8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
Size 5.8MB
Sample260824-w851hasclc
SHA256 8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7
MD5 36108ebe81a64311e0304f1dd32d2a9c
SHA1 4b0d25f216987757d34295555fcf72a9fa908d68
SHA512 600c91040d9cd5ffa7ef32a3b8956c4f198011783c46f68c24fe37e3ff0f2363179a659f5d3fc35e35d5609b86a02d1539dc2e61b30d293f435b21cc08a40008
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwBCPaNqA3AGQLC+:+0s420bTjzGlBrJTJb8QAMQai4SGyvkv
TLSH
T11D5623E5785E6EBBC10E1C7E8D178D6275AC07B1C7904CD3EFD53EB60851D921A22A32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1188	SystemTrayHelper.exe

Executes dropped EXE 9 IoCs

pid	Process
1664	SystemTrayHelper.exe
1188	SystemTrayHelper.exe
5716	SystemTrayHelper.exe
5012	SystemTrayHelper.exe
3012	WindowsHost.exe
3740	WindowsHost.exe
5460	InputService.exe
2220	InputService.exe
4444	WindowsHost.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemTrayHelper.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsHost.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\SystemTrayHelper.exe\""	8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemTrayHelper.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemTrayHelper.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsHost.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\InputService.exe\""	InputService.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
31	raw.githubusercontent.com
42	raw.githubusercontent.com
48	raw.githubusercontent.com
1	raw.githubusercontent.com
9	raw.githubusercontent.com
17	raw.githubusercontent.com
25	raw.githubusercontent.com

Detect suspicious telegram bot 5 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c50d-27.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c50e-102.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c513-139.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c50e-176.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c513-210.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4580	8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
4580	8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
4580	8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
4580	8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
4580	8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
4580	8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
4580	8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
4580	8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
1188	SystemTrayHelper.exe
1188	SystemTrayHelper.exe
1188	SystemTrayHelper.exe
1188	SystemTrayHelper.exe
1188	SystemTrayHelper.exe
1188	SystemTrayHelper.exe
1188	SystemTrayHelper.exe
1188	SystemTrayHelper.exe
1188	SystemTrayHelper.exe
1188	SystemTrayHelper.exe
5716	SystemTrayHelper.exe
5716	SystemTrayHelper.exe
5716	SystemTrayHelper.exe
5716	SystemTrayHelper.exe
5012	SystemTrayHelper.exe
5012	SystemTrayHelper.exe
5012	SystemTrayHelper.exe
5012	SystemTrayHelper.exe
5012	SystemTrayHelper.exe
5012	SystemTrayHelper.exe
5012	SystemTrayHelper.exe
5012	SystemTrayHelper.exe
3740	WindowsHost.exe
3740	WindowsHost.exe
3740	WindowsHost.exe
3740	WindowsHost.exe
3740	WindowsHost.exe
3740	WindowsHost.exe
3740	WindowsHost.exe
3740	WindowsHost.exe
5460	InputService.exe
5460	InputService.exe
5460	InputService.exe
5460	InputService.exe
2220	InputService.exe
2220	InputService.exe
2220	InputService.exe
2220	InputService.exe
2220	InputService.exe
2220	InputService.exe
2220	InputService.exe
2220	InputService.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe
4444	WindowsHost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 1664	4580	8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe	90
PID 1188 wrote to memory of 5716	1188	SystemTrayHelper.exe	92
PID 5012 wrote to memory of 3012	5012	SystemTrayHelper.exe	96
PID 3740 wrote to memory of 5460	3740	WindowsHost.exe	99
PID 2220 wrote to memory of 4444	2220	InputService.exe	102

C:\Users\Admin\AppData\Local\Temp\8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe
"C:\Users\Admin\AppData\Local\Temp\8640c7d536f0599b4c831ba98c52020a433e58426b420e68057489b1fac4aac7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1664

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5716

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3012

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5460

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 280B
SHA256 f972875e70c1d8c955370e51cdaa2b30490a3310e08c9e21d4692e6c275b845e
MD5 47917683f6d20b03a810600da6bf1eb9
SHA1 ce60426040ca9d355e3a0a139168bff74bc5822f
SHA512 a48ef5a8c01891961f5958de55d39b9531c1242946a677c346322edbb78b09769844fbd5e77cb7e6fc1aa5dc887c0545d69dab38cfedf2febf115a8c2f5b0c91
TLSH
T173D02B0556BD99A33B32DC8048DEC5B0BE0291A112D43C211C0DC27624480B6B706044
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 9066534b093088a317bb7df20fec902d509d2b711c016a7d7600e2716cb4a79f
MD5 89d8bd33620c0cc6a7066158cc9551a9
SHA1 f358fa3cd3fc34fdc112817e3ac8489ac78de970
SHA512 d34f5dec12f5487e260ec7e5f257341e8bac0bcab006bb98e6a0b7b8c244cb330c2254529dd6dd0a1ea6c48c485a1a481aeae71d1c6e5091b2c39843fa85728d
TLSH
T1B1E0722A6B0C46843AA3CF2407E89C733C6A518964921215681897E20A426EEC30F29A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 3d6f060b7287bcdee784465103ea19d69bca480ac8447dfd700d1fbe5e1ce249
MD5 3f6184d4c8785f712b1bcb749f965a0b
SHA1 8b30abfeecef80535e5695bd5065be355fa0e592
SHA512 9eb1d8db17d40def7a5de67410bc05b231a02c43c041a61fac31f4296e823ddbcfbc17200317bfe4a4ad5b5b520f324f04c2970aa61cda5a9b58b222629dcb36
TLSH
T1CA41FACABA1CB854BF45DF4448B4CE222E7CF2D41540159635FAC8F22486FC86F0B89C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 173KB
SHA256 94379e4374642ef0b2af4d7e115270811f211204ac7931998938725661a32098
MD5 36c0992f681b56a46c19c64376bc0320
SHA1 e573dda183fc6a278bee60c2770de097322479ff
SHA512 34b315a1b451baf0fc0d3e2168dadfe256e0f8a61674c5a27e1cff87cb811e042f79049aa192f5a2af6af3db910c3208c10ffff8f237a056009d9b33614cfe24
SSDEEP 3072:G6xnYMFwK35BgXrXgYHYp6/AmyRQsHcbJ7Nh:G6KuwK87QCYp6/Wx8bJZh
TLSH
T177041BA85C3BB6A3AD07CF524DAEF69612E591C52912732E3E347E505C13ABFDA13C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 06e16fc816cd78ffb99afac3ddb8b50e6aec5ca8ccc83e66de02bdcaae6d3567
MD5 51184e69ed2cb5631bf01411ef13d33d
SHA1 84c61f6ada63505cd720ca6ee0ac30270c5acb41
SHA512 15b935ce752932e8289f8523ed04c757bc6d4b011d385b170321b1ac6361cf7d413e43e9b355393e7fb14e276476ebbf58638670d1513fb9065755b7e0752296
TLSH
T1E91121C29FE4A09085F786B0CBF8D5337C7870C62DEB30C12C81C59220967186B1903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 f5169ac952891b03dd545f4361e8126c79c394cf2fffc8a968cb134524f38184
MD5 a008841d1b0feea0726137fbde4e99f8
SHA1 c469cf775b0d6147913fbe2ae13788c7ed2e42d2
SHA512 04588d76f33f84667f2fd8cd56ff9dfcf98ae5707085034a43787c8cd37a01ab2fce292c2d5df5fbd06107c18646f9ab9520a38829d2222a1b893fca34814ba9
TLSH
T1274109EB2B197C99BE06CF9A0DF4C63A1E7C909461500852B5F6C8E315EE3D61847C8C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 db079dd0123c67646cea0633033f4b438cede82d2727e51a8513602b094df9dd
MD5 c393e37197013a09ac50716a8d819f56
SHA1 a8d22b6578158c115f259b56a79510ee0511b533
SHA512 8f95136238f99d3abd6de91fbe6c2a91ce50410b3273bf5afc6c4c3bde5609da6749ee01b121718593921e93879dc7a3d811bf88a6bcefc8f31a6e45233b15d2
TLSH
T191F0DC1528FD4238E032D83486D47017AD19F0157805A7F706DB53089B15C410D1202B
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 8cf1436c2dd82d6985616ad0b64bb2f41533ca050c558c440ac3b426602f9398
MD5 3cc510ce81dcb012c2d2974d95426618
SHA1 e13cbab18a01ce42ffaabaced8e289b0d6ca5699
SHA512 70700857dc266354e150e0d725803e612c1cfec6de868e325359dbcc48056d50845c2edc5530c691b035bc5800b70696787ad309e0561e39647bd6e40621a802
TLSH
T1ACC08C1C2AA20A06F2A8837C02C239139B208112E2418F052AF12A48C996F162838C3E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 ac3e6f324d52f8d95ff8b08a3182e67fe031c8e41f8ff438215938953d314be3
MD5 60d4819eea12c172b7205243309e217a
SHA1 b07165be7ecc87df428b2819c1fbc7e67701f6ca
SHA512 ae6bf0ef3583d969dbddc9151c9f967df452e907e71bc07fa8cc246055ba960ebbca0a657346b0f61c83444cf648cec7a9e84d21856abd285e7522a199034b11
TLSH
T1D1F0553C0AF851BDE07AEA789FD9A7A25C15F13718044AAF2AD14B4EAB02F025C52479
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 d7c065b9bfae744cd4a48b60b9b927aaa28c196bc80913ef29be2e76f120ee3c
MD5 b85efd8c98354c07d015112c3c620202
SHA1 fbda565481fb17c094f448f2e670358f96135509
SHA512 6bf80d4a3120fb39040c2379ab4f0d7336a0c0c26d786cc990b2684e8c1761277d491ed799b28dc8f4ba82371f1f6cfac5b1619c2a8b352d597664e7a3537cf8
TLSH
T105F0221079FAA03AF026EA3983E530B1E629B20A34055ABD26B363042A51F242C0391E
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 83ec741458d1244ad51486e79f33e52017a66d543afeb2f684106d7cbff54fbe
MD5 44532881bbf4247e0fde6a25c4197ffe
SHA1 a23dda498f03f0f026660c6a0e1dd7c404b02d45
SHA512 5e8c6b0e5df8e488bf1d2e3faa276a1e6cf99377263edb838962e41fed7a95cff0b276bbca3be91461d5a0aa4919d58fa765ef596e04196d91239ec71f2d7539
TLSH
T177D0221827010172F024833A44B016837EF49906F2822F802FF1130C482EF001EA2C0E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 9777d9c1def06e1bd22ddc66229f89faab4ced5cbf4f0bd62ba2af32ce3e71d6
MD5 84a1f3982981d46ab5fec10254f1687a
SHA1 84d9893ed289893243fcfc5dacd294adb5cac336
SHA512 d4ece479af008e9b9593837f6eb2b2ded5a11c6a4d36fffc8def186d18d546c719a0aa8ee4ea8363cc89689fae05b71985d1c216061f8c7d7786b638fb94b3d1
TLSH
T1DAF0A32516D2401EF6723A394EFD53BAED15B1563401CC9426E6070AED17E005D1153D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 38c96bca6d4f8d72b00726494d1356c61e3060b11edce16bb12d3388229284f3
MD5 bdb937fecfb443d4f3200c04d44e3164
SHA1 beb0afc831fa8f3fb0b5591230a0d5d9d25f4707
SHA512 088537fd2e83f4b469eb701027f57c3bd6b3b4a84f7cd250933ac44e8328252ff101d231bc879d69b548d997867b6ab9890f6989a015762aa51bc227f09a6701
TLSH
T138F0AB3934EF000FF132DABC03C113D40962F237360C276E3AE402092E4AE41BBA1926
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 8ab2c8870b9437880f70d72d3f3a972be0e1f550e93a6d19371b2f3e98ef93ac
MD5 10007bc6e4340e4289df3e42d9d40f76
SHA1 da4fca457f7b04cf49761e232f63a99243a3bf7c
SHA512 6092a6009d872fea28511a95969824ea29741313e2216fd2ca279be1bbea24fae8d74e04cd847499956cf3cb974cd8143fffffaf7c473a4072e728707e4799c8
TLSH
T1D3C08C1C47610606F2A883B802C239838A208211F3C19F0126B12A4CCD34F162C34C69
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
Size 6.1MB
SHA256 194ce5c6048d06fb93adcd776baf103c9b0014db63ef40a840da1c1f9d558959
MD5 71a35fcd8541d98e533e2abe7fcdfe36
SHA1 50dbb16374ace4a95485bde9d344174c08d0321f
SHA512 22bae1cf49b6c57184d60c28eabb0d3e932a652d4430e45cc13b19e69916daff67c24409ab183efa2f3b62cea011ccf6b0b9451b8f03ccbc2a9e65d46dc8506f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCgbN:TDpbgBr/4QAMQaTCvkA3Ynx
TLSH
T1E75623E57C5E6EBBD10E1C7E8D578D2275AC07B1CB904CD3EFD12EB70851D921A22A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
Size 6.3MB
SHA256 802e7e94b0b79d3f9ff1a00bdb47c46e001a852b44736ad83ba73161f142c999
MD5 187d576f7ea0885f9347dd932b9e5573
SHA1 b7e0f634101e3e38232131250786571698aca510
SHA512 4c435c8592f6d79ff70438a88aa6f9c6fbec273052f02d6afe5c91d1dbbf33252b36b4ee03553620a4655183d17fa5284deb8147803df99c31e0f259dc85df26
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCgbaA:TDpbgBr/4QAMQaTCvkA3Ynn
TLSH
T15D6623E57C5E6ABBD10E1C7E8D5BCD2235AC07B1C7904CD3EFD52EB60851C921A22E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
Size 5.9MB
SHA256 e3eeb9ba9b5889c22ac27d972c5a7a895549736940b4317e4b57f6260fde29f2
MD5 cd7ec9b911424cca4c8de0c8afaaea98
SHA1 f360a0e533882efc4a8d08b4fa5e702d711fed2d
SHA512 3b65317e88df3efcd46480376f8bb514bd6f083ec7c66ac4e457d51b736bb3046e2ab74a8ea8eedc4193dca601bb0c8626adc5fe5430768437ea4933a4667913
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwBCPaNqA3AGQLCD:+0s420bTjzGlBrJTJb8QAMQai4SGyvkG
TLSH
T11B5623E5785E6EBBD10E1C7E8D578D2275AC07B1CB904CD3EFD52EB60850D921A32A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\InputService.exe
Size 6.2MB
SHA256 310a6d06c4b9c7c7cf7f351b6f272446ac5c6d4274a201e385091afd6df521e9
MD5 f0140a1090a74845657b925a0b5fcbc7
SHA1 11d7a340e35c15bc170c27b181556446fb7e038e
SHA512 55cb9c69ac7331eb93dc9dbb05e52a0312b5a06c59004449db53475e20d22057aec557743d603fc5f5689f65c88f3dbfc5ed07c18f6dfa5f16bc8a1628929c95
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtLCgbaX:TDpbgBr/4QAMQaTCvkA3YnS
TLSH
T18D6623E57C9E6EBBD10E1C7E8D578D2271AC07B1C7905CD3EFD53EB60811C921A22A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemTrayHelper.exe
Size 6.0MB
SHA256 8395a214b18799f140ab6f6518e9cc0e5fc3607b711c5605155770ebc2ee1154
MD5 8a1d19804d051bcea04c785973d3c764
SHA1 d391911c8f516af8c88110f9fd9964cb0e700f9a
SHA512 52d4adbf98fda2141bf3db3282cc05b16fad0cd759a4a69276402fe146ad8e3bff849b25c0fd6a2ce23ff6ca03eae572568a6ca4708737eaf9b5b5b0a481ef07
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPp5Ci4SGwBCPaNqA3AGQLCg+Sk:+0s420bTjzGlBrJTJb8QAMQai4SGyvkW
TLSH
T1495623E5785E6EBBD10E1C7E8D578D6275AC07B1CB905CD3EFD13EB60810D921A22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download