e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50

Analysis

max time kernel
150s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
Size 30.3MB
Sample261113-w339qaag64
SHA256 e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50
MD5 01ec9fc0ddae92cdb4d7479adf9ebdb5
SHA1 17ddce7f96c5fb0a23281125507589650020a6f5
SHA512 b7054369ae044e4965bf5f25af594b0a0bbd29e88dbbefe34e7c2c2eb8fc655d25dc0491281fffc92795b36672261a479876cd88aa1779d09b7b27e1ac3d0f86
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwAlPevU8mXbzHT5xVNpm:4JwMrcMGFyo82ENlNUFxXpd3oAQAu
TLSH
T1CE6733EAB84E73BBE51C4C3D8D091C2278AD1F659B1CCCA6EFD538B10940C627B67A15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1144	UserSession.exe

Executes dropped EXE 6 IoCs

pid	Process
1144	UserSession.exe
4072	UserSession.exe
5552	BackgroundTask.exe
4968	BackgroundTask.exe
992	RuntimeBroker32.exe
6096	BackgroundTask.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\BackgroundTask.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\UserSession.exe\""	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\BackgroundTask.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\RuntimeBroker32.exe\""	BackgroundTask.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
29	raw.githubusercontent.com
41	raw.githubusercontent.com
50	raw.githubusercontent.com
54	raw.githubusercontent.com
1	raw.githubusercontent.com
15	raw.githubusercontent.com

Custom signature

Detect suspicious telegram bot 4 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c426-27.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c429-108.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c42c-145.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c429-180.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3412	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
3412	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
3412	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
3412	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
3412	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
3412	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
3412	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
3412	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
1144	UserSession.exe
1144	UserSession.exe
1144	UserSession.exe
1144	UserSession.exe
1144	UserSession.exe
1144	UserSession.exe
1144	UserSession.exe
1144	UserSession.exe
1144	UserSession.exe
1144	UserSession.exe
4968	BackgroundTask.exe
4968	BackgroundTask.exe
5552	BackgroundTask.exe
5552	BackgroundTask.exe
4968	BackgroundTask.exe
4968	BackgroundTask.exe
5552	BackgroundTask.exe
5552	BackgroundTask.exe
5552	BackgroundTask.exe
5552	BackgroundTask.exe
5552	BackgroundTask.exe
5552	BackgroundTask.exe
992	RuntimeBroker32.exe
992	RuntimeBroker32.exe
992	RuntimeBroker32.exe
992	RuntimeBroker32.exe
992	RuntimeBroker32.exe
992	RuntimeBroker32.exe
992	RuntimeBroker32.exe
992	RuntimeBroker32.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe
6096	BackgroundTask.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4072	3412	e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe	91
PID 1144 wrote to memory of 4968	1144	UserSession.exe	94
PID 992 wrote to memory of 6096	992	RuntimeBroker32.exe	98

C:\Users\Admin\AppData\Local\Temp\e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe
"C:\Users\Admin\AppData\Local\Temp\e722a1a19a0683631709d592d816c80c4c94cac912f9d19bad2175582b010b50.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4072

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4968

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5552

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09A184963DB18218E7969055927ED546
Size 279B
SHA256 403542b4bd5e420670e3b7959ee7055639edffd718a0bf76adaa35a381016b3f
MD5 e346cfdd053ba12b6da4b518e1938a1c
SHA1 5c53020a0564d03b5adf55618ba213655423bca8
SHA512 753c4ae0455175af325f905244a43653bab53eaadd1c20d69525e4ef93b9dce88e60da6a4bd97ee825592aa002d07fb741627927c11f00dce09db4ad55b571a9
TLSH
T139D02B0992BF29523D11CCE4D4D6E48D7001166423FAF599B934C1493484D263F05210
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 836B
SHA256 10ce6a561968b29ac9d759ac8dbf69e4c2b2a775006fefbd7768f7515457a502
MD5 abba165d7e530bbd08c9428f8aec4273
SHA1 fd73fb2e8db7ca9a391b2925cef3399e75d43790
SHA512 60482859fe5a0fe5bd5a7046ecf59f9eb7273a75735b19b574f7ee7286a7ae4188135a88b98814428dff3beb00e8f149355035161f2a7918ae53dc7629c9868b
TLSH
T1C10186264D4B9D25E0E69CBC49A4CC1E0DF6B684D794F1594C4CA41C7008FCBDAAF0BB
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 cf94097a835577e7a50ade379dc1cf297d67df503b071bfb12b85feb39dfa441
MD5 8c7bcd60a92c37622ec3c08dde603797
SHA1 d909155aa1ed8aaa2e3e6421c74fe577b155602a
SHA512 1baad9a1d23458d41f72d8bb4b4a73d0c126a5b0ce343c9aa84f4692a2146efab102f289ac1eb62abab67c9ee6887271fb7fb199bc5988cb67c07e58dab10b3b
TLSH
T183E07D0797AC54D6B75304242A93641F79A2010D6851931A293D69D80C4B27FCC07201
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 b4092c269abebb9f0257deb11aba25a9fe886c714a5624d71027849567251de1
MD5 fb8d13c645aedde48999df2c774f8ff5
SHA1 92a97a2239b715856ccf066bdfe4ee5e26dc1446
SHA512 401e2c8dd620680bcff7a117eaa25c0bc34b41052af4b394e29089e00da18d159f332b9dec0129cb82cb257a615aabcc71b263ed7e8e40a7e144c331f9348ff3
TLSH
T14E41D7D92F097151BF85CF041438C6321F38F1E0989462D9B4FB85B2788AB91AD19C8C
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 238KB
SHA256 3fab6ca463bebbacf075fd281317808bcd1bdf2bf05021179729c564adb7a85b
MD5 af0706a93569c46e25c8d057e260db56
SHA1 4ae6c46363d90760a8174aa8b72423fc903961a3
SHA512 aa5cb5419e0323370ba97f190035bd42350685ac1132e483ae95d22953cca66cb916c4cbf2eb9a18f94d7708deed28263e5e9699ce1a4c814fe75c4500d2e3f1
SSDEEP 3072:ULMiiV6E3+bCmZw3RvfOzDZ3rOGX5svJp4Bj1Cw8S2ah2O05Il:ULEVf7XezDZbtXmSj1B7Bh9
TLSH
T1B034FE58ADF7F0565E8A9D618CD79E8E47F0319B2352621B4EA35FC01C17BDB8E6208C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 fb386a0724f7eb8d3f20841a49dcd1f57ad982d2fe4a7fe40b0ae5266b5a9f5f
MD5 9f7ae5176136918b5a111201508e1b3d
SHA1 e2d6f30356cdee3bb15ac14d51618035b503eb8e
SHA512 abc9cf0bb90d4124cee0d99a31749b18189226bf24c0b21c427e6f31d25953b71d64d02172f4c83e1e6cbfd89fae996b8f09b555f3d2e7abb8a451c689ae70ba
TLSH
T1BD1154C69FE4B0959AE34A70CAF8C52A7CB820C928FB74D12CC1C4923457B6E3B0543E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 c257e1fc34012e93a370fa3b3a35ff6fe47adb26a80dbfaf3103df1b980813ef
MD5 0d1aff18ce81d9692d5b93132fd30db8
SHA1 ac4ab2a66da11ceb4465d4471f27d634b9c3d2f4
SHA512 bd25cdd58595284296ef4a43d53ea333b2d3db152ee216b13e243f9e7507730de5aefded769490de49657c8e7c97208af6f97a4ed973e639f0f33c77a08f3642
TLSH
T16641C7E71F093868BF46DF966AB9C93B1E3C806491800D8674B3C49210FEB911A1A88D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 91b79e7eb875f3a0eecf676e8c38b189823f56078c808bce49bdc3de74693a54
MD5 dfa839bff27e8a69f21a3d7850ba73ac
SHA1 699e5f1eafc4787d5ceac4070ff49d2a267a86a8
SHA512 60e5d5123effa49e64ed4fc2faf3be3937ad32f3e658354b57d16aa83ee09598911facbed9d8318d670c2cf52a61f716c257aa51114d69e9a23e3897544889c6
TLSH
T1660144B1BBBE6B347B829D4683F9EA021CE4B7B68C5061C9E445C85E4C1C3A2A24418D
MD5 SHA1 SHA512 TLSH

Submit Download

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09A184963DB18218E7969055927ED546
Size 484B
SHA256 ead779646b28fba99e434501b502d440a81a6ed8c42840a4a16c622378e710a0
MD5 ac8834fd74973ced2ef1634b953c2c69
SHA1 f7824e8678b954a30086950b2384517ea45141fe
SHA512 d8ae3989016239a6b1e06d6d7c866ad0fd9b4fdf190ce3a65e5ae130eda165799671054eae10672c78a63d7efbd52b50c4e0e4fb99d4ef802551cb34154908e5
TLSH
T10DF0AB8420BC810AE0B6D835C6DC31A6FC2AF21A7849AAFA179323496621D504D5913F
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 65eddb6bfed8aac9719e338f520f263bf322f4b4df07318afd0e4fd70b7d32e2
MD5 3eb54c5dff9248814da5c7e7d2cbf6c8
SHA1 71fd943b32351056d5d0ce2f845f12352dc01be7
SHA512 3cac5950b57c4d9b2bd144c32c9d73338ec3654d772199db9fb08f80d172823125ab1806d2c1044edfd8465f4fe6fdfe77954e2120b927b0f7cf7a5abaed063e
TLSH
T1EDC08C908F92021BF01407BA59511A28ABA07523E0468F0E0AB1044C996591219A0C09
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 bec908cfa05c17c0dab46a0869406a92ed42f54c0f2757f68ebb1214026ecfc0
MD5 7d0ab0c8f70ae75ce13bdc42161a8450
SHA1 32d115a4799320666d78d012390258e4794e5d3f
SHA512 f7549d2bd00c087103eebc8fb3a9245196600b215a21f92bdd2de6bbd48f3dc06a8cabf1b2698fadce4c6bb117b04ab188bb6e8c8337dee56fbc7a02a40e9945
TLSH
T1F0F0A32C07FD406DF173DBB84BE5A7955D15F117280845ED0BD14709DA12F005D5117D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 4ca7a5be5f5fffb5cd53e14526bec3d633dd19a6cecece721af53ece2245b0d3
MD5 f73480fe0e5f04a174f206a4d2cf0ef8
SHA1 35215b71118b4fa3a3460fcb0fbd35917726b6f9
SHA512 9323b46716bd7df5e322de88e639f30d439336fd6ae25734c0a7648a5844bd946b67098c97be25d6b0c766551cadf4af244149086c2f0480de9a1fe55dd2894e
TLSH
T10DF061783AFFD57FF227D5B983E561707526F305300521B921F112086E41F103C42109
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 041dba63d1b1a783178dbbc51d1ec10517a66983cf1e79acf88f9db200cc9aa8
MD5 47ad514c178ea2ca9bea4043dbb9b247
SHA1 ef0c36c794b0a4cd5d108d075f3498bf3fd09fb4
SHA512 ed2ad9a0ee11bd1ee45c9f3a9882a7b039b769e165dd7ffc8900e9e15f5728fa030f0b83315f480d928198f3fdb88cf42cf9ecf577e925180c9460d3fddacfc1
TLSH
T1E9D0A9696B910220F06193FBE8A24943FB906229B6C2478E1E27121A883CE8A1822D0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 fcc1bf1bb6ba8d020e6a46d3519fa7c8999089b719aa7d51bd114de46d0e641f
MD5 db6ad3477649e2d504242737df210394
SHA1 e72ba477056c6442966923180ac34f19fbf6c5f9
SHA512 26d9dc83c1c1bbe6abff4b041348ef0371a1b7ac9b77b2d95672605f455d1e5caf7f0e92387494c4c2150ec34698284da76c1e08bf6ca665d4ac4873af7251cf
TLSH
T1F7F05C7423E7801EF221777501F456AAB81DF11B3401C96515A3530EF902E404D2143D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 f5714adc26142a979a835443556577fa508ff2a4045736b7d77821d9c40592d5
MD5 0ebab1df2d5e723d92635b7c3bffd810
SHA1 95f28c8ccc3bec7093f1664593ae26e2844535cd
SHA512 4362ae3e276af01768202dc025fb029079f69036438d957e46d3f5ce6afa7e7bc6845724b7d7d1809e365a2944aac5819fa3ce7d3a7e4a8b242ca7a61b796c8f
TLSH
T1F3F02B7C54FB014FF176DA7906C417D52523E1373208277976F492092D41F40BDA1929
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 4ab943ec45ee8d029bf3000ed0f7eba87f88c514ca079ac9c0aa2c7e30e67bff
MD5 8b3ccb64e56240f9fcf15c0d09ed6e50
SHA1 30c0d214476737402491e78f34effaf8eba0243d
SHA512 4ce146d46733b8908cd00cd942ddb36da362a3b140060593192cf651e5b869dd9af0eb337777e6b2f7ba6b2c8eb26c39ed5db109422ff75616504ca3dd63d87f
TLSH
T1C1C02BF89F420213F01843FE69910DA94BE06A23F1827F0A0EF10A1DCD38B12A4F4C02
MD5 SHA1 SHA512 TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
Size 30.5MB
SHA256 aaadacc15239777d25678ff093ab31bc281d41ecb83850344811a7e6dc85f766
MD5 959666fe434b131b9b92107acd25d91f
SHA1 cbb33327b155298ae1b115f457c16c0eabfb155e
SHA512 d80a139ee44dc41746834166587cf92bca66a05b911be20c989ed871624839023aaf001ea3e0fe1f2de00084a54ef3589efa97e5bd2d54eea0d9e936beb4966a
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwAlPevU8mXbzHT5xVNpc:4JwMrcMGFyo82ENlNUFxXpd3oAQAE
TLSH
T1B66733EAB84E73BBE51C4C3D8D092C2278AD1F659B1C8CE6EFD538710940C627767A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\BackgroundTask.exe
Size 30.7MB
SHA256 f0249db9318746689843ad4fcc77340ee8072c32dd90b3610d29d4f13977fde6
MD5 329092ae92c66755ea44cff3bde9af92
SHA1 89a95fc5042c31e8e0f3f31caeef6232a73856cb
SHA512 1331027d250167cc821d080957f987a2a02dcd8b323bddaee8e728401a90211b94e2c307dbc33d23f95b617d78b7d34018970b263cbffea6520373b8c2bb7ad0
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwAlPevU8mXbzHT5xVNpa:4JwMrcMGFyo82ENlNUFxXpd3oAQAsn
TLSH
T1816733EAB84E73BBE51C4C3D8D092C2278AD1F659B18CCB6EFD538710940C627767A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\UserSession.exe
Size 30.4MB
SHA256 1d266516aa14ef8340cda3e695363f4db544f477cf4c0a35be9ae9050762b9ce
MD5 e3d5c78c958ac2b2ec4578f15bcab788
SHA1 68217dfbc7f567d5397066be9ee539f09fc9c102
SHA512 4718ae8eb1c4fc532d46069f5e52cb70d785d789dfe82045e128c612a463994270423db0696d46470b3076148b1a69339f261c7066d148c603234cd6537dee8b
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwAlPevU8mXbzHT5xVNpA:4JwMrcMGFyo82ENlNUFxXpd3oAQAo
TLSH
T16B6733EAB84E73BBE51C0C3D8D091C2278AD1F65DB5C8CA6EFD538B10940C627B67A15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\RuntimeBroker32.exe
Size 30.6MB
SHA256 f113094b9780264d950fce7a74c2efe7904c9da74336f1061fbc221769687417
MD5 011f1e07e67ca78a02e7388ee38a0bc5
SHA1 64daa69a23b0a64ce03067fdbf9bcbae774bc6f4
SHA512 9d2905760700458227510ff7643351ef8f6a51a836c0083d06262f4e81a44a14936d1cb18f6e948495a1c70d8bf944cbbf466af475c58ee91ef370df710ed073
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSWByoaGp8mpEk1dwAlPevU8mXbzHT5xVNpd:4JwMrcMGFyo82ENlNUFxXpd3oAQAl
TLSH
T1C46733EAB84E73BBE51C4C3D8D092C2378AD1F659B1C8CB6EFD538710940C626767A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download