b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
Size 9.8MB
Sample260910-ydqcnsed93
SHA256 b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5
MD5 18711387ba651892b6dc550230a8a53f
SHA1 a08c21bd310b0a2329665c79eea057cf7cd8fd49
SHA512 0682c47fa64bfa2772584849e36996eb6721dda552c440558a77dbd8925ba248807ceac9e800f0f15110b6e1e98ea5e137f853996ec0334d844504582e20314b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+Qy/:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrD
TLSH
T129A633D6785F66ABC20D1C798D16CD22396C5BB1CB548CA3FFD53EB20C10C936A22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SystemHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	ServiceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	DesktopWindowManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	UpdateService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	NetworkHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SystemTrayHelper.exe

Deletes itself 1 IoCs

pid	Process
4428	DesktopWindowManager.exe

Executes dropped EXE 14 IoCs

pid	Process
4428	DesktopWindowManager.exe
3944	DesktopWindowManager.exe
4252	UpdateService.exe
3792	UpdateService.exe
544	NetworkHelper.exe
3776	NetworkHelper.exe
3968	SystemTrayHelper.exe
4464	SystemTrayHelper.exe
2428	SystemHost.exe
5116	SystemHost.exe
2248	ServiceHost.exe
4128	ServiceHost.exe
1080	WindowsInternal.exe
1116	WindowsInternal.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\UpdateService.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\SystemTrayHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\ServiceHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SystemHost.exe\""	SystemTrayHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
101	raw.githubusercontent.com
107	raw.githubusercontent.com
111	raw.githubusercontent.com
123	raw.githubusercontent.com
72	raw.githubusercontent.com
73	raw.githubusercontent.com

Detect suspicious telegram bot 7 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x00070000000245d9-15.dat	suspicious_telegram_bot
behavioral1/files/0x00070000000245db-82.dat	suspicious_telegram_bot
behavioral1/files/0x000d00000001e734-114.dat	suspicious_telegram_bot
behavioral1/files/0x00090000000245d9-149.dat	suspicious_telegram_bot
behavioral1/files/0x0003000000000729-199.dat	suspicious_telegram_bot
behavioral1/files/0x00030000000006d3-245.dat	suspicious_telegram_bot
behavioral1/files/0x0011000000018131-284.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	DesktopWindowManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UpdateService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NetworkHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SystemTrayHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SystemHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3840	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
3840	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
3840	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
3840	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
3840	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
3840	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
3840	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
3840	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
4428	DesktopWindowManager.exe
4428	DesktopWindowManager.exe
4428	DesktopWindowManager.exe
4428	DesktopWindowManager.exe
4428	DesktopWindowManager.exe
4428	DesktopWindowManager.exe
4428	DesktopWindowManager.exe
4428	DesktopWindowManager.exe
4428	DesktopWindowManager.exe
4428	DesktopWindowManager.exe
4252	UpdateService.exe
4252	UpdateService.exe
4252	UpdateService.exe
4252	UpdateService.exe
3792	UpdateService.exe
3792	UpdateService.exe
3792	UpdateService.exe
3792	UpdateService.exe
3792	UpdateService.exe
3792	UpdateService.exe
3792	UpdateService.exe
3792	UpdateService.exe
3776	NetworkHelper.exe
3776	NetworkHelper.exe
3776	NetworkHelper.exe
3776	NetworkHelper.exe
544	NetworkHelper.exe
544	NetworkHelper.exe
544	NetworkHelper.exe
544	NetworkHelper.exe
544	NetworkHelper.exe
544	NetworkHelper.exe
544	NetworkHelper.exe
544	NetworkHelper.exe
3968	SystemTrayHelper.exe
3968	SystemTrayHelper.exe
3968	SystemTrayHelper.exe
3968	SystemTrayHelper.exe
4464	SystemTrayHelper.exe
4464	SystemTrayHelper.exe
4464	SystemTrayHelper.exe
4464	SystemTrayHelper.exe
4464	SystemTrayHelper.exe
4464	SystemTrayHelper.exe
4464	SystemTrayHelper.exe
4464	SystemTrayHelper.exe
2428	SystemHost.exe
2428	SystemHost.exe
2428	SystemHost.exe
2428	SystemHost.exe
2428	SystemHost.exe
2428	SystemHost.exe
2428	SystemHost.exe
2428	SystemHost.exe
2428	SystemHost.exe
2428	SystemHost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3944	3840	b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe	91
PID 4428 wrote to memory of 4252	4428	DesktopWindowManager.exe	93
PID 3792 wrote to memory of 3776	3792	UpdateService.exe	98
PID 544 wrote to memory of 3968	544	NetworkHelper.exe	99
PID 4464 wrote to memory of 2428	4464	SystemTrayHelper.exe	108
PID 5116 wrote to memory of 2248	5116	SystemHost.exe	111
PID 4128 wrote to memory of 1080	4128	ServiceHost.exe	114

C:\Users\Admin\AppData\Local\Temp\b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe
"C:\Users\Admin\AppData\Local\Temp\b3b104041ae4b316a5be746acaaa46513a2505c07154731b33f4224951d2e8a5.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  PID:3944

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3776

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:544
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3968

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2428

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2248

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1080

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 6ac45142693bd1c458512e3b8def1881e3fe3a81b85425044c0f460d67eac362
MD5 c10ea189c98d33ce0e871d19b27d2ee8
SHA1 b8e07c52568b0b8ac43d24df87ce133dedc95e96
SHA512 fa95426053eb82e9c3468f3bdf385197b306b22556ae80e4d255de3a1b6c7ded2b605a67dbac0f9295cd922e395aa2e0e0401d4057b15eaa1d26aec4d3524e3e
TLSH
T1B4E07D0E572CC3C3BD164C1026E5857A3AF270AF44D2150E643517C9CD42137C847049
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 407466a7bf7a775973c4c9f5277feec33d64debdc13b130e25446b9b5af3893d
MD5 415bc882f76a7b3e971dc0f091c9e07c
SHA1 37e4314fdbdd38a097d7371dbcd9f06f0becbbcf
SHA512 2ed928ae36c0e8cf7573c495786e80c6025f58a0972de548bc11eca029059e6c8bf7f7bf498e5cfbddaf40626fccbbd859d43a65e18b3a059b1ca0c59fa4a28e
TLSH
T16041A9DA2E187422AF814F805874CB353D7CF1D49988505974FA84E36495BA46D1A85D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 0e88a5f0db492c6d183a9c530238a34b60ddf8e643d59bb067a8bed73f3b04d7
MD5 ca45821f82f18cbccb347fd3d2edbdd0
SHA1 3c0bbcc22bc271a84cee8414221d42d021d221e3
SHA512 85a9f6c20f07e9bb0ba9aeaad0ed6dde142cc456dd82f56db61ea2b8b1f6ac821d6921fd59aef0530ac8cb3ac1ce2ba85a4108c3780fc861e81c4090bd7a1425
TLSH
T13ED0951715F6C9553B53DD044DD0D170B423AEB773D36C1AA48FD0D65800D2D3F0A215
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 177KB
SHA256 7d0f6df5f36e062a516cedcbfd4ef40616adcd767ec1d8b14ef85961122408d2
MD5 1a266210e74b768c7c5f1e87c3c04556
SHA1 947e95122d39b61d8fe7f803fd9c4114a1a41978
SHA512 bb11fb4b14ca0ced323712922f53d748347141fa1c80f76edd0417413b6deaa11bedd3e34722f29e10460e86a6db615830c8d5bfce0f088c3194ae9f805b0a97
SSDEEP 3072:MHlcm9KPx74X/pCh8ycyMGBeDvu6tizLF:u+AEx7I/fcrBeiqa5
TLSH
T105043C645C7BB6A35D4BCE524CAEF69612F591D92812732ABE347E005C13ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 d47f36305c57a449d1209353c65cf916990d10c10bbb8dce40387ad034ead9fe
MD5 da2321ede03f4a5aa95d46060ca64ab0
SHA1 426f6b6524e6e41e03b9d2897076c8d0a2fdfa43
SHA512 d30bc6ed1e2abf680fcd8a7902f8e931ba1b7c64f3d794e9ea55fdbad2282ee766386816ce8dd0cd5782526e61b61d5eb17817d8affbb31ba58a43724ef579dd
TLSH
T18B1125C35FB5E19045F65765C6E4D5313D78708638E938C15C939842245772C670943F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 05f55cd741ebf04fa6143cc1279f95b44c856f1efbd611312ea2cd1793a0b673
MD5 c2f9f75d444f05b448f600f9f498972f
SHA1 73efed1f442da35a14c31316406bbd1dbc14b9fe
SHA512 533226cb07ebc8d0f7ca310bd09c478deb65bc93d0dd6a1806c03d2a1bb475c31baffab1ca3a7980feb230b7d67a6905441efed6fb02e8d99439a878da91ddfc
TLSH
T15141E7EB6B1A3968BF469F866E79CD355C38D4B981800885B9A3C4DA10CE7C16E0698C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 8b713a8fb222393f533757e96c84592d6627f2788a78f4b7f5e6a30b48bc99ea
MD5 91a02e3aa725646ddfa5c15000d85df2
SHA1 0a3b1f662c8e043d33cc0225f31be789a7dfb5a6
SHA512 cb2ea59568ee21bb1c4c62a55cae94aeba9eae5489f81bbc86002724f95556b72fec809224b9df6da153531261ea7762909c915b43514e771857a71504dbec7e
TLSH
T14FC08C1C2AAA0A06F2A8437C82C139439B209542E2818F161BF12A08CA96B162878C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 49069db9f7a1cbb05fd15c804582342ea243cc41a875f79c05e2e823493905d4
MD5 355f62bcff90144a459a8f35d3916d85
SHA1 3a5e50780bd6f8a82accfb17f365b3d25a8c9a11
SHA512 2aaf2369c4a0d87d3676049e877d1d5cf09be6c6b4a701d529dbe999b335401748121b33afae2bba56de7de44171edfb4a3e567228548b2d4e310c0aa7857991
TLSH
T16AF05C2C1AFC805CE036DAB98ED5EAD65C16F227281445E90A914B099E02F441C5143C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 4bd226d2972a7de7b7272538dfcad9736b9e52bc4da0c00c2a998979ed6f6a60
MD5 e35fe2dd871b6ee48d553b4cf956e514
SHA1 ae470f0c0bfdcb883b054b974b6387fd52c26820
SHA512 da1f40449f7da3a089243cd22d3ff1e303c195498b1e48dea96781202c5fb56d0d7ff658dd681648b3da20ea3af2bb01d4f248c7d354de2a46f01b40d9fdd957
TLSH
T195F022203AFA903AF023AABA83C561B1096AE30674026AB61A7023042E24F206D82511
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 521bf8c50a3069a341e4da644606e847ce4bdede13e7dad5eb17f03a429d5301
MD5 fbcee13e7e6bf693d0d42f9c20432ed6
SHA1 bba9a0d6e7638085083c60480a99050355aab019
SHA512 961c7395e4d74056fa92c1935d27a63c0a0a866b1a8eb620f1e2f9b24664ffb9174064ab987b8790e9bac8754bc27adef84491097137338fc064fbfca37a2708
TLSH
T1C3F0550C14B8400EE0B2E8B8C2D526F6AC35F6086804C6E707E7114A5E07E203E22ABA
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 cc00dc67cad62e457ace68fd1b9b480c99acb976d05ee885d617aec507445d59
MD5 3ba99688a382fb7f6805a544af8ce489
SHA1 7eaea813fdaabf24aa2a065f83d3d964773b48e6
SHA512 d2fe4c9614d383c1cb9fcda1d047f0ebee1d3eab03d27145b95e364674f314c38d4c85e7123ac5a8bf69ef4373460836bdee4d55f58dd1915e0cd375609bcc2d
TLSH
T18ED0223C3759031DF0B0423946A246C2BFA21482B9C1932D0BB3230E442EC820DE1C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 19809d31ec346eaacd2d374993f84603475cc6a0be1269ad231b8bf4357ad2eb
MD5 ce3108c7f1782181555a47163089081c
SHA1 b1bd9bbc95e350b02120110c0acb63abb6895da3
SHA512 69b2efbbc1f6c62a4696e6c5c55f6430570e3b7b101935724b34b739b9c8603ade29a582df493cc394f2b7d7b01cee8243ecab9316fde4ee55ba1ae3d97fa83e
TLSH
T174F0AB281AEB405EE232A7B94AF553EBAC26F3523408C5651AE92309EF43F407E13434
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 afae6ab74020e33feb725cda74d4bbd3698b7ca05a4bf21bc516fe0508cce681
MD5 4c788fd78c1341acd5bc0dada3bbe1be
SHA1 e862cb1a4634dfbfde78f874be2fe507a1eb98dc
SHA512 dd47f9fd1c7ada3d3e2d2b1d27134550a84c6774e71b158771c1bce9c3b98e06055a0561b9baecf457bc3cf457804f981741d86dfe148e527059651473a63a04
TLSH
T103F02B3535F7115FF252DBB812E052D59A72F53735082AFC7BB046096D05F40BEA2925
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 81894633e4e86361312f5fcdde346a2c3df5a8962ed4267fc2510bcc62255214
MD5 f2a77f6e20b5dc139253abeffb99763a
SHA1 47d063a14d9bb50784378b73a79b31f0099e2a85
SHA512 5d82087f78721524c5e50f66d42a4470794dd68e1e6dd7700cd62c28fdb7af29e50fa7293b79687e88f73a9496c521f5804a290b0faf4c3af8df9b142fb75c9a
TLSH
T122C08C1C26610606F2A883B802C22A838A209211F3819F122AB22A08CE24F122874C2A
MD5 SHA1 SHA512 TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
Size 10.3MB
SHA256 a94235980d123c4ebb71672804a8e1758b512394f1f310328ae7a34577489245
MD5 979a749a6045f30508f87beed59f2b60
SHA1 e853e746903d53245339d6fede64f21a36a0cdd2
SHA512 69f6e331e7ca5c279d26068abfa338f56052fbea9775a065463e26b4f6cde3a97050f621dd6ea9f53f398307bf5f50b937afefe3f5cfefab5e860dd52b2f1994
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+Qyo:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrs
TLSH
T168B633E6785E66ABC20D1C798D16CD22396C5BB1C7544CA3FFD53EB20C10C936A22E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe
Size 10.1MB
SHA256 f1b6ee30af8f587eef6cf4e92d6604b526b5a7ef03accbaf40aab1dcd8a923d8
MD5 49005e3927a6e613cdf5298316023aa6
SHA1 81e0e39b12b8b19efa025e39ae03a8f196c97b9c
SHA512 278ce6ec7bdd6f9795132651c868d2354b01e6448acf4ac9565799e1132e54ce50d2c37a4e97ef375b4b53b5975b15f6079bdf007dd9c1575874211402951b38
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+Qye:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyra
TLSH
T1F5B633E6785F66ABC20D1C798D16CD223D6C5BB1C7548CA3EFD53EB20C10C936A22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemHost.exe
Size 10.4MB
SHA256 b545215f2270c3bbbf679e303521553edce52c1fd325760425cdbfd425ea5e5f
MD5 0026e41c657c6a428cc1a62ab9f4a813
SHA1 c30e3040d1810504ece5a4f46a0e4b875ecd68b0
SHA512 01e372aea78d442d8a517cb7750ac1b14780594bdf28f968e8b7e04f696506540d87e01e9172a3e66798835d609302cc251eab47edd9d1d62e2d4e6321f1ce7a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+Qyk:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrw
TLSH
T110B633E6785E66ABC20D1C798D16CD22396C5BB1C7544CA3FFD53EB20C10C936A22E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\ServiceHost.exe
Size 10.5MB
SHA256 c3d29d8357450363baa85abe87a30c024ac7de808e0592e99989c7132f32b450
MD5 940716a5a27b07f3f712e05606470521
SHA1 4182afdca97845e0fa16726e41e87d5eec82efbf
SHA512 235ebdd53ee22eb5fa2d09615b06ee6acd8d52bd00d196bd13d4180302cfed3c92d765cbc26b6113e2731dd03312418518ce0db35314d2e7ddbecbafaf694a6d
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+QyM:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrg
TLSH
T172B633E6785E66ABC20D1C798D16CD123A6C57B1CB544CA3FFD53EB20C10C936A22E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 10.0MB
SHA256 4b9054a10c21f464960d79fa03f664a61b5ee94be58c60bfac5afd063862032f
MD5 c7f2bdf22b2a5abed7dfc90d18330c1f
SHA1 7e31c4aca1bf8d044c8fd4a2377ba9d07bcbe4db
SHA512 48598bf36f2c58d6f97ab8f807e6208be68ef097b6fa2761879bb46dddcde1df2cc4cf3a73c789ad8aa03622e6f1abf3b86f7c4839b41115e059a6e4bb70315f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+Qy5:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrV
TLSH
T1F9B633E6785F66ABC20D1C798D16CD22396C5BB1CB544CA3FFD53EB20C10C936A22D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
Size 10.2MB
SHA256 04ee90c9a5d7c45c9e1d6a16a4e46d5ef41be4b968264c804194e38096128455
MD5 4e7de17da44ccd37831d675a4add6378
SHA1 82c5ec5865f8f2f6f81111977fbfee93aea7506b
SHA512 39abcdcf2b5dead4bf2f83ef71325421fd2b351379f37de30492f648ffc78856be77af3c1c87a5feffda7e301e1a04ed50fe82be88e87280711da376da29c505
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+QyQ:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyrM
TLSH
T143B633E6785E66ABC20D1C798D16CD22396C5BB1C7548CA3FFD53EB20C10C936A22D76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
Size 10.6MB
SHA256 14449cce5af4549b357cd9264f550feb336ea1a11408f3c1e151076046a57662
MD5 42f29591459f1993dcac68e458b87923
SHA1 4ae3dbf596433b53c741a2e44d4f4e39b582b455
SHA512 4d08bb16bc264c1ea739bc1520637aaac5dc92e626d8e707dafa13d9382d3306fa544948492e181a994cbea94cc063292001c2d262db2a56bdcdece04dbcc37c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IEhMy5NQ4M+Qy6:TDpbgBr/4QAMQMrEGRHsww7Q8RDhMyre
TLSH
T14FB633E6785E66BBC20D1C798D16CD123A6C57B1CB544CA3EFD53EB20C10C936A22E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download