40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
Size 9.1MB
Sample260910-v3clbstakc
SHA256 40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8
MD5 33853e415d5f32b17779deb100e3154f
SHA1 b6b942f9b339ea597a7cc0c634c55b11c6e0676a
SHA512 d8473dbf7351cb46f4bdd6b1901438c06bd099225355b93564f2064ac6e76c158b9b496aaabbf2554ac1cf8e1d4d8e07bf41f919ae45aaa875f0a3bb2c9e61e4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lz6Weh9ab1bpS:TDpbgBr/4QAMQMrEGRONY/4VLjlU8pM
TLSH
T10BA633EA785F6ABBC10E6C798D05CD6275BC1BB1C7648C96FFC63EF60840C521663922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1732	ServiceHost.exe

Executes dropped EXE 13 IoCs

pid	Process
1732	ServiceHost.exe
4948	ServiceHost.exe
2148	UpdateService.exe
3404	UpdateService.exe
4144	SystemTrayHelper.exe
4516	SystemTrayHelper.exe
1888	DesktopWindowManager.exe
3868	DesktopWindowManager.exe
4252	UserSession.exe
2316	UserSession.exe
3796	WindowsHost.exe
6140	WindowsHost.exe
1252	UserSession.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\UpdateService.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\SystemTrayHelper.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\UserSession.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsHost.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\DesktopWindowManager.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsHost.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\UserSession.exe\""	WindowsHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
25	raw.githubusercontent.com
31	raw.githubusercontent.com
3	raw.githubusercontent.com
39	raw.githubusercontent.com
52	raw.githubusercontent.com
60	raw.githubusercontent.com
72	raw.githubusercontent.com
88	raw.githubusercontent.com
12	raw.githubusercontent.com

Detect suspicious telegram bot 7 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c56f-28.dat	suspicious_telegram_bot
behavioral2/files/0x001100000001c545-74.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c571-107.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016ace-141.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016ad9-175.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016ace-209.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016ad9-244.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5716	40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
5716	40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
5716	40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
5716	40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
5716	40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
5716	40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
5716	40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
5716	40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
1732	ServiceHost.exe
1732	ServiceHost.exe
4948	ServiceHost.exe
4948	ServiceHost.exe
1732	ServiceHost.exe
1732	ServiceHost.exe
1732	ServiceHost.exe
1732	ServiceHost.exe
1732	ServiceHost.exe
1732	ServiceHost.exe
1732	ServiceHost.exe
1732	ServiceHost.exe
3404	UpdateService.exe
3404	UpdateService.exe
3404	UpdateService.exe
3404	UpdateService.exe
3404	UpdateService.exe
3404	UpdateService.exe
3404	UpdateService.exe
3404	UpdateService.exe
3404	UpdateService.exe
3404	UpdateService.exe
3404	UpdateService.exe
3404	UpdateService.exe
2148	UpdateService.exe
2148	UpdateService.exe
2148	UpdateService.exe
2148	UpdateService.exe
2148	UpdateService.exe
2148	UpdateService.exe
2148	UpdateService.exe
2148	UpdateService.exe
4144	SystemTrayHelper.exe
4144	SystemTrayHelper.exe
4516	SystemTrayHelper.exe
4516	SystemTrayHelper.exe
4516	SystemTrayHelper.exe
4516	SystemTrayHelper.exe
4144	SystemTrayHelper.exe
4144	SystemTrayHelper.exe
4144	SystemTrayHelper.exe
4144	SystemTrayHelper.exe
4144	SystemTrayHelper.exe
4144	SystemTrayHelper.exe
1888	DesktopWindowManager.exe
1888	DesktopWindowManager.exe
1888	DesktopWindowManager.exe
1888	DesktopWindowManager.exe
3868	DesktopWindowManager.exe
3868	DesktopWindowManager.exe
3868	DesktopWindowManager.exe
3868	DesktopWindowManager.exe
3868	DesktopWindowManager.exe
3868	DesktopWindowManager.exe
3868	DesktopWindowManager.exe
3868	DesktopWindowManager.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5716 wrote to memory of 4948	5716	40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe	91
PID 1732 wrote to memory of 3404	1732	ServiceHost.exe	94
PID 2148 wrote to memory of 4516	2148	UpdateService.exe	98
PID 4144 wrote to memory of 1888	4144	SystemTrayHelper.exe	99
PID 3868 wrote to memory of 4252	3868	DesktopWindowManager.exe	102
PID 2316 wrote to memory of 3796	2316	UserSession.exe	105
PID 6140 wrote to memory of 1252	6140	WindowsHost.exe	108

C:\Users\Admin\AppData\Local\Temp\40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe
"C:\Users\Admin\AppData\Local\Temp\40cee200e18e3bcd893bdd36599c8877a70208c970f0d13d42059c2b52581ab8.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4948

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3404

C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4516

C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1888

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4252

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3796

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 6ac45142693bd1c458512e3b8def1881e3fe3a81b85425044c0f460d67eac362
MD5 c10ea189c98d33ce0e871d19b27d2ee8
SHA1 b8e07c52568b0b8ac43d24df87ce133dedc95e96
SHA512 fa95426053eb82e9c3468f3bdf385197b306b22556ae80e4d255de3a1b6c7ded2b605a67dbac0f9295cd922e395aa2e0e0401d4057b15eaa1d26aec4d3524e3e
TLSH
T1B4E07D0E572CC3C3BD164C1026E5857A3AF270AF44D2150E643517C9CD42137C847049
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 407466a7bf7a775973c4c9f5277feec33d64debdc13b130e25446b9b5af3893d
MD5 415bc882f76a7b3e971dc0f091c9e07c
SHA1 37e4314fdbdd38a097d7371dbcd9f06f0becbbcf
SHA512 2ed928ae36c0e8cf7573c495786e80c6025f58a0972de548bc11eca029059e6c8bf7f7bf498e5cfbddaf40626fccbbd859d43a65e18b3a059b1ca0c59fa4a28e
TLSH
T16041A9DA2E187422AF814F805874CB353D7CF1D49988505974FA84E36495BA46D1A85D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 0e88a5f0db492c6d183a9c530238a34b60ddf8e643d59bb067a8bed73f3b04d7
MD5 ca45821f82f18cbccb347fd3d2edbdd0
SHA1 3c0bbcc22bc271a84cee8414221d42d021d221e3
SHA512 85a9f6c20f07e9bb0ba9aeaad0ed6dde142cc456dd82f56db61ea2b8b1f6ac821d6921fd59aef0530ac8cb3ac1ce2ba85a4108c3780fc861e81c4090bd7a1425
TLSH
T13ED0951715F6C9553B53DD044DD0D170B423AEB773D36C1AA48FD0D65800D2D3F0A215
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 177KB
SHA256 6ba279264dee83e77b29b9f11f02c78b1a29f1ff4b217f85a3ef0eb68e37830b
MD5 f8893fcdd6665b6653f65b64e18fe97f
SHA1 b69bf00a8cbc7cf6a3d3a1e87b9dec01c16a040b
SHA512 32c2b02d6167a6a2ccc266c6f63b4fc75d1e3339e4e5c5e134b55f3039a7f1dddf5f8d37e59bb8e2ef54d2ed13c5f3cac9c58f00701b25afe647e1116bbf3ea6
SSDEEP 3072:8Hlcm9KPx74X/pCh3ycyMGBeDvi6tizL1:++AEx7I/ycrBeGqap
TLSH
T10B043C645C7BB6A35D4BCE524CAEF69612F591D92812732ABE347E005C13ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 d47f36305c57a449d1209353c65cf916990d10c10bbb8dce40387ad034ead9fe
MD5 da2321ede03f4a5aa95d46060ca64ab0
SHA1 426f6b6524e6e41e03b9d2897076c8d0a2fdfa43
SHA512 d30bc6ed1e2abf680fcd8a7902f8e931ba1b7c64f3d794e9ea55fdbad2282ee766386816ce8dd0cd5782526e61b61d5eb17817d8affbb31ba58a43724ef579dd
TLSH
T18B1125C35FB5E19045F65765C6E4D5313D78708638E938C15C939842245772C670943F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 f38d96786bd6c666347abdee0f69f50848ed6702f7d9b73485da564b84aa9a0b
MD5 be6e0072d59511894c2a14958121b04a
SHA1 8727081701ad59a1b8fb4c7ed045354dac35f51d
SHA512 6e33c6591cbe2a5d5c6bfd5dc0b0cd86a3a5d78e6052654e460582454cce3b6107069aa4af04ff8a03f40482e489a122251f407aa7b93a5a22b018f93608728a
TLSH
T1AA41D8EB1A4D7568BE854F4A5DFCCA395E7CD0A881800E52B9FBC5E7209EB40690B49C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 73dd07beeb08e4a40dabc5ec7c5bb8e5fa6629886af7dca1961786ccf99f754e
MD5 faa9c8cc72940ef87d8616c419aa507c
SHA1 94543c2f38727542a17cbad52fdab2b12a1262b7
SHA512 7ca97bc81accfd02a25c9290620dc7292f5d538c4da71eb215a17c41c682df599dc4f1c36c12168fe254c4d31fff5abda7f48d78a876a703ec90d4eeb63a8c30
TLSH
T117C08C1C2AA20A06F2A8437CA2C1B9039F208101E6818F151AF22A0CCA97B162838C6E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 6e5ad7160e0575a5213dd1e090ac23325f652f3aba982ba68c4d58ea46f6893d
MD5 4318ef9d4f5104e30ef3725860f392bf
SHA1 5880c6ce428f82b5f022e0e88cf561450da641f2
SHA512 522d7cd2f8dc12fe572c19b1b81cf5f1ada8c64c5aaa053530812acd7a286dc1297da26b1d9528b1b1e6b78e55f2ba1f79d9bc54a1a51bd8c693c906648ea10f
TLSH
T170F0552C2AFCC12CE072DEB98EE6E6E65C1AF223280405E90A914B0EAA02F451C9043C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 9a5b97805695b282a41e765b43601eb46c24d70f6da0a08aa2203499fba95a70
MD5 2d3b67e0bb4e0852177be5b80da675a4
SHA1 27aed685b9b59ad5fd7e919a680002aa51809aac
SHA512 a106363910bf6d4b6d6a414be447040ffe7df393daa9e4913112f0b2e466d42b8ed088c70e638c08aba78bce6229981e4479c51589fc5550e05709500a25fa9f
TLSH
T1C8F068603AFB903BF033AABB43C571B1096AE30A74026BB61B7063042F24F206DC3515
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 72be41c24ef0661c6794f7a0718ae3e6fc6717d31289328765e7a68d6e394d73
MD5 0c032c3cab2b2ba0c9bcae508f498fd2
SHA1 3d2a7ee219de6f1a5c1f924bb4cbb268fe4648e5
SHA512 4d9e6b19390c6dedfc7446460cd13f9816a21beb70a22450d4c6ba575df044ad96ccd557b3408e5723c085e109df26209ba60fa2946077e2f8285492746ec7cc
TLSH
T110F0EC0C15B8401EE4B1E974D2D565F5AC35F109684586E707E7214A5A07F113E6297E
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 6263654b08cf5e835c56a4649805582814a24c444539e49deebc90f5b736f09d
MD5 a2070c22cd658977974cf3db564094e3
SHA1 2addd21cb5e2c7b6ef73793dc6b560fdcb31a2c6
SHA512 bd32443c96af4c0683c902b9289a794d8f27046b3b9c302acf7fac67488a6f33023ae1e159613bdadb1637412613db4d9f382126add76086f906ef8d145cd46e
TLSH
T163D022043BF1013AF2441B3A483005807A23F202B2A38FAC7FB3100C482EA220862C0F
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 8865c7e356f64b2bca470925e88847333fc5d165238719e012d48d0ebd72558f
MD5 c242ae812a11bc6dca35cb75aef12fc6
SHA1 3c4f67a95329d04dc40962fcc63c1b6f4a9bbc90
SHA512 63f5bd8957c4d0acb9955191fd0664abbdab831bfe174170b277bfe3dac0a9b7ae46ba9552d8a01807b4b3997abe326e4576d3135faa066331293817d17fbe63
TLSH
T125F0AB285BEA401EE23167794AF453ABAC2AF3463409C4692AE91309EF47F406E12534
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 07e9ff376e78297114223567cc18441ec735bf2fb90c7b327607fb522fbbe5c0
MD5 9873a8abe462eeb5dd9c74107c34740e
SHA1 fef61e5fbb64d8c9c2c916760fd41ccbfa865fa1
SHA512 2fe8fdba266c10ea7b4a83a140e3a9102e2a0490fd9cbe6a715e1fbc1d99dafb2a8a55680d8eed8284c218ba5af9b2aed4df93a4b3f65f28df578322a8921421
TLSH
T1D8F0AB3524FB402FF137EA7E02C111CA8432E13732487BA92662470D5E42A01ADF1D1D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 30c6683f583b455702182377a5eca0a2f3acc673dc9dd7d31772c506f7f67428
MD5 f3a7af927782229eab2b99f3a2ee4379
SHA1 99f1d4b6ee9d87d62cd7faf7cb479e2dac27d896
SHA512 49348fe8d1e3403f9a99d4501f8c0f46480dd29b19c9bc759be30858632c9a1316e88adece4f3663d9c341796abf505e29f39e986ebbb219f2655857100b17dd
TLSH
T1A3C08C1C17610606F2A883B912C229839A208110F3819F1526B22A18CE24F122834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\UpdateService.exe
Size 9.4MB
SHA256 23b556772bae93457abbe405ea610005ee580a261398b9e9bd3d2a767fb1b17d
MD5 b70bed701b20499eaa1578f1665c6d5e
SHA1 7c43329c82af28f7a1dca7ce35457c17c68a7d91
SHA512 6b5859ffe5d85a141944bcee8055d8ba08700edfa9f813a5f75465088d2dd0256be15aaea9582d6ca0d1f442beda7d22239960f859b8bb92c90be1171919e924
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lz6Weh9ab1bpl7F:TDpbgBr/4QAMQMrEGRONY/4VLjlU8pzp
TLSH
T1A8A633EA785F6A7BC10E6C7A8D058D6279BC1BB1C7648C97FFC53EF60840C521663922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
Size 9.5MB
SHA256 22aef00af2744ab168cfbe6191e07101453914a836e51ac6b3b69f24771d96ea
MD5 1dee9e4d65cea06c1cba1b29a1b3352d
SHA1 03746ce96cb1b284b13041896776f0ac84aed825
SHA512 9f4892a7c71941f453bf81004c2059f59af2500d7721fc9d281da9b91d2d0e3e0a5e29db909bae9e7e87a44ecb69714827263d5e15e9857b18ec3f6679d33d7c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lz6Weh9ab1bpl7k:TDpbgBr/4QAMQMrEGRONY/4VLjlU8pzY
TLSH
T1F7A633EA785F6ABBC10E1C798D058D6279BC1BB1C7648D96FFC63EF60840C521663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
Size 9.7MB
SHA256 68add6f82408072268dd292d3cecc8483ad0b47a5da4ed0ce0bfd625829d3e40
MD5 953db5e2cca00316aaeb714a9bf54286
SHA1 72beab9fbbb406f822c13bbd23829dc3b0926925
SHA512 f0214dbbaf15e0e946e087a4add16e6147df9dd6e3a27c63ddc8c5260b052edf6f87848da267adff33c15be96209a5473d0fdcf6c5f2dfe37d6fda9215e2fc17
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lz6Weh9ab1bpl7pyi:TDpbgBr/4QAMQMrEGRONY/4VLjlU8pzn
TLSH
T1F2A633EA785F6ABBC10E5C7A8D058D6275BC1BB1C7608D96FFC63EF60840C521663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
Size 9.9MB
SHA256 a3a4b6cd318a5c66ad3cff79fac1f66eae8f059b5fd14a80474fbaa4c64eaca7
MD5 2d6095980412df681fa242842e7e9fa9
SHA1 8e99ff9bd024cac1fb46baf079e4074b2e2e4358
SHA512 619b36309dee7dd594d890f720b203cddf26e565aa50309b8d0fe3e48f7e32804ee533d0ea76fe16ab847e82ac86ae9a9aa173035cb14d7d9b56d7858e4308b3
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lz6Weh9ab1bpl7py//:TDpbgBr/4QAMQMrEGRONY/4VLjlU8pz2
TLSH
T173A633AAB85F5ABBC10E1C798D058D6279BC1BB1C7649D97FFC23DF60840C522663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\DesktopWindowManager.exe
Size 9.6MB
SHA256 0413880dace82219c089d8aef708532689fb514d9d5ff9b80ee1b5946cf18847
MD5 799d8f3eca12916c59c81888f1eb6edd
SHA1 4f5d3b09484764ee97beeb9329d70533178c7858
SHA512 f4b98a55b43791c43131572702093470597eb28bd24288a4a4c3550dd5a05c86fd3189393b648698d7f4f189b0c7ebc4f25de251e0253c39710bda6afe05222b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lz6Weh9ab1bpl78:TDpbgBr/4QAMQMrEGRONY/4VLjlU8pz4
TLSH
T17AA633EA785F6ABBC10E1C7A8D058D6275BC1BB1C7648D96FFC63EF60840C521663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
Size 9.2MB
SHA256 45691df42e59fa378ef7c820ef9d6215b09886bb903fc409dcaec8dd077d0159
MD5 43eb5cedb95848fb604d19412673cc32
SHA1 bcc50ec2ad08eafc128ce5862ae3362eb71b6b48
SHA512 89ec66a8bae8633e55165a5c904f0bec42149af67cdaf5f69413316d461050a07913e170daeb4d56ec57243934f587215bb144975e2b5eba649ea65b1d8f34df
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lz6Weh9ab1bpln:TDpbgBr/4QAMQMrEGRONY/4VLjlU8pzn
TLSH
T180A633EA785F5ABBC10E6C798D058D6279BC1BB1C7648C96FFC63EF60840C521663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsHost.exe
Size 9.8MB
SHA256 d160098edb8a783bb8f5cae34057ff91b0aabe2fae2b86b578a7e9339e8f747e
MD5 f971f94ab3bfa90eb519d4a17943d332
SHA1 d6af59febf3f463da1f7685f8dbba816ef17812f
SHA512 3b26ed68e799ce2c1a7d4ac596d5c89a0c74e876e0d65129b2f50174a508053d2a5f40b5b3ecefa3291709fca2dffedbb3e849c26e8dbfa4fa534faee045f05f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lz6Weh9ab1bpl7pyU:TDpbgBr/4QAMQMrEGRONY/4VLjlU8pzD
TLSH
T1CFA633AAB85F5ABBC10E1C7A8D058D6275BC1BB1C7648D96FFC63EF60840C521663D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download