e83dc46ea407a9d23cedd0bfd58d36bd957391aa2510c85f295c631a384c893ee058976f522
TLSH
T1FB1121865FB460D096F35260C7F8C9327C7464CE3CEA38D55C838896346A72D2B0543F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 c5fb6b5c7cdf08b4570c8cd8cd28626915a695700d2cafbfeaaf3a73306a642e
MD5 30064da6596c0b6a74ffbcb81607f78f
SHA1 3c635ac013887b61cbf96a8fb2de82547897e86f
SHA512 99f2348ebcd04dec8c049db6e0ad2e504ab64bf06392e945033b0cdd5a9f91744d2119319dd90c9983b9ab523eb48eb375abad2762d049b8e676264d5415bc7b
TLSH
T1C541E9FB0B063994BE0ADF8969F6C93A1C39C0B891801881BE7BC8D2055EBD12D5799C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 32878f15bbd997e8201c65209e73326352391713102fdc4d91f22fc692f0f776
MD5 b0667907bda352534673580b5b4984c5
SHA1 1de3c3fb7ba8fe736152912078ba99b1957f59a4
SHA512 156b1816648c7600402ef61eccdca4375037954715733a8ae8609f13edb1e9a7d410ac61b5975b85e3bbb3b46603b4e6d7585e23882bd9ba6ae89b2c09c04bb5
TLSH
T1ABC08C1C1EA21A06F2A8437C02D23A139B308511E2418F191AF12A09C997F162838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 335312a7386082a0ae7a11ea5abe222222afb932e7b35e93f20e96a3174d82cf
MD5 fc8b9136bdc8bceec0b9b90942383ba8
SHA1 cbc27c3cf0a723a41488dae4051b6dfd5d766ba4
SHA512 8af59c37b5815802a2b0dc46f4b51e9759b52560e2640e0b1e49b14b05b37b6e3134e9b054ef27a55ab844903de9b1408ebcb474c2c9810bde17dc54e5f408ff
TLSH
T1C9F0A73C2ABC907DE5B3DB799BEAA6569D19F116140401ED1ED24A4AAA09E006C9153C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 220a2c8c5d135d11cc05df5db5e519ca32dbedbaf5163fc222812be7ab0c9b76
MD5 d9c536e94df268f750c6a033fc78d384
SHA1 152821262494fbff390051f499f0b55d3d1e51f9
SHA512 3a24eaac80d205bbc221c0726eccfd2fed36f53a4fad9cb684d4cd396278beb393b4a6884631d86f4cbdd29c1aa5fefa190c9af4f6e9b18bb97cd62b8f8d3832
TLSH
T1C2F02B283BFA5076F073A57487C961B5443DB29A640115BD1FB61B046E06F206C9150E
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 30e5a6b84eb80eb3068f7fd1c9b717a4d49479b7814400325d1090fceb78d725
MD5 d999ebee5c31892dfdde1f9b87ff7fbb
SHA1 f00cd3bb9842421ea9f92c160e402141a9bc635e
SHA512 fef066228df638ead5b8f631af07863e2eeb5944331ff81b40a6f1e2565c3051e4c6282a77979a115dc790884db253c3ec9227aaf527dcc2e6097f26191986d7
TLSH
T125F0A33409BC4109F072E978C6E97D777D75F1163806CBB60696420B5F52F404D9312E
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 b75ffa1e93440fa5a8718419781a31fdaf7410a5fa4424413dc55dca64cab0f7
MD5 5dddb8890cc2daec6f1866deeea32f08
SHA1 482a9fab17984f6d52ebfc46126658ad8625f20e
SHA512 98bd54deb5581fbe908a391cd39c18b356d913ef90c43520271d80d9826688316fac96813120891f6cd0fca385705d2be0ccc7e8c5b9b87afd7abc8155cbdfd4
TLSH
T1EAD0C9285F62462AF01543398A620A827AE15542B6818B1E1F7AEA0D842BB126D2681E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 fb91095a1a36ea5838445d636c356f20a7b63cfe1288c9fd1d0435249c92cdcb
MD5 e5857b226a95cebb3898c8c10c3ddd25
SHA1 472c6278821c85dc5baae2fce3438f5eb278826e
SHA512 0a82877706c15d17374313b677c9edf337d303bb2ea8c4075969c1a350aa1d447abb3276d86ca4243c8b9bb29dbbc9a7e0dfc5a7b0b4f04ecb0c59349f33bf9a
TLSH
T114F0A32406E2416EF2727B7586F193DAAD69F2573900DDB81AD50709F617F43AC1243A
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 937cd9aac877a91780e49282c6ffbae67a349ce4d4c51f10d9bfdd8e1688f79b
MD5 1e04897a134f7ef32cb014ce07ab7652
SHA1 ca9912bb56423cab5e880dca53019958a1c69176
SHA512 892207dcee5113c111a75dcc68a17e12585b984175f3a7c8618165880b75605e226ea083786c80ec5c90677232039cbbdfb46b1a130ffd6708b820f0c19e3f2d
TLSH
T1B2F0AB3824EB021DF162DABC83C152D55633F13331042BA9BF7113053D53E82A970E15
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 dd46561ed4f3638634f23072cc760942f28004c921487660ebd5dbbcf76af08a
MD5 6390689b48ed4828471b549d9356876e
SHA1 77b5b099a14d996ad6fcf1a38fe48eeed112a86f
SHA512 1085ef3f6e5ac90721b7a5d126f19a2f426f2b2be22f50862e849a85472352fde55442daaa4f6f6bdb05cc82d7ab7cb2d9f9eb33f58a19a330c801bf4369ac05
TLSH
T11DC08C1C07610606F2A883B802C22A839A318210F7819F152AB12A08ED64F122838C29
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
Size 5.8MB
SHA256 ba66d5c46b7bf98bda117b345a4e17b2dd3fd45b5dd9303682bd880b3f431f1b
MD5 67ec38ed96ddc34040d7ea1f603cf0a6
SHA1 7dbd7a518fc343ca41e40fc8c82039907f3d7f59
SHA512 2a01b53a1b0864b8befc80ff14ea16ccee500626d91be51d50e88ee4bb5164eddabceddb7241a141a5c6f790c0e98005a6eb49835741164434321b104acda903
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9xR5KW:+0s420/3uzufNDZSH6bhGzGv15R
TLSH
T1BC5623A57C1E66ABC04A0C7A8E168E6276FC1BB29B115CA7FFD53DBA0450D930713933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
Size 5.4MB
SHA256 be496b88451358cf7c4e577636ea4182049a8f6360665209362fc593f582dbbd
MD5 d79e0a61d3140614ff04e1298dd11123
SHA1 be6b30d92856911ee1920549b2644025038390a6
SHA512 c5587096aa54e123dea6971c8d58c03fa131d0b3d36bf8a804c66af259b9d374783cb2e1e678aa7c1a6ba29731d3b4f7d2c89f25f0d77dfeb7220d72bf1c11de
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9T:+0s420/3uzufNDZSH6bhGzGvR
TLSH
T10B4623E57C1E26ABC00A1C7A8E128E6276FC5B7297111CA7FFD63DBA0950D931713932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UpdateService.exe
Size 5.7MB
SHA256 177b04ff8f04fb33c158e760500475b4e1cfa94e3b85be666f8494d3ba595042
MD5 5495547d8df869c8e3ca031c6cbd462a
SHA1 f3a22ecdb7cea4b226774042c31585ec625769a0
SHA512 b383e30a0d7a030cd5c54bc636121234167bc96edf0717fc0f321a0c52ec3bcc7bd315ee8da92bd59c911d185d56fd417311e8de13c5a83731d5d64fc7ceab17
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9xR5KU:+0s420/3uzufNDZSH6bhGzGv15v
TLSH
T14B5623A57C1E66ABC04A0C7A8E168E6276FC5BB28B115CA7FFD53DBA0450D931313933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\BackgroundTask.exe
Size 6.5MB
SHA256 a69e9f98e2b37c02740a245164f9aad8b0f84254ef818e482ad95d9dea523586
MD5 96b3fb550c4e453d8d19a418c1fedac5
SHA1 360fd5d51b0c4697244ac36bc433da2df0e6c78c
SHA512 92db64676c6d4fd3d715e00cf942c5ca96ae90462f8b946c1dd886be741a27ca4bd9f3d5e7427d9025dd8f4d1407572ea7b224114329860d6ebee83bb26fd037
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9xR5Krc:+0s420/3uzufNDZSH6bhGzGv15V
TLSH
T12D6623A57C1E2BABC00A0C7A8D168E6275EC5BB29B115CA7FFD53DBA0850D931713633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\InputService.exe
Size 6.3MB
SHA256 41240f561c7ae2c8604f0c85f1a1d2409e01279411818fb158676a480cb15a94
MD5 aed8985702cb2aaa1a501aa7298d029f
SHA1 114bcca94d80898fe7b3e30bccb3718190a7a552
SHA512 7a6256a28ac62e6a515af48123ec21eefc80f74eff79f459f72f42919cf1ef9f5026f6108ff1d86a9f215b61fcdb3c558fe068d79f4c14bf099dcb3c5e3574e8
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9xR5Krl:+0s420/3uzufNDZSH6bhGzGv15A
TLSH
T1106623B57C1E26ABC00A1C7A8D168E6275EC5BB28B115CA7FFD53DBA0850D931713A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\NetworkHelper.exe
Size 5.3MB
SHA256 73d67f48799dec59553775ad5f371a6a8fa05a4b447dc89ac8694e8aeb39a594
MD5 5b84beea7db1a9ef1904f0f03e5dd913
SHA1 67f26cf435a5870e910a6c8ded8f29e09fc71e60
SHA512 d5aecc8c1508bb67d1f5774921b33d0d452f731bc6c841839ba10f1eb29e03e50e6c54231997402eca1e0573bc664985eda10d82b96050bdc66c53a287688812
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg90:+0s420/3uzufNDZSH6bhGzGvW
TLSH
T1EB4623E57C1E26ABC00A1C7A8A168E6275EC5B7287111CA7FFD63EBA0950DD31713933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
Size 5.5MB
SHA256 155af0e9e913e555d221437a2a25a665f0b7af4ec6fdc610ccbb06870e4d5151
MD5 995845abb49bf4049d593c11c62d4796
SHA1 c00a310d1eb42a764c22c1012b70ccdefe457709
SHA512 8957bff9770324ac269755701746de1c965a76e147818ce1511945fc9be0b8faab3632e35ddeb92cd446d278a87306fbb9137a7625847af31c1c26911858ef3d
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9xRQ:+0s420/3uzufNDZSH6bhGzGv1Q
TLSH
T1B64623E57C1E26ABC00A1C7A8A168E6275FC5B729B111CA7FFD63DBA0950D931313933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\ServiceHost.exe
Size 6.1MB
SHA256 ea3c2be405cab16ab79fe6f41b124a4928f63bb2d8fa63b5770fb03dc6630344
MD5 7835896b4f718e4a5b096d6fa253a3a9
SHA1 ac55dbc5f2654fa8208a657ec65cb8a4b08ef4b1
SHA512 ecac2c67161b59efa4c317e9e883a1ec794d422d5f32fd0e90b0fce852fe37dc27381e8bfb2cde682ca147af6ce8a7699a4d6cc76692da9e140b6dc04c28def4
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9xR5Krm:+0s420/3uzufNDZSH6bhGzGv15h
TLSH
T1445623B57D1E26ABC0060C7A8E168E6276EC5BB28B115CA7FFD53DBA0850D931713933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\UserSession.exe
Size 6.4MB
SHA256 f0398f330685997cefb34a23bfdbd88f952c0609df4974e730aa3cb85040a906
MD5 cdd8c2bdc92e52f6c125a49fa2a4a1d8
SHA1 df620eb2544e10da3b8094487d18a7067de75143
SHA512 5a281cc98e7cbe14966769c170841bd50ebd0d36fd8ad2cee87fccc2577df63bc705bde80adbaf4c396b4a45162f83740af24865300101d9487303ba53705516
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9xR5KrF:+0s420/3uzufNDZSH6bhGzGv15I
TLSH
T1206623A57C1E26ABC00A0C7A8D168E6275EC5BB28B115CA7FFD53DBB0950D930713A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemHost.exe
Size 5.6MB
SHA256 3c297ddf644db9ef73bb049aad424df3b428a72f6c42c31bac22eaf80c136d1f
MD5 7d29da5b7e2fd8d8ec067c47c0954cd0
SHA1 e98e89d58a303e7d2a5b577c1ac96c02daadb32a
SHA512 d65cc75333b937d80cf8da6c3d88484f1994c725da02de6a0ae13d0bcfb347955c52a48b42c8b535f8db48bea3efd1041ed4597f7fa477c3a4032f74ee27e264
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9xR5KD:+0s420/3uzufNDZSH6bhGzGv150
TLSH
T1134623A57C1E26ABC0461C7A8E168E6275FC5BB28B111CA7FFD63DBA0950D931313933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
Size 6.2MB
SHA256 734b002a84787515d13722a04ecec0280aa2d9a5b1ef1be293636a1b10ca0ecd
MD5 8211c788b3dc19454c0e2068583b2419
SHA1 72366f35e86f9fa1dfd14cf462295f1c080c06bf
SHA512 9103c024cb715c60ed503400a4fc253906cabe2e4568c23bb655be796e5f59d428db08820512a03c36d5dd0eb8b706b3cce38c0585556fa89e95f1eb44626771
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9xR5Krq:+0s420/3uzufNDZSH6bhGzGv15l
TLSH
T1B75623B57C1E26ABC00A1C7A8E168E6275EC5BB28B115CA7FFD53DBA0850D931713933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
Size 6.0MB
SHA256 e1531efddb7614062850d0172bad9c92438475e93c8ba9b2a9da7f0f33485d04
MD5 a4351dd0332132ff458ea8b0ef856dac
SHA1 aebd2722eba16392e2aa88735d7cfa4a6af99e27
SHA512 c508e72c2002ad7ac74360ba1eb4e6052e20d43483ec3d24948a61b5ff6734e1a6f05dc9483050dedea4633b0efcfae903fef4f618cfdfe234fb7362f8d96f7d
SSDEEP 98304:+ebGH420Zl3c3XcjtuzC/rKPovM4VtyZUZUDLD6+SIPaGzGeg9xR5Kry:+0s420/3uzufNDZSH6bhGzGv15T
TLSH
T1935623B57C1E26ABC04A0C7A8A168E6275EC1BB29B115CA7FFD53DBA0850DD31713933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download