c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
Size 9.3MB
Sample261003-qa1p8sygnf
SHA256 c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d
MD5 0fa65149a90180fd0ff7018039470aaf
SHA1 2e83c07852e296abcd5cb747d4ebe8d9630a5aa5
SHA512 8ed0619a4a349f4a39f43db9bb8c91084c9dc19264eeb6323985c46187a5a6a77da45dbbbffed59cc1ef9b39e30b2e11e883968da61baf66822e2f72a9d2e480
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWi3g8PS:TDpbgBr/4QAMQMrEGRHsww7Q8RuWLH
TLSH
T1B9A633D67C5E66BBC10E1C798D068D523A6C5BB2C7549CE3FFD53EB60810C931B22A62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3540	SystemHost.exe

Executes dropped EXE 9 IoCs

pid	Process
3540	SystemHost.exe
236	SystemHost.exe
4688	NetworkHelper.exe
2012	NetworkHelper.exe
4544	SystemHost.exe
5128	SystemHost.exe
3512	SecurityCore.exe
2752	SecurityCore.exe
2160	NetworkHelper.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SystemHost.exe\""	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\NetworkHelper.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SystemHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SecurityCore.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\NetworkHelper.exe\""	SecurityCore.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
21	raw.githubusercontent.com
33	raw.githubusercontent.com
43	raw.githubusercontent.com
49	raw.githubusercontent.com
60	raw.githubusercontent.com
1	raw.githubusercontent.com

Detect suspicious telegram bot 5 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c505-29.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c507-48.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c50a-113.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c50c-147.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c50a-182.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHost.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4704	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
4704	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
4704	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
4704	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
4704	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
4704	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
4704	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
4704	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
3540	SystemHost.exe
3540	SystemHost.exe
3540	SystemHost.exe
3540	SystemHost.exe
3540	SystemHost.exe
3540	SystemHost.exe
3540	SystemHost.exe
3540	SystemHost.exe
3540	SystemHost.exe
3540	SystemHost.exe
2012	NetworkHelper.exe
2012	NetworkHelper.exe
4688	NetworkHelper.exe
4688	NetworkHelper.exe
2012	NetworkHelper.exe
2012	NetworkHelper.exe
4688	NetworkHelper.exe
4688	NetworkHelper.exe
4688	NetworkHelper.exe
4688	NetworkHelper.exe
4688	NetworkHelper.exe
4688	NetworkHelper.exe
4544	SystemHost.exe
4544	SystemHost.exe
5128	SystemHost.exe
5128	SystemHost.exe
5128	SystemHost.exe
5128	SystemHost.exe
5128	SystemHost.exe
5128	SystemHost.exe
5128	SystemHost.exe
5128	SystemHost.exe
3512	SecurityCore.exe
3512	SecurityCore.exe
3512	SecurityCore.exe
3512	SecurityCore.exe
2752	SecurityCore.exe
2752	SecurityCore.exe
2752	SecurityCore.exe
2752	SecurityCore.exe
2752	SecurityCore.exe
2752	SecurityCore.exe
2752	SecurityCore.exe
2752	SecurityCore.exe
2160	NetworkHelper.exe
2160	NetworkHelper.exe
2160	NetworkHelper.exe
2160	NetworkHelper.exe
2160	NetworkHelper.exe
2160	NetworkHelper.exe
2160	NetworkHelper.exe
2160	NetworkHelper.exe
2160	NetworkHelper.exe
2160	NetworkHelper.exe
2160	NetworkHelper.exe
2160	NetworkHelper.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 236	4704	c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe	91
PID 3540 wrote to memory of 2012	3540	SystemHost.exe	94
PID 4688 wrote to memory of 4544	4688	NetworkHelper.exe	96
PID 5128 wrote to memory of 3512	5128	SystemHost.exe	99
PID 2752 wrote to memory of 2160	2752	SecurityCore.exe	102

C:\Users\Admin\AppData\Local\Temp\c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe
"C:\Users\Admin\AppData\Local\Temp\c4f2c9ae28bd29e9acbdb65ab97dc9d784c0a43c734b088f2cd5b6119c540f2d.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:236

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemHost.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2012

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4544

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3512

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
MD5 eb444c59d03b1567ebbb5e58480a6eef
SHA1 e638b0d4f8bc77cb263d4e561ca3cfd1e286432b
SHA512 43cc6537c3b42c6a520ad798c7d57f02e3a6770d08ee501ac16a6db81365e6c09ba75a15d2b614b2b19ab3d667c9753a671c6e77a54797011705393da73686f8
TLSH
T1D9E0721A362DC0DABF6A49394A6250BF78A1008F00CD855A342C87F84C8262F9F0BA08
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 749860344f94a12e314cdb27fc86b31285596137f12714a6443e366934020d67
MD5 4579cccb20eb53d3f8634118c8b6d128
SHA1 15cb3605bea7c55aa1d417108cccc1313b690090
SHA512 202a34939f16e742a9ed1159f684cb0fd0e2572c158de7fc5600aff8059b8cc8476764f61ad56f55292876199ae82a6863861e141ff788b83c6b10e2c708258c
TLSH
T1DC41A3DE5E2C7464FE818E451938CB322E7CF9C5E480556E70F788B270D6F942D4A88C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
MD5 32d66548cf2a8f1b6b0ab9d6c335806c
SHA1 69e42d1c9f5e7760749da4331591e196bba4b81d
SHA512 f8d7ae900b29dbddb66293c320367f3b4dc41ecd372baed0f690bd657d8d92c77f8dd5cb3a10b7d93e1b1d7ed2a90c12d3461dde8845e2c7eeef1ff2c3237842
TLSH
T1A3D02B1D15F56D137E27991487E8E56174651A2713D0485C14498677A8015E9194F704
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 bf28e561c3da89c18fb58785913a85af1caaf1cb0ce2dec299d5f3c9dd4d7ac8
MD5 66d0289acffee96041e8390c8e47a1df
SHA1 090fae2436fb6cad9b18851814995e47cfd8cac8
SHA512 e40ffd0945fab8c38cdd7810716298ae1f0d8c8cdae0bf0e25f7bb1fe710c2a222d6a4bb6d1d1544a03835bf6ec87ba7e080c739338c0538ddcfafbdbb734818
SSDEEP 3072:3tZr/ECXHwcAvW91AQlHQti4XbqM0eCb6SduAd:3tF/DkvE1ASo5rqM0PDR
TLSH
T18A044B542DBBB5A35E4ACE620C99BA9603F561DE2112771BBE306E505D03ABFCF17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 8c7602efe22cb85666dfca8b597ad0f33617fdd861c8bf7e951c305dfe59b3dc
MD5 de10d5794ceacb41f46aacbc68d07747
SHA1 167aa5e4fd0a87215579791b0bcfa181d7848ada
SHA512 6d7a173bbe00ac650b201daa93ebc17e0d4f345d5d321643ec500a76356f2e300ca626f3a414321e9c09eaf98258e5ef52c5f87cbb2b8a6d52d7636bce097323
TLSH
T1131121865FF4A1909AE356A0CAF8E1367CB424C66DEA34822CC688E2245776D7F0443E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 96a38b6eba68f440c891318a05812c586c9b39a22d6ee7fb9045a70bde3c11de
MD5 5388d3e50217159f7a26efd57a0a98b7
SHA1 43a097cd0628c4be1f36402aa856e960865f45db
SHA512 74db4be8b6b6324685e7ec161b5e8b7847cf89c454cd15c8772ba676dd87fc871175ba32e330a173c7562923dbfa1eae4187b9e788b31df4cc8c209e4285d975
TLSH
T10441FADB2B5E78A8FE41CFD92CB5C63B1E3861A752800D52B5F7C8D114CE795590A8CC
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 8b408b3ad7781ba56d1c54732d53c76540e6d9c2971d803a79573a253e79a54a
MD5 02cb330d5e384fb8b21b22b7b7401099
SHA1 f6ce263aea39cb0c3b165301a87a01e7049e6427
SHA512 ee79d220cdf92fefb5d5148855ed4be9943413c39e17115fe8730d4cd2b0020d580cba4e63869df5e9fb703b53d5bf6480875bc6ca79d0b3c8c80e8f9c5e570a
TLSH
T170C08C1C1EA21A0AF2A8437C42C17913AB608101E2418F091AF62A08D996B162878C7A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 93c1e1337723e9fe1dd69fcfb88f881469d9907e5468a6789dd4126122ae5815
MD5 1b931c3268b843cad281b974cd442d95
SHA1 2d355f8196c2490f160647343263ee7f5c0457f7
SHA512 b2865f253cbd65d1d79b4b01fb31de940ac0840546525b58e521797f7befb94fa72e4769b7b4b63f5c90c1fb61da593d5c9759b29c11dc074aef0b910ba76fbc
TLSH
T14CF05C3C13F8804DE071EA758ED5A2D56D15F123380889ED5EA147089A06F015C9153D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 e514ac4e75fa475b50c9312ba7a0bc586477fcdfb0271a4ed4de718f3c2c13d5
MD5 fb44cc9950439e35a0496e9fec6c26c5
SHA1 758579fa3bc262f2b9cd861932bf487abeaae136
SHA512 fe1c25f9c4a02243f161f6fab4101c0a0e7f55715bde92705c4b9f58356abbb9a5fbe5959812fbb1a9e9830b97d2f651bf382b7fef97d62829ef68922ddc507a
TLSH
T1C4F068583DFF823EF4379E344BC670B28D2DE22B2003AAB4257203086B10EA0AC1571D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 74303f948ec0217da070cc79586047ce3615d4c9e7b1b3aa66e25a9122b89b13
MD5 6f391e53d420fea1576c038aa9c6ed6e
SHA1 49dc591a803c468c80b995a5fd51c2d8e8a58903
SHA512 55108724883b5893bfe7363a4091c24f9dbe182c11d728a1f8d78b598c99bebedce127cf981320ba5337d77dfda4d3277015a5070e8e3838ec8caeb5cd650059
TLSH
T115F0AB002CBC402EF8B3E9B4C2D225B6F935F115780487F60B9B0341AF52A024E9216F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 d264ebfc1f5fd2d3b4b1ce628240915c0be8387e20dd99eccad5860ecfeae1c6
MD5 e650d17afeabd3e1489d81c7be62b026
SHA1 5867a49e14c9d3135196b32f8ef537377811d2ec
SHA512 a435bd9dc6d07c3a4ad60d895eab36e2f1a7c93d3bb737cd75b34bf611a7f3bd8ca9592c9bbdfc828de09ba37336fff7b2f333b3ebc76d51a4617f9de382b365
TLSH
T1A9D0A9186FA00236F0A986388DB0062AEB203940A0A2020E1BA2222E092CE121862C08
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 3eea2f3db923e73c54825f9cf2e2b1a87fed32f77f7014ad432671910928d350
MD5 6468ccb2a48a206f77a0ce13d0b54321
SHA1 53525b2478df8f7b521b7e5c41a171370c9fa9bc
SHA512 c1e0fbd7387cde510d631576d9410436a1217455b638b459c6c190a1729524b78ee4a49ffe572d460835078449ef2de73a5b0261b156cba4c2689ba9e83875dc
TLSH
T1AEF05C342ED2015EF673263D49E85395D904B6153805C55915A20A49EA67FC11D6283C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 6a9a63178e9b4fa77e86d455372f3f00fc76f9e0c7792afb3f0e6477d954b2dc
MD5 d94461535663b2ce3ad2088ad86f0312
SHA1 5a7f2ed09ad6ad2a0b7530cc5241ef98a6a75c91
SHA512 fe1219e6e761b3dd1f541112f52e1339f86fc75ce0f5e91f0ba84f980925d43f3e3f589db747f2109f69ba81f69bc739fbed7a3dc784c84ba49d8967b2a2594e
TLSH
T1E7F0AB3E39E7121FF122C6B842C006E66562F133320422A9B7B2030A1E46A55E860A26
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 7b2831cb5ee945de9a569304f8ecf85fe0529ee35ec103d0ec433dcf8df2442f
MD5 051cf9a945a08720efde193837dd9d52
SHA1 24e23dcdd6f7d294df71a254bdfdb73fc640136d
SHA512 19c72984c21c0412aa443792acdfc7141b8cff7f23f97b09237bf6449c49e9a373b0ea76acba2c3bec263c28ec1f4ff807f4574baf32461ffe6d887c9ff74d17
TLSH
T1C6C08C1C0A610A06F2A883B802C2A9838E608110F382AF0627B22A08CD34F122C38C69
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
Size 9.8MB
SHA256 3e72aad39587f73ddf88e4e00a53d69ea0f598f8d5f9201933d49b4d77cff5dd
MD5 449b74c5552c4bf7f732840fb482e5fa
SHA1 c57d2ddcdd4998840d88c8f6a87cdbc0459f9e6a
SHA512 ff574c65d246743c40eed48673be678a8b275046bac7c2c5c0927ca10b008abde656130a803ab93e8ef338c5ed900087533fc1e2eac7fc1ba15d34e81ce16a5c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWi3g8PcKJ:TDpbgBr/4QAMQMrEGRHsww7Q8RuWLXu
TLSH
T1E2A633DA785E65BBC10E1C78CD068D523A6C5BB2C7549CE3FFD53EB60810C931B22A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemHost.exe
Size 9.5MB
SHA256 39f8e854faaaa9935629991c1e961aca1f08b0f205ef28fe28116e44a2811cb5
MD5 93f3e0c582ec8345f252f8055dde6ec2
SHA1 f90806acfe7898e335e507cf7c8e55318648b430
SHA512 22cea6817ee81a47eb953ee46ad02ebd1507559e44d306ac87fd156fb226565c807d8b98cefbd53c1c9f4c0128e440307d08452e82e00c61dc70bf743abd82d0
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWi3g8Pcx:TDpbgBr/4QAMQMrEGRHsww7Q8RuWLXx
TLSH
T1FAA633D67C5E6ABBC10E1C798D06CD52396C5BB2C7549CE3EFD53EB60810C931B22A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe
Size 9.6MB
SHA256 ba4432ca96dac6eec2b16c82f5c851e82aa225e0a53a23a5375107834cc508cf
MD5 1ae268fa65043a6c47e3522028d7c93c
SHA1 a2c4d8a81adc76e78e1ccf2ad4544090aa86890f
SHA512 dadbcb4054cb642bdb2c35d1952b4d7023f7b24ae41f875cb5eaa0a22cdbf5c27edda35064581137e88aca66c719e4f1d520a96b23c06d57ea399460149691e1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWi3g8Pcf:TDpbgBr/4QAMQMrEGRHsww7Q8RuWLXf
TLSH
T146A633D6785E65BBC10E1C798D06CD123A6C5BB2C7549CE3FFD53EB60810C932B22A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe
Size 9.9MB
SHA256 f67f2697304854993d2256b2fae6154492be4ef3c56f8989914428e3fbe4d8ee
MD5 170dcb57e4e8b7ae517b7fab9cd86a16
SHA1 9cbbd7964c4a25144d3cd7c87bdc5fc0d0b8fbb3
SHA512 b4c0b2c02c093e351f71e752a3fedf1feab3088cdc298dff64616acf0a8290ea0d75e26b44b064e5ba6f4e9e687b66fd4d5d853b25a51146d321ad42dd8cc913
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWi3g8PcKj:TDpbgBr/4QAMQMrEGRHsww7Q8RuWLX6
TLSH
T103A633D6785E65BBC20E1C79CD068D523A6C5BB2C7549CE3FFC53EB60810C931B22A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
Size 9.7MB
SHA256 42ec71fe293367a8ae3403deea1e2ef5271bad7ae45b4fcca7afd8e524ce03d2
MD5 c1b9f5f85368be6c9a59f77597b9c658
SHA1 48ff2fd956b2e9e83e2fce0672107472daa200c7
SHA512 a9a553fda823ce3b397faee25037564a8c88936065b54d2e08e84dca3f27f00c348263d5c9a59692c128dc70a8665a4a145656203ea2ac052aad89e11066ad54
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IBWi3g8PcM:TDpbgBr/4QAMQMrEGRHsww7Q8RuWLXM
TLSH
T141A633D67C5E65BBC10E1C798D068D123A6C5BB2C7549CE3FFD53EB60810C932B22A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download