a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
Size 1.8MB
Sample261022-tlsesavy8n
SHA256 a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b
MD5 1bdaa28f14854451beab6c09b2a2139f
SHA1 c10439b1d8485ec1ffd31371d409a456e9b4ffa3
SHA512 94364e6d940afa779a4c8cefe1651f19b7366535226f9719de23be517488d4e122ede9d271cffad24e2ee3f50152cf1ef5295c1e8397281daea6bf32d1cec94d
SSDEEP 49152:+eWUGHITpj2h0VZrp7u5HkL2CmIf+u9Yt2EXA7JFB:+ebGH420ZtgHkaNTA1D
TLSH
T1009502E5795E7AAAC00A1C7A8E06CE6275EC57B2C7501C93FFD53EBA4940CC31762932
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5784	SystemTrayHelper.exe

Executes dropped EXE 11 IoCs

pid	Process
5784	SystemTrayHelper.exe
3424	SystemTrayHelper.exe
4252	WindowsHost.exe
6076	WindowsHost.exe
5056	SystemTrayHelper.exe
4588	SystemTrayHelper.exe
4164	BackgroundTask.exe
2616	BackgroundTask.exe
5004	WindowsInternal.exe
3068	WindowsInternal.exe
4796	SystemTrayHelper.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\SystemTrayHelper.exe\""	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsHost.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\SystemTrayHelper.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\BackgroundTask.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsInternal.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\SystemTrayHelper.exe\""	WindowsInternal.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
15	raw.githubusercontent.com
28	raw.githubusercontent.com
52	raw.githubusercontent.com
64	raw.githubusercontent.com
77	raw.githubusercontent.com
40	raw.githubusercontent.com
61	raw.githubusercontent.com
88	raw.githubusercontent.com

Detect suspicious telegram bot 6 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c50f-29.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c510-106.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c515-141.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c510-175.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c515-210.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af1-244.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5944	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
5944	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
5944	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
5944	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
5944	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
5944	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
5944	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
5944	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
5784	SystemTrayHelper.exe
5784	SystemTrayHelper.exe
5784	SystemTrayHelper.exe
5784	SystemTrayHelper.exe
5784	SystemTrayHelper.exe
5784	SystemTrayHelper.exe
5784	SystemTrayHelper.exe
5784	SystemTrayHelper.exe
5784	SystemTrayHelper.exe
5784	SystemTrayHelper.exe
4252	WindowsHost.exe
4252	WindowsHost.exe
4252	WindowsHost.exe
4252	WindowsHost.exe
6076	WindowsHost.exe
6076	WindowsHost.exe
6076	WindowsHost.exe
6076	WindowsHost.exe
6076	WindowsHost.exe
6076	WindowsHost.exe
6076	WindowsHost.exe
6076	WindowsHost.exe
5056	SystemTrayHelper.exe
5056	SystemTrayHelper.exe
5056	SystemTrayHelper.exe
5056	SystemTrayHelper.exe
4588	SystemTrayHelper.exe
4588	SystemTrayHelper.exe
4588	SystemTrayHelper.exe
4588	SystemTrayHelper.exe
4588	SystemTrayHelper.exe
4588	SystemTrayHelper.exe
4588	SystemTrayHelper.exe
4588	SystemTrayHelper.exe
4164	BackgroundTask.exe
4164	BackgroundTask.exe
4164	BackgroundTask.exe
4164	BackgroundTask.exe
2616	BackgroundTask.exe
2616	BackgroundTask.exe
2616	BackgroundTask.exe
2616	BackgroundTask.exe
2616	BackgroundTask.exe
2616	BackgroundTask.exe
2616	BackgroundTask.exe
2616	BackgroundTask.exe
5004	WindowsInternal.exe
5004	WindowsInternal.exe
5004	WindowsInternal.exe
5004	WindowsInternal.exe
3068	WindowsInternal.exe
3068	WindowsInternal.exe
3068	WindowsInternal.exe
3068	WindowsInternal.exe
3068	WindowsInternal.exe
3068	WindowsInternal.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5944 wrote to memory of 3424	5944	a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe	91
PID 5784 wrote to memory of 4252	5784	SystemTrayHelper.exe	92
PID 6076 wrote to memory of 5056	6076	WindowsHost.exe	96
PID 4588 wrote to memory of 4164	4588	SystemTrayHelper.exe	99
PID 2616 wrote to memory of 5004	2616	BackgroundTask.exe	102
PID 3068 wrote to memory of 4796	3068	WindowsInternal.exe	105

C:\Users\Admin\AppData\Local\Temp\a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe
"C:\Users\Admin\AppData\Local\Temp\a8c9a302487d4187b397abca6bc184e748210331889657fda128f429512e721b.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3424

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5056

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Temp\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

C:\Users\Admin\AppData\Local\Temp\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Temp\\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 62e0bbe17f08cc2940f18fc2be60c644114e2506ab7236048e43b276062afb94
MD5 0cab762ddd4aa39d054d0e11a891a52e
SHA1 e5afa696fd3fd38818790967dd765cf56f0583fa
SHA512 384b04f573e9678ba452f02cdcd853ed8497e58aeb6689bd822d2e2f203a5e4085842ca141d77df451bac85b2b63db8541e329b575581b11274d72fd34050093
TLSH
T17FE07D1EEF0D05E37E63482552E658377982610E9485E8556754C8C249077FB4E47005
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 4fb6be7d3a1cff6c18341968725caf760a8c498e04f12a9eff95756d1f58ba10
MD5 89bc6d10a684f52f0021b3690bda48e3
SHA1 3235b7d29ba33fa0cee791319d6e2901a8ad3a57
SHA512 48120719749cf6ddb849487450d4576e21dadc31509677de4c28ebec21b818962a9e27026a8d5cc1800cf9d1f3b3f38ffb5b3a5ab80042e8cfff2731468dc584
TLSH
T12841B7DA6B197024BF85CF400838DA362EB8F1988582559674FA85733493BE42D15C9C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 afc5ee13d6ed025c84384a46139bdeb43bf8b0fd9dd2aab6ba9c52c0e92cc634
MD5 a6985e3348ab22d00ccc4d46882e9f58
SHA1 3bb3e490a5446b0ac2a73739535f9ff357703c5c
SHA512 a7598eb8170596e1e3b4a3bde5bc58a24d329c3a6af9f5a488efc3dd2095157e2bce814b5849da1056dd4488787fdefa9e8197690f63a0441d2a840d5d7fb8b1
TLSH
T121D02B7246FEF4053E2BEFB1E9D4E7D47800273216F5A44374C8C2540A48DAA6D4A221
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 187KB
SHA256 9667be0cf0d3094e929cce7cf98e2ec34007d72763f21ae2df74c95e4da3948f
MD5 742bc16f350bf18621a0d4f1bfd708a0
SHA1 92eaf7ff614f0c88f31ac955e0f22ac4e99d691a
SHA512 61ae20ca040755c334797583b7b5dc9d4b9bcb43e304d891e91eb06fd8d17c339dd4c90bf936effef826aa48a6ec1c5c104a38d4bd64e6c79891b321ef641f9a
SSDEEP 3072:b/xX4qvtYfQGujFUTqltS7YMmKRhZz3fQZAaXzEtU:t5+IGujFU2ltKPPUQW
TLSH
T14B143F186DBBB1619F4ACDA14C9AAA5E03F571DF2312331B4EB76ED01D43A9B8E0744C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 ac3b9420d8f28ab9603b250a1645eb92d819b1e80938bc9a7a62db83694b8df6
MD5 77926681e106c6f5f18af1d72cb4e264
SHA1 0f649289cff3929d6a05b48de459152c307416ed
SHA512 978b7c78b433a6a777b1c2fa616eeb2cacd7658736438be800c43d8ef0dc3ffe884e66d321e2cc4fe2c204f12dfa293a3019fa912cd30da82be300db2cdd50f7
TLSH
T1FB1165D65FE4B08049E30760CAF4C1253CB034812CEA748118828996309675DBF0903E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 64f1d5302f764b875376dd8a6921f0b91a7daee898203eb50acfbfbd905634fe
MD5 3e68d450f44c55a2ef39c98050cf1573
SHA1 7ce41df341f1db397d623d3b8f8d475da9876786
SHA512 365968292841f38dc5df8752b9289c935b594a2a7888757e45a5cee294071902694dc079d3d7ef6ad5a4307e96e645315e11f6448ed52b3c2238be9070f4a3ee
TLSH
T1DA41E9EB1B0E359DFF059FD51EF5C6351D78E47495400580B5BA849624DABC62E0AC8C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 79d63678b6126dfddf25b01f75988a870f913a22ada7876b51e3b52a1c3e06b1
MD5 5fd63c7c53f506bd73d82df0606cf3b5
SHA1 2062003ac63ac1560bacd9924b0ea3324bf4a9de
SHA512 44f1a444f1bbcae750317b7363d5abf408c55e8d7f6fd8e1d6cfd6cf5e449eb6939260b8e10d992b05644ee93c0db5d4b8cf86a8603467f0e4d583f904e8e28a
TLSH
T106C08C1C5AA20A16F2A8437D02C239139B218141E2858F052AF56A08CDABB163838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 da9eb7aaac41b256c10bcd930d43a066900d8e89b1a611fbed20a99e460f7400
MD5 d839362de51d097740becc217345776c
SHA1 6bf010a10341017db8d411da42ac65b129750986
SHA512 8df58246bb8a237c1fe89709158aa0a4d8ce1e3fcdea31d01e583cfa29eb29e187c296b6dfa827c774ba805fdd5e02b2fe148f8bd6545425cca4748fde779a6d
TLSH
T1F8F05C2C06FC496CE173CB79CBCAA693B915E113340546E90AD147896E12B025C86128
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 f605d9b148963be42c076bb9e7678dd384ab9279fdd7a7bfad9cd4052377efc2
MD5 4822481292a2bc51dcaae7c72d227962
SHA1 60a39e887283d1625e5fe6ab1bef4efd464eac00
SHA512 fde8b4cb94a7ac2e0715ab8b64874417a973e802fc16dd0fa03908295cd6e4b6672f3a9582e1fdea40bf2bc398e767d9671fe71b01e5dbf72fbf59bf1c35fe9e
TLSH
T169F0226438FE947AF03BDA7907C5627A0526E21660022AB826B113092E29E202C4250C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 0e0866f5743e5a54e5ab2ed0adc5444c07ff493d4d59e5db416765ee6b52c52e
MD5 e75a29695dac86af414954aa58e5950d
SHA1 8bb879128349fa70aee8d511871dfe20367b0cf6
SHA512 60fdc05053ea15e0e4c33574cad1425cce95b4b6c1496b246e4563d564457f3b0744505de2dcdba13ae9b89e552ceaaa9613be156e1dce27833b883ed4d257d4
TLSH
T113F0A320247C467DF0B3E835C1D532F7D939E21764094AF706DB13055610E000D5153F
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 17a5c65e1f112103cdad95291cff21014e4b1ee7483ce436f0620bbfe8ee0023
MD5 1f4d1f784a788be2b16ac4f1104e3fa3
SHA1 1d8ddbf94889c452d4b774b1eb259d81f76f1d42
SHA512 96d0232841563aba4bb4177cb6d698ec5eafd6c7fd67611d5340c72617d7af0118be48e3618520c3d8b3ba72731645515ae144a809919459c1a3008f89492eba
TLSH
T129D0122A5715032BF075527A659449D755A88512BA824BCC1F72074D982EB451CD182D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 3d9f6dd558d02c1b532c920449a1637171e434e2009c7210de83cf554126a5bf
MD5 373e96bffd9dc0ab8f3970398f13bb2c
SHA1 1d3f9a5201f3a5f63b8aafa1f0b049aa6d0fd16e
SHA512 2821f48a26290f810eb310b818779ddf95228916fcd36d1ce90e4f210bee1a856e70f71484cd5ddaf14231610ef375c4b6de42a6b183870408fbe97a26c4ef2b
TLSH
T113F05C281AE2456FE6662B7906F4636A9E15F2563404C4A526E9070AFE17F042D11439
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 0e7e5d4c5d8cc87cec2ea6561171c7f23167a4ca857e9c965cf05be5cae4a2ba
MD5 6afe28dfc78f9002ff0f4e5d0b6af930
SHA1 c9dbaeefdf8f38b77e40bcbab680270e03efea08
SHA512 38bf50ed6282ddce05443bf0bfc8ba9776e520ee48eb8c50eb5e38ba4c2196fc88863e8f3d8dc6b044a3bde269cf1eb5e315def63969da89f3ea6cfbc7f4927d
TLSH
T179F02B3C1AAF015FF731F77996C261EE9663E23732047F593A7182082D4AF45A6E0915
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 e7beb1db8b1c5a1bdb0334c53174e150105e6a821cb3c5681259ae0e8b952f23
MD5 b94d586df595339d84f21b57aeae9b5c
SHA1 fbb6df942d1e61d1c299363e80bbc989658d1162
SHA512 8005d6c65cfa380868385ed9ffd7422a5ee4e7e2b1ca412718efa6252a49f0defae0fe0359677102ea2efb5480392963ee65fe4bc8c259e0428ff611113bcd51
TLSH
T143C08C1C07610606F2A883B802C23D838A208110F3819F0126B1AA08CD28F122834C69
MD5 SHA1 SHA512 TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe
Size 2.5MB
SHA256 3bfa3789322f37c2a9dceaa42ae2a104d8e6c46045638af094dc813a783feb7a
MD5 e1086262169d641416df5ede9c1f55d7
SHA1 1de439cd81e61c0fbacd0ffc7169c88bb064f7d8
SHA512 5dcdb7dcdcad75ac08bcac445d404448c1a105bee37ed148a0f0a2b35d7c36f928711e119aa817425ef76aa091f93e12ce905833341971065f13759ac064454c
SSDEEP 49152:+eWUGHITpj2h0VZrp7u5HkL2CmIf+u9Yt2EXA7JFNMTbtBnV5fj:+ebGH420ZtgHkaNTA1k7nLb
TLSH
T199C512E5795E7ABAC10A1CBA8E16CD6270AC57F1DB505D93FFD53EBA4900CC30622932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemTrayHelper.exe
Size 2.2MB
SHA256 8eca6934ea951f6b4325018b51c59739c18b3188234dd724195cbb3dcf6725b0
MD5 2a91749a8ff292a9527a780a317f91c0
SHA1 290764178d49c3b393d0227bb35420f7130c3474
SHA512 9c67cff8af211af0eb3176534bdedfc8f87258beb85b55069856f0c73b6f8422cb6fe75cfdecc4eae4b03b4d0120c5e6f07cdb68d768146db4233b444ac17046
SSDEEP 49152:+eWUGHITpj2h0VZrp7u5HkL2CmIf+u9Yt2EXA7JFNMTbtBw:+ebGH420ZtgHkaNTA1k7w
TLSH
T1C8A502E5795E7AAAC00A1CBA8E16CD6274EC57B1CB501C93FFD53EBA4940CD30762932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Temp\BackgroundTask.exe
Size 2.3MB
SHA256 8befde457f7decee6a92891e814b140bc905a4cf6e4d333e23c04820c3165e0e
MD5 e19e9551384f2a848ee1b4f30f4179a9
SHA1 36dd517665f25f81812cf4346df0f6da6c62f74b
SHA512 9a26bb395869c17242f235c4db26fb608c083875e65a3d157df8b8542dffc8725a5e89e69a56261264ca3f7b7dc7e5c08e6c56fe9670fe2ab564dd4e26adc7cc
SSDEEP 49152:+eWUGHITpj2h0VZrp7u5HkL2CmIf+u9Yt2EXA7JFNMTbtBnVH:+ebGH420ZtgHkaNTA1k7nZ
TLSH
T1D6B512E5795E7ABAC00A1CBA8E16CD6270EC57B1CB505D93FFD53EBA4940CD30622932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe
Size 2.4MB
SHA256 76914c2c19ac9c51e0f890f3bf12afa43a5a5c495a4f5f97bc91058b45a22ee4
MD5 0f71b9c856a797bbd11ec73fff419461
SHA1 9e68147df7971cd24e0471f6593dd436515e00c2
SHA512 1fa5c6c863ff48f36ac550b26a0058e1ae184c97acad23004e3c849dec1d4f14ecb1d735d4784d90e8bf1008505635fe813eb348d29f10751be2ebd260a2589a
SSDEEP 49152:+eWUGHITpj2h0VZrp7u5HkL2CmIf+u9Yt2EXA7JFNMTbtBnVO:+ebGH420ZtgHkaNTA1k7n0
TLSH
T12BB512E5795E7ABAC10A1CBA8E16CD6274EC57B1CB505C93FFD53EBA4900CD30622932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
Size 2.0MB
SHA256 b283a59052eb560ace9aca6ed864f0b08675564dafb7f349997dcd33a9c7cdf3
MD5 cf4bddad32ceb58322f952f3cff06e21
SHA1 a50184befcf39e88b9dfaa127f056427f6e0f9c3
SHA512 c7fab56df9a23bde1fd2558d0a0e598b7e2e6c4a4c7b6a6a4d07563dda09f274fbbfce81fe431c7ba728b76388246eb5498cde89ed2840764eb2c87c6ca4eb94
SSDEEP 49152:+eWUGHITpj2h0VZrp7u5HkL2CmIf+u9Yt2EXA7JFNMTbtw:+ebGH420ZtgHkaNTA1kG
TLSH
T17FA502E5795E7AAAC00A1C7A8E16CE6274EC57B1CB501C93FFD53EBA4940CD30762932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
Size 1.9MB
SHA256 0f1a25f0941023b2fed4fda6b4d9a49525de530ed17706eb09587732ba40561e
MD5 4b65071bf5c0bf49c1bd5419e9373970
SHA1 c09c6abfa43694716d1c90fd45815c115c789602
SHA512 f6b4d97c898e7aefc78527d328949a534dab5dc081cf714b98a72f725bcb938e5c44c94ef2d93a44a2292464dcb3586864bc5323ff8061d12947ed3e74603e28
SSDEEP 49152:+eWUGHITpj2h0VZrp7u5HkL2CmIf+u9Yt2EXA7JFNMTb5:+ebGH420ZtgHkaNTA1k5
TLSH
T1319502E5795E7AAAC00A1C7A8E16CE6275EC57B1CB501C93FFD53EBA4900CD30762932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download