6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
Size 5.3MB
Sample260720-rvybaac19j
SHA256 6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43
MD5 1078defb029ad7cb5f861c6690e5b906
SHA1 c58ed6cfe8d2bc364309ea6bbbcf9daab91d248d
SHA512 be21f5c071fd3f9c99b07901d9194c713eb20c4a3b399b2e8e4525d11971569608b1bc0ae0f8e03285221fc0e3ef4e3f73981e5dfbc58e5f2e44b84f697a6c71
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6PzD3hWkko7C:+0s420bTjzGlBrJTJb8QAMQCgGH3hWd
TLSH
T1124623E5785E2AABC10E1C7E8E56CE2635AC5BB1C7645C97FFC53EB60810C931632D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1632	WindowsHost.exe

Executes dropped EXE 12 IoCs

pid	Process
1632	WindowsHost.exe
5440	WindowsHost.exe
5528	SecurityCore.exe
4496	SecurityCore.exe
1616	NetworkHelper.exe
1152	NetworkHelper.exe
5520	SystemTrayHelper.exe
4240	SystemTrayHelper.exe
4548	SystemTrayHelper.exe
3040	SystemTrayHelper.exe
4844	SecurityCore.exe
548	SecurityCore.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\SecurityCore.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsShell.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\WindowsHost.exe\""	6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\NetworkHelper.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\SystemTrayHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemTrayHelper.exe\""	SystemTrayHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
28	raw.githubusercontent.com
51	raw.githubusercontent.com
1	raw.githubusercontent.com

Detect suspicious telegram bot 9 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c563-1.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c568-13.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c572-95.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c573-129.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c574-164.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c577-210.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c574-245.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c574-246.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c574-247.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1208	6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
1208	6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
1208	6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
1208	6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
1208	6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
1208	6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
1208	6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
1208	6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
1632	WindowsHost.exe
1632	WindowsHost.exe
1632	WindowsHost.exe
1632	WindowsHost.exe
1632	WindowsHost.exe
1632	WindowsHost.exe
1632	WindowsHost.exe
1632	WindowsHost.exe
1632	WindowsHost.exe
1632	WindowsHost.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
4496	SecurityCore.exe
4496	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
4496	SecurityCore.exe
4496	SecurityCore.exe
4496	SecurityCore.exe
4496	SecurityCore.exe
4496	SecurityCore.exe
4496	SecurityCore.exe
1616	NetworkHelper.exe
1616	NetworkHelper.exe
1152	NetworkHelper.exe
1152	NetworkHelper.exe
1616	NetworkHelper.exe
1616	NetworkHelper.exe
1152	NetworkHelper.exe
1152	NetworkHelper.exe
1152	NetworkHelper.exe
1152	NetworkHelper.exe
1152	NetworkHelper.exe
1152	NetworkHelper.exe
4240	SystemTrayHelper.exe
4240	SystemTrayHelper.exe
4240	SystemTrayHelper.exe
4240	SystemTrayHelper.exe
4240	SystemTrayHelper.exe
4240	SystemTrayHelper.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 5440	1208	6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe	92
PID 1632 wrote to memory of 5528	1632	WindowsHost.exe	94
PID 4496 wrote to memory of 1616	4496	SecurityCore.exe	96
PID 1152 wrote to memory of 5520	1152	NetworkHelper.exe	99
PID 4240 wrote to memory of 3040	4240	SystemTrayHelper.exe	104
PID 4548 wrote to memory of 4844	4548	SystemTrayHelper.exe	105

C:\Users\Admin\AppData\Local\Temp\6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe
"C:\Users\Admin\AppData\Local\Temp\6be3573ef9e285645bdd504eaf6d75dd2ce78378c3d0bf9252eeb32b678eab43.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5440

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5528

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1616

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5520

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3040

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4844

C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:548
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe" --monitor
  2⤵
  PID:2580

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe"
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 281B
SHA256 56044e7c672df35700f9ac390ffdf8ce41732759bd8531b46ae5e420f665f24e
MD5 5284083e619a8fb05e3f58dccd1acf40
SHA1 9b0d313c8e08fd55bf0de015bcf7a8e46cb45c69
SHA512 8cfcb53ec6a120e8308a107bd1482eb52e622c85b7a43314f09b1342e94bbfed8465b5e9ccedc77d432864f2a4b40a9a42dabaac0e64f2cadd1a692393b4ba0c
TLSH
T1F7D02B5A13F9DC992F63E9D0D8C5A0247402359603B5A824680D822F9C80DBAEE42618
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 315B
SHA256 c341bf40d330ad229049b4ab04f743dfb9f6837880b06fb9a5fe78a571d25bf8
MD5 3a2ab0998fb70b5e54b22fb83bb8db93
SHA1 2e37f41757e185ccab19f2eaf3326e43b170d84d
SHA512 bfefa69ea37014426913c8526af51976492002c0678c435e3b155a62f79565c2e078c444baec7b0b30c7c72a7de0b5a5ec6e6dd7beb2722c062c60785fd36e42
TLSH
T1BDE07D53F31D54B871639E287BA1587F7851301D90D94145685448D14E42266D60B669
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 731fce6086ee9c81a2a44954a0d500c0ca13c9dab5d07e42e0fb20658abc11fa
MD5 3dfcb5630cdda448a010401b348b5f74
SHA1 f4d96643f5321db70dac428121e5b76cb2694ed9
SHA512 6597398ff259a5bcf0ce7aa369a4d333f3a2b276befd25270b0f91c227b84226ea6cb6fc3d06e4caa20e5f6e0da8c7014aab1ad14dd912c21c0594055f51fb7a
TLSH
T16741B7D97F093075FF82CE825D79C73A2E38F1849844649A70FBC8E27895B983D1A45C
MD5 SHA1 SHA512 TLSH

Submit Download

A8A4CE43DA65177907B85FEC6335160B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A8A4CE43DA65177907B85FEC6335160B
Size 97KB
SHA256 5f9bd80acd13c9e246a9c6044a0e1f898067e7febcea6f1197c732068dc48cdb
MD5 1c05ad2ae073b49ae1b831b73e02c78b
SHA1 f0eb960d80b2847d6c56558573a52e0528886262
SHA512 2d3735ad372a4b73b5a4028bb86c7bb012162c6e4a2d0351eab6c5c1297174851cf6b695ad789aa0f96ab9e8f087fbbec6e8d4102d5af403c982efa2caffd043
SSDEEP 1536:S+PHLXAjZILT8duabiEAm+qUY7Rek+eFfigxTq4qDrtGu9K:HHLX5T8MMiEAY7RHfigxT0HoZ
TLSH
T195A31CA89C77FA61ED0B8FD64EAEDE9E1EF511D71D01822E0E307E509C13A57EA57040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 979B
SHA256 5c832ef1c014c33fd8d34f432522d0c0a81103d0139062316f1cdb917bbb34f9
MD5 b13ad82c1206c0f384a0d6e7f5494a38
SHA1 4bfd3509c00a5499f45b8cb7a060bfdfb99a5e80
SHA512 0651bcbdd97f4ada535bde161f7875b9353f5afb56e466bd671860c9182488e48fa4a762c51d27e8d0734f3fe8a1b5ab01cedbb3801fd8d1171a9d907e306fc4
TLSH
T17D1132829EE8A1D049B366A0C7E4C1257CB5608129BE70811C808892145B71A2F0902F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 ec3009898656307ff86e13639e0ddc0158b2cbb0b1b22dd185e0abace0c3f66e
MD5 9a0430f05aff8e1e79bbf03a6115e247
SHA1 c17d05b53460772705c13c88e553d9152911557d
SHA512 b168c3016c3dfcc372ccc3e9c4883165cec32298f2479d8eac999f4a37fa5c26d933daadc16e85c5f3c9a00712f1dd07700d1b2bb5b33a862796c80ad5910ea8
TLSH
T16D41FAE72B0538EC6F428F491AF9C47A0E3D82E4E1C01C82B8B7C8C214DE7E16916C4C
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 f7173b35e8e54e7a30f67a66306f07806a54ca40c10a594c2588e14fbfc79347
MD5 7306abd43bd2a7c196749bf83267bb79
SHA1 b2af98a37bf3117063a8380c1ca09a1952e22d9d
SHA512 7873aa6e4b4a42e45c1d399bc8c6b8776ce29ce63bbdb2caafbfdf5fa5cafcfafe6413b2c645c6f4f9bf9d2f74163fb3224417ee7e9e65e84e87ab80a6b22bf4
TLSH
T189F0552034BC4224E672D8B8CFE571ABED1DF41ABC02A6EA07A356086A45D514D6243E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 c947ddf8c3341476b7daf2c71160edd92c0b6abce00197e1863bdb3b93e73289
MD5 daed1f47e013155a30f6532228fedbab
SHA1 3ee498b0edfd2fede390eb0ac4d902fa10c7873c
SHA512 1f1207d0bbed4b7a1756d1814a7018e02d38d538898b81843d8621a176a14ce9c5775ab808f14dd146f07d54f07d8006a8c1c7cdf8a32a28fbd7d13d7c0665d5
TLSH
T138C08C1C2AA20A06F2A8837C12C13903AB609101F6418F051AF56A08DDA6F162838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 a9f316b86f0c8e7913caa0d1ff14ae93af96325fc8a44aeaa893e68116ad79b1
MD5 58394a377e4f240a3e0a2e496c00f942
SHA1 32d432c983291922d0384c2c314740b29a533837
SHA512 f407bba32a18fe8a2017bdabe041313967940d10b0e1bb5a5f356701be8350f63715312740a5c5ada74e005ad1609f5c1db3948cc92bf395d8cf1ab72ee261fb
TLSH
T1ECF05C3C02FC806DE036D9794BDAAB955C15F22B180445F90FE14B489505F025D91038
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 aeb481c413eb3e750daffb183e65be5c5fd4762ecb37a37cece915346b221afb
MD5 95afb81aaa22bb16e91cdeb0ff17ba84
SHA1 4fb6a7d6b8fe0fb59f7ff80fe32f7c7ef46a4541
SHA512 ba9f43f8d1086806d08876a741b3dab179d36436f0aca90a539d772a9d96eddfc0636ad4795ffbbf67fda8e7ed419d382a38e8e23c3c4816de9c6be0765df48d
TLSH
T139F068143EFB913BF5A6DB3803D0717099AAE25630021BB42BF6134A2E14F217C5292D
MD5 SHA1 SHA512 TLSH

Submit Download

A8A4CE43DA65177907B85FEC6335160B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A8A4CE43DA65177907B85FEC6335160B
Size 246B
SHA256 159a8c6273885f9d643f50e960d4c3f31f747209d6469486202fe31897ca1603
MD5 3021f1e0917f929e418843fa474d08ab
SHA1 82277feb7d914404988004c6ad8da2e561247917
SHA512 3623cb536bb89a708dad91bf3f9a5220aa6f7b9ac220917b0f3ff6b0e7f350d54167246ae6e669b33bdd715932a5cc0005690346974fc296997930de4453a5f9
TLSH
T165D0C97C67A50529F176927A9DB1579F0E90390AF6419BED0BBA5618483EE011C62C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 bda3b7cb8bec9555dc9c182982eced23a095e242897eeb410319398c67a1e4b9
MD5 3ba994b882a84c98ec2fe2d6e4e8ef37
SHA1 b3f5824a4a68c7e7cd23f62eae197bdba54a3533
SHA512 4a335864f9a4474b3a7095da4e6c67c8c75f85723bf9ff9c3518d125fe7eef43a64e58fb0d4cae081e1be08c2f4c15ede65fb5657fd731afd6f0f91ef1642611
TLSH
T1DEF0AB342EE6443EE232677D06E493DF9D26B2163800C5BB67B7030AEA07E400D11438
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 de5a13be615ca7438fe37b3789c94f4c1e7fdf241cf5a6dac8fa07152105f457
MD5 538eec6a370c412acb25c3ac23e98604
SHA1 a845e99ba78670d3ba80491291ba03b235d98f39
SHA512 ff0dc91f3358a37733d14618f4e96eaf32836fc1f46783d073fcac2d2505d51f4efd48d7b1d54cee062a3f8ec335fc5add85a405866cd3ea5e19e180bf50f8a7
TLSH
T1C8F0A33825AB112DF1B2E9B902C021D6C413E1333005276C37B253492D66D806EB0D2D
MD5 SHA1 SHA512 TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
Size 5.6MB
SHA256 276ec6e6eee69dea9f83f6b4734f538aab8eda502022fe74dcd3ba9751bf83e3
MD5 0d192573e58e0e67b1b76d73763d7031
SHA1 09d2c097e2446d7e2a62fe8e2337cea9a28e59ec
SHA512 abe339518e5cdb29b0057683fe814d1fba802a797ba8a6ddeff8c823b714f992c171b9a9e14106be43dab3ef89cc17ea9a3ecfae0310559f51e431c80d21f1b5
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6PzD3hWkko7pVV92g:+0s420bTjzGlBrJTJb8QAMQCgGH3hWU5
TLSH
T13E4623D6785E2ABBC10A1C7E8E56CE2635AC1BB1C7645C97FFC53EF64810C921732922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\WindowsHost.exe
Size 5.4MB
SHA256 2cec3fb0e6fe13fa7a691424c92e8f88479f5b2223f1b3c410c300c2dba72c02
MD5 887394cabbbad839a31f1d0a003f3230
SHA1 11d5c32d3f8a5e692aa823795fca7637499f738b
SHA512 fad13aa5369412e3807d85517efb29218093e799677c3053081ad51c3f86f4c103badfd0b3ff4e10816deb33807fc1bfb3dac69d7a5b4a466f291fc1310a16ae
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6PzD3hWkko7pVK:+0s420bTjzGlBrJTJb8QAMQCgGH3hWUw
TLSH
T18F4623E5785E2ABBC10E1C7E8E56CE2635AC5BB1C7645C97FFC53EB60810C921732922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
Size 5.7MB
SHA256 24f5bab0db10154ec2e74bfda35694ba4d54308bf74d44d234caeb837b9e98ec
MD5 87f09d83012be43808a6da11a868200d
SHA1 9951101df08f4ac3303fc89b972a48dcd21fe08a
SHA512 f7f46ba28155648828c03ff4080f129a11555e1d60228d7172592a83859e12df7d8d24ca7ea7f043f11f4102d0c8f45254802e7a391a4feb0d2e44d832530a4c
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6PzD3hWkko7pVV92oZ:+0s420bTjzGlBrJTJb8QAMQCgGH3hWUr
TLSH
T1445623D5385E29ABC10E1C7D8E56CE2675AC2BB1C7645C97FFC53EF64810C921732A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
Size 5.2MB
SHA256 d7846ba8591f9ac41f2b935ef37069ef691aea89eaa7e956927300b249ff221f
MD5 e665097c1e7b9d5e81b00fb7cb9e23d6
SHA1 41a08fcaf8b5ae492463490bee97c8fd4dcb5b75
SHA512 a43ed42a3e27ce7b32bece314c24150601f47cca6c82383d421659fddc6891aeb6fad2cb5185f510b6d959aa8701512ab78d6438d93b743b2751dd7b50275771
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6PzD3hWkko7J:+0s420bTjzGlBrJTJb8QAMQCgGH3hWo
TLSH
T1D74623E5785E2AABC10E1C7E8E46CE2635AC5BB1C7605C97FFC53EB64810C931672D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
Size 5.8MB
SHA256 b0ec9730f28ec00827d399e2ee4ff78685e5f593fbd9b5e2c740626d5cb19603
MD5 744f1b19f3d22bda96e57693651ae92e
SHA1 86f9b50ca31f7111e3e11b7634b146a01b30df2f
SHA512 1e86207f974223467ffdc633009c5c3852db08ff0a9880f75ff9cd927b39de3bc261befeb6b937a503e545ad71008312ded308e5517ba9f54b9ccdb226c42fc2
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6PzD3hWkko7pVV92ox:+0s420bTjzGlBrJTJb8QAMQCgGH3hWUP
TLSH
T1A45623D5785E2ABBC10E1C7D8E56CE2671AC2BB1C7645C97FFC53EF64810C921632A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
Size 3.4MB
SHA256 326b7aa4177ec115235cfa90d5fb90b9a61145f1d49e793e65a1f61c4262c786
MD5 5fa251e3d4cd2200a3a3b085e2c097e4
SHA1 b6ffeca46a5fcbc6edeabbab3f82c557adf806ec
SHA512 81e3fa0a1e34f7bce4ae470cc968abfee896b2354ba3462a709029fd2e247255546c0940ed2af9b55bd4dfbae39dd54d06d9fa01902a166fabfbdf76d50a8c20
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMJ:+0s420bTjzGlBrJTJb8QAMJ
TLSH
T173F512D5785E6AABC10E1C7E8E1A8E2675AC5BB1C7605C93FFD53EB60810C931723932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SecurityCore.exe
Size 5.9MB
SHA256 556e339a98533d08ae4c9f1e03640441ff58c85bb7a6ca159b7fa22d2b2dc8ea
MD5 3f18999f90dc1f689e7804907f7b8727
SHA1 7e2641a92b3f52fb13c94c18fa35bff740ea3d87
SHA512 f022a176c6171eb5a55b5e4421358932cdf9152618e9570888198965ac2a233896cb2b6cd005647df8ba56ccc426fe05a56a1e3eb117991cb90976a7accec949
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6PzD3hWkko7pVV92oe6:+0s420bTjzGlBrJTJb8QAMQCgGH3hWU3
TLSH
T1BE5623D5785E2ABBC10A1C7D8E56CE2671AC2BB1C7645C97FFC53EF64810C921B32922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 5.5MB
SHA256 3ba1ec3f477de9653c5eb04fc9b1d6819467c4a7eb5c692b3680d0456bda6c08
MD5 db94c394a896637e7197ae0163d7a0f3
SHA1 2f75b90e833342d7a60da0a4f21c1f65b1cd3301
SHA512 48930104816eb4b4be96d9a3f83dc8fdbf37dc5987a4a6442e699cb7954a5fc5de7cd2d58a0bac072087a5598350b8a0e37399cdb8e3725dc71568022951f2b9
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6PzD3hWkko7pVV6:+0s420bTjzGlBrJTJb8QAMQCgGH3hWUu
TLSH
T1B24623D5785E2ABBC10E1C7E8E56CE2635AC6BB1C7245C97FFC53EB64810C921732922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
Size 5.8MB
SHA256 376ee65f6e5b10058f7588560d3a8433a06f855ee7c5346b4200d6668cff3e50
MD5 71907da7c11325a5b7b9aaad61f3378f
SHA1 b5596d497e24cb93779f56c8a405190835acab92
SHA512 c7cd39b86147370209084f6e534dfe6055f778a401b0509e4c8485d7332f6b11040ccde3045279dd345e5a0c852847c92b6e257223474d9a76a2b866c2d28f8f
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpv8LeRT6PzD3hWkko7pVV92o7:+0s420bTjzGlBrJTJb8QAMQCgGH3hWU9
TLSH
T1C55623D5785E2ABBC10E1C7D8E56CE2631AC2BB1C7645C97FFC53EF64810C921A72922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download