548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
Size 10.1MB
Sample260912-x2eemstala
SHA256 548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68
MD5 352d968f603d244aa5837f111bf2c40d
SHA1 0424bced115839dc37549497a96fdc35e81baab6
SHA512 81f6b917ce56f70fb2d583d6fe16f5bd97ecfd63ac3dd57811bf89d55354cb393de37acd2122e88373c9ce812bc8f5f74911ac025556c14a83aa6ea2d443bec8
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpF5pyw:TDpbgBr/4QAMQMrEGRONY/4VLM3qIb5J
TLSH
T13AB633EA746F5AABD20E1C798E068D2635BC1BB1CB644C97FFC63DB60840C531726922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	SystemTrayHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	WindowsHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	UserSession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	DesktopWindowManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	UpdateService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	WindowsHost.exe

Deletes itself 1 IoCs

pid	Process
748	UpdateService.exe

Executes dropped EXE 14 IoCs

pid	Process
748	UpdateService.exe
3272	UpdateService.exe
1692	WindowsHost.exe
1096	WindowsHost.exe
5456	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
5116	WindowsHost.exe
1868	WindowsHost.exe
736	UserSession.exe
5660	UserSession.exe
4788	DesktopWindowManager.exe
5372	DesktopWindowManager.exe
1396	SystemHost.exe
3260	SystemHost.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\UserSession.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\DesktopWindowManager.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SystemHost.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\UpdateService.exe\""	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsHost.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\SystemTrayHelper.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\WindowsHost.exe\""	SystemTrayHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
30	raw.githubusercontent.com
31	raw.githubusercontent.com
39	raw.githubusercontent.com
47	raw.githubusercontent.com
60	raw.githubusercontent.com
72	raw.githubusercontent.com
89	raw.githubusercontent.com
95	raw.githubusercontent.com

Detect suspicious telegram bot 7 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x000800000002464e-10.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024658-85.dat	suspicious_telegram_bot
behavioral1/files/0x0008000000024659-123.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024660-172.dat	suspicious_telegram_bot
behavioral1/files/0x0008000000024661-208.dat	suspicious_telegram_bot
behavioral1/files/0x0008000000024662-238.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024664-274.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UpdateService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SystemTrayHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UserSession.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	DesktopWindowManager.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4672	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
4672	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
4672	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
4672	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
4672	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
4672	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
4672	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
4672	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
748	UpdateService.exe
748	UpdateService.exe
3272	UpdateService.exe
3272	UpdateService.exe
748	UpdateService.exe
748	UpdateService.exe
748	UpdateService.exe
748	UpdateService.exe
748	UpdateService.exe
748	UpdateService.exe
748	UpdateService.exe
748	UpdateService.exe
1692	WindowsHost.exe
1692	WindowsHost.exe
1692	WindowsHost.exe
1692	WindowsHost.exe
1096	WindowsHost.exe
1096	WindowsHost.exe
1096	WindowsHost.exe
1096	WindowsHost.exe
1096	WindowsHost.exe
1096	WindowsHost.exe
1096	WindowsHost.exe
1096	WindowsHost.exe
2844	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
2844	SystemTrayHelper.exe
5456	SystemTrayHelper.exe
5456	SystemTrayHelper.exe
5456	SystemTrayHelper.exe
5456	SystemTrayHelper.exe
5456	SystemTrayHelper.exe
5456	SystemTrayHelper.exe
5456	SystemTrayHelper.exe
5456	SystemTrayHelper.exe
5116	WindowsHost.exe
5116	WindowsHost.exe
5116	WindowsHost.exe
5116	WindowsHost.exe
1868	WindowsHost.exe
1868	WindowsHost.exe
1868	WindowsHost.exe
1868	WindowsHost.exe
1868	WindowsHost.exe
1868	WindowsHost.exe
1868	WindowsHost.exe
1868	WindowsHost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 3272	4672	548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe	89
PID 748 wrote to memory of 1692	748	UpdateService.exe	92
PID 1096 wrote to memory of 2844	1096	WindowsHost.exe	99
PID 5456 wrote to memory of 5116	5456	SystemTrayHelper.exe	102
PID 1868 wrote to memory of 736	1868	WindowsHost.exe	107
PID 5660 wrote to memory of 5372	5660	UserSession.exe	114
PID 4788 wrote to memory of 1396	4788	DesktopWindowManager.exe	116

C:\Users\Admin\AppData\Local\Temp\548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe
"C:\Users\Admin\AppData\Local\Temp\548f9ffa6b5667dd0dccd3e7906aa6860bbdfbdfe423f675b78d5a7e13249e68.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3272

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe"
1⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1692

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2844

C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SystemTrayHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5116

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:736

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5660
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5372

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1396

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 c4f967c6bf8395e191bc1cae9ec7698305ec01848df166bff48881a24c41cb49
MD5 8f26e8cf3c85927d43f9b41bdd5a3898
SHA1 267d2db8943d268ca0f189616c64703306667dc4
SHA512 89957c7b2efa3c45650235a723fc20e860b60a23dfa845edd38263c71d331262f365e83b7aa3f6cdf76c40ebc3cea2ef18b0ffbf7e145389b65b4a5992d545c4
TLSH
T172E0E71A77ECD1D47123DA2047D940353C30356E3886454C740D93D74E41378D7072D8
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 76542d72e58371df0398c037592bbac4ae9a3407025ddc9b97efcab1a6aa1c86
MD5 9dfe1229f365f93c3721d6d33a4f2d42
SHA1 69c8a76d4c5183f0bea71a979f9cd66342263fb7
SHA512 aeaf745ea3ac48423ba43a39b44ec3795598290d76d268486326111b07acf1a6dc0b5aed023b7833ba62aca0035e0cd06037b68d900bafa4c604176912397494
TLSH
T11041B7DA2F2C3424BF858E459979CB352FBCB0D98544605762F6C0B2748AFC46C5A45C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 282B
SHA256 36408e52c9acbe4615b115121e4f1915f3764104d7c07f69863305c5a40f9d9d
MD5 888c6e57a832096daf55993a9aa0a1bb
SHA1 c85b5739d1bdb71185093a608ada73a66cf22b43
SHA512 7231500e5f8f8e7664a4409ce6e83ad902b7ecf5cb7c9f690b75a9b0e408d9a03e57927892af75616751e70cc07267c1db2005c2863ab0713ce4b0277683a785
TLSH
T1A6D02B07F5F48C613D32DD101AD6A5347113B53F11D4560DB818819D5E11A3C8A46258
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 175KB
SHA256 62a343611968dc9e706a1fba6be48b523a0c5e7d4940daf7ce544d70c04f69cd
MD5 dedf0dad1ca30e7813190fe6fe239da9
SHA1 02fefff807a4bc017f819699fb2e90658781bd1a
SHA512 0079e08d03f5c6c7b2fa3b332c690f0426d2429b459645fcd36e8db9545ae39d486d974fdd17e4eccea8d54b32fe1212a66a35c1e80abde96efa5e2df914d3af
SSDEEP 3072:wjX6/KPm744/fC7fbfy3IServK6titeap:wbkEm7B/82YSeOqmB
TLSH
T132043C646C7BB6A35D4BCE624C9DFA9616F561D92412732ABE347E005C03ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 979B
SHA256 2be89f86a7c292a38c9e84d47be96caf58192b985969b44578d7fc62715658d0
MD5 af9e39b50201061de6d0bfbea9d95b79
SHA1 1a5acc98b38b351fd6ac67864bb7c99f63868fc4
SHA512 0ec5a0ef1026a4bf25a3a701dc3a26fecf911297ae5773a62c26a7aa6721a8f58c84a1bfd8acb5e45e04c3cd402c48d021bd84b544d1dec6675c4dfac9efcba5
TLSH
T1DD11E183AFE4A0909AF366B1DAF8C6357D7864C66CEA74D12C81C896205A71D6B0903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 54a1217cecef8c3d3e0bd63200c1be6431dc56ade04a47a3b5b36fd5c618e398
MD5 094c972993bbc8bc3d6878e2049852cb
SHA1 24a52c099d2340bf40312389bca10426ddf8be10
SHA512 29bcbf73ad166c69ac11e5aabb5b8aa92efd1ffc4ca8c8cdef4498cf14253d59448aa7b0e120051c3ee3038cd4d4809e90b79904ebe941584573bc64359f6a39
TLSH
T15641FAEB1F8938E4FF028F4A59F8C5712D3891B492401E4275B389C215AD7845A4748C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 105808ba5ce12e01cfd8cf5b059daeb3eea6db632176039dcf121cd6139614ea
MD5 c0a23ba019e3e45aa7a3812558c878a8
SHA1 b5e3632acf789b4eecb2981b53a9a4d02fde29f1
SHA512 500bf12056049f143a349204de0ed2f97181b7b1d3317cf826f477f3e28f17696f737cda57635c35bf727dff8a325c1410dd4f7c3933784f57c79603a9cd050b
TLSH
T141C0801C19514505F594437D03C13D0357108101E2418F0516F12504C956F153974C69
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 420fe5fdb30f13ef8a236c2feaf394e0a8d746da074aaf8717cc9cd2c42f5b48
MD5 c759d658eca488b17fa1f128c5d9df88
SHA1 7c0ce07417596a17fc982a5845915c203c8985ab
SHA512 eea24ef4473898ca04a58230eb0ad988394d6564076d6d6cafe96c04520ac00a67127b53eb8416b101fb83d031e091b6403989ef34450e7f8f0d77a235701ce4
TLSH
T181F0E53C16BC846DF672DEB8CBD9A3E23D2AF213740C45E55FA107089A02F01AC92979
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 fa9bdea9fc3289cd078e9833a8404b3aa295f48cda7a0055966062a98bf086e1
MD5 f7823da98a34c8a4a3a4a157ae1748e0
SHA1 ff0cfcc8401a3ccffb4c78baea99354e1d90822d
SHA512 eb6efa356cc51ac3cd97301935b633db7b276f0fb7985fd59ad76e326df737f2003144cc9bfc366b71e5771e0e11a7f471155bf85d655048cec247a064fd1f60
TLSH
T118F068253DFB903BF173AB3643C936726929E327300E2B7A267023043E18EB06DD6115
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 534c80e61900b6808bc8ed0e0e94c2f219693ec2962b025df723358705a47747
MD5 8908c5b8026bf0a31142f19e8c9cbad9
SHA1 536e41e3c45418e93f151a0098d2d551b86aa128
SHA512 23b9add98081449c3a019d4e776288c9cc382e9ede01ccde6e5921770f61d82102527c0875e01e1b8af5285993339003b155ffceef6b2d52093087b6a1e306cc
TLSH
T165F0A310047C401CF073ECB9C1C565FBAE3BF11538055AB6099B12046712F001C5153F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 cfe6f132f97960747bd3f62b15e6fef0ab51ed4dcef99c298b67aeb0f7572241
MD5 1a27a8893ca9b9bdd1acaf4185caca27
SHA1 f48d311fc1b084f91d3af8636da7e7bfbccdeaa3
SHA512 9abede89a6c6145a8fd7ce6146571905153d1d1217f85a12605281f1ab4c494f5f96c97bedf7dd4ac70efab7af7ddc0c26e518a331566f276fbb9e39008f9d1c
TLSH
T177D022102FCA2334F025073F98718E261770B607A9828B5D0F38118C8C2BB2018B2C0D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 f15280c46b683fbfb839e07ad2ade3102c226e444c2b612a797f5f5b07f3048f
MD5 4936f18e6e7a50b630ca41f4ccb5ce3f
SHA1 21af3e761ef0f6156aaac3f5c25c7c6a52680ac0
SHA512 a6b66ca000b2bbba7830ca53753cc9d512de615db72e2aa0368176cb357213facfdb7d507a2db34730614022a702f725e9af3088cd32e280b44d77b278169352
TLSH
T12FF05C2016D2403DEA71677842E453DD7C0AF3573400D4753B92410AEE17D011D2283D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 4e39da7f320671465fe82340ca58090fd3b8f272848c0298305baaa8707b1c0c
MD5 c07b7b95312b5a13dbddc4c64036f963
SHA1 18baa8be9cf9e43a2121c803bd90e4f242144632
SHA512 1457c6d70b99812fc56fb30e1263a0d39f47949ea746f0554b7eada767c0fb4a8e82cf275519e5aa61c7a6f4335cde1e56d31598a37e9b7adaf423b6b4068ba2
TLSH
T133F0233D15AF052FF251D67943C556D74523E337311C365569B0534A6D45E01FA70621
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 618b934acfb6f758db707f1152a620164e16e32a92ebdca34afe3198d292f701
MD5 9712e2235076d2b1b785502dcff51505
SHA1 c14fbb86631c5031186e6bbe9c6725f2cf83d27d
SHA512 cdf4709cc3e9700bc89dfb17d5b39277f68b8caa94f23cd65d196ced4425c13298fcf3a450ab777f04734ef126537e50197fec39223b256ae04fa4f21d493e84
TLSH
T108C08C1C57A10A06F6A887B902C22A838A208211F3819F0227B12A48CD65F162874C29
MD5 SHA1 SHA512 TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe
Size 10.9MB
SHA256 5e5efc474aeb0f1d75178fe3f98e0c465c888e3fb17389a7fca64f5403621fde
MD5 dabf221b35fe2118ec6b8b65eaabdeff
SHA1 fa239cfc2b98d9b3fddaa9281043e4113257fe95
SHA512 8a7b4cff41d0cfce66d9b251dad7b9fbe46cce0eb0be899b2a2437c4b52359b239fc57a67f0f1fff8c183cb7d4e17b3a56a66d854db0d62bced13cf86c8abb59
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpF5pyYzG/e:TDpbgBr/4QAMQMrEGRONY/4VLM3qIb5P
TLSH
T1E9B633EB346F56ABD10E1C798E068D3635AC1BB1CB644C97FFCA7DB70850C621622D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
Size 10.3MB
SHA256 13fc05c0527b952a1f6c87a03efa496f9829c00bc837c0b7ae75ae86dcc6498a
MD5 739d6a6c89586e75694aa58a312f6e0f
SHA1 f0186cd22b160843d7f356f97739e01e1a5f501d
SHA512 46fa161f35de420996225395970e099f9e66c151776ed59c2bdd078ade96823a0c91d9d016e8e97407adad57287a7fa3d46c8d6f2e2f1722ca126485cdacfe34
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpF5pyYzGU:TDpbgBr/4QAMQMrEGRONY/4VLM3qIb51
TLSH
T111B633AA346F5AABD10E1C798E068D3635BD1BB1CB644C87FFCA7DB60850C531722D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
Size 10.4MB
SHA256 a13b3b4ad867c56600eab24d04cd2e12e1acd21275335596f2ba792719dbc0cd
MD5 1c02a511d9c43b9fbbc80a1ce63c1513
SHA1 dc9863d32f66096fec194ac552d0e480f38ce5ec
SHA512 d0d59f2963809fa3e16da9471290bac5bb08cc0593dd4aa79f5d444cf2862bdb045dc054952f1967000e2ccd42a24ed8870d1bbfbab8d7a5330d8de57a774998
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpF5pyYzGh:TDpbgBr/4QAMQMrEGRONY/4VLM3qIb5i
TLSH
T1CFB633EA746F5AABD10E1C798E068D3639AC1BB1CB644C87FFC63DB64850C531722D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UserSession.exe
Size 10.7MB
SHA256 1d51c4e6d8c08f2a2db3f0072d9b3dfdb6ad3e859b2d6f8889f412234264986b
MD5 0d20a6fc610d0c1c52e58fb480e2f3c9
SHA1 37917ae3e88cea5e86d5f11ef93d1c80b4efdb64
SHA512 6ce851576b45edd19661ffab017074c263d66f825bdadbf0c1152258b102f5eba6db03e4f98929340e4ad68d5d8de6073008915d4f984abf411690841657f669
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpF5pyYzGw:TDpbgBr/4QAMQMrEGRONY/4VLM3qIb5t
TLSH
T170B633AA346E56ABD10E1C798E068D3639AD1BB1CB644C97FFC63DB70850C631732D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\WindowsHost.exe
Size 10.5MB
SHA256 3d75566dd96ba32a983a0f5c547c59357a11b0c886c5224b81ae4de1a9d8a591
MD5 28625e5d85512133fdc39ba33d072856
SHA1 f93134bed197976be3e007b654a78c4dbe2d6371
SHA512 3fff305a7ff38cbeed2d7cd6c4cea82092b3e02c86c1f02c19de769eb5c66481cb3d1d15f1ca7d6b869c7d3d4b7a551c082602c6f7a6624f2da7f81b3b0f1776
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpF5pyYzG8:TDpbgBr/4QAMQMrEGRONY/4VLM3qIb5r
TLSH
T17AB633AA746F5AABD10E1C798E068D3639AC1BB1CB644C97FFC63DB70850C531722D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
Size 10.8MB
SHA256 46a31b703b771236518d56922e87ef4ecbaa0551498de0adcb7ced32da6429a5
MD5 3187c44fdc87a9f7bdda82c284dff21f
SHA1 baf5de793d056e43d4e65dc271d49d00846201fd
SHA512 609bf6b359df517d214408b4ba9a8f33859a484796264a947f3c8518212de1ea4f2b1a8c753a4638ebd39615ad5a814ccb90b9e3580c814de66f2d8d11bb13ef
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpF5pyYzGp:TDpbgBr/4QAMQMrEGRONY/4VLM3qIb5K
TLSH
T183B633AA746F56ABD10E1C798E068D3635AC1BB1CB644C97FFCA3DB70850C631722D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\UpdateService.exe
Size 10.2MB
SHA256 b9e419e73e2443a17e94802443fb4a3b1ea93e3797f552b3418000bea5fa4aea
MD5 ba3e7fdc4c927e69e1cc7a4f51ffd177
SHA1 82dbc58cb5d1c7356736166887ccd1f4155fa91c
SHA512 ca196cb2150955d344eb909765760bb00451cf3c1790f29f11c04438e9e18cb8c9c1a2b10ff19018e9f7d57075d6071a02927a45a66da73e7592aaaed601d085
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy485q/GVOzIpF5pyYzGs:TDpbgBr/4QAMQMrEGRONY/4VLM3qIb5x
TLSH
T190B633AA746F5AABD20E1C798E068D2635BD1BB1CB644C87FFC67DB60840C531727D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download