4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
Size 10.5MB
Sample261003-trzfaascqc
SHA256 4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9
MD5 023642d3b7a246636fd2c871e32116b5
SHA1 83cf996c48e07bf8e297a3afbe981df5d88d3fd4
SHA512 c975f2d8a13a5fe9878e68bda855309b515b4ec6674d374968bffff5bf6dd76fcc750b5f36088f6b5f2bc82dcd7e4f9cff3a1ba2c1597889879e5ed582582d7f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoK4nz3aSE:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSMm
TLSH
T112B633EA785E66ABD10D1C39CE068E6635BC1BF19B644CC7EFC63DB24850C531A23D26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4384	WindowsHost.exe

Executes dropped EXE 7 IoCs

pid	Process
108	WindowsHost.exe
4384	WindowsHost.exe
5592	SystemTrayHelper.exe
5392	SystemTrayHelper.exe
2960	InputService.exe
700	InputService.exe
2832	SystemTrayHelper.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SystemTrayHelper.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsHost.exe\""	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SystemTrayHelper.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\InputService.exe\""	SystemTrayHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
56	raw.githubusercontent.com
65	raw.githubusercontent.com
43	raw.githubusercontent.com
53	raw.githubusercontent.com
1	raw.githubusercontent.com
13	raw.githubusercontent.com
25	raw.githubusercontent.com
29	raw.githubusercontent.com
40	raw.githubusercontent.com

Detect suspicious telegram bot 4 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c4cf-27.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4d0-104.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4d7-140.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c4d0-174.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	InputService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3564	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
3564	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
3564	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
3564	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
3564	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
3564	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
3564	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
3564	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
4384	WindowsHost.exe
4384	WindowsHost.exe
4384	WindowsHost.exe
4384	WindowsHost.exe
108	WindowsHost.exe
108	WindowsHost.exe
108	WindowsHost.exe
108	WindowsHost.exe
108	WindowsHost.exe
108	WindowsHost.exe
108	WindowsHost.exe
108	WindowsHost.exe
5392	SystemTrayHelper.exe
5392	SystemTrayHelper.exe
5392	SystemTrayHelper.exe
5392	SystemTrayHelper.exe
5592	SystemTrayHelper.exe
5592	SystemTrayHelper.exe
5592	SystemTrayHelper.exe
5592	SystemTrayHelper.exe
5592	SystemTrayHelper.exe
5592	SystemTrayHelper.exe
5592	SystemTrayHelper.exe
5592	SystemTrayHelper.exe
2960	InputService.exe
2960	InputService.exe
2960	InputService.exe
2960	InputService.exe
700	InputService.exe
700	InputService.exe
700	InputService.exe
700	InputService.exe
700	InputService.exe
700	InputService.exe
700	InputService.exe
700	InputService.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe
2832	SystemTrayHelper.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4384	3564	4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe	91
PID 108 wrote to memory of 5392	108	WindowsHost.exe	94
PID 5592 wrote to memory of 2960	5592	SystemTrayHelper.exe	96
PID 700 wrote to memory of 2832	700	InputService.exe	99

C:\Users\Admin\AppData\Local\Temp\4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe
"C:\Users\Admin\AppData\Local\Temp\4fa807b086b286973a3d670268aba84dd040edc515a3d2ff1ddafb51135ad6c9.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4384

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:108
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5392

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2960

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:700
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
MD5 eb444c59d03b1567ebbb5e58480a6eef
SHA1 e638b0d4f8bc77cb263d4e561ca3cfd1e286432b
SHA512 43cc6537c3b42c6a520ad798c7d57f02e3a6770d08ee501ac16a6db81365e6c09ba75a15d2b614b2b19ab3d667c9753a671c6e77a54797011705393da73686f8
TLSH
T1D9E0721A362DC0DABF6A49394A6250BF78A1008F00CD855A342C87F84C8262F9F0BA08
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 541828396e95f1244c8fd8c461d08e6914672db6a9d836a3ab2c432f8f2b0352
MD5 d9b0127230b61148eb3d2434c49763db
SHA1 f322be8d26997620bc8ab1e607893384de46892a
SHA512 e9d9495a47ce659fe6062d25dc25a767c5b0947151a91721454dff1bd9bdaf0dba80d66134805b7adb97b091dff30d85babd37c2aac4de3997d715b830e0d785
TLSH
T1E541D8DA6F39B454FF8ACE411478C6322DB9F191D68D506132FD89E77486BD42D0885C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
MD5 32d66548cf2a8f1b6b0ab9d6c335806c
SHA1 69e42d1c9f5e7760749da4331591e196bba4b81d
SHA512 f8d7ae900b29dbddb66293c320367f3b4dc41ecd372baed0f690bd657d8d92c77f8dd5cb3a10b7d93e1b1d7ed2a90c12d3461dde8845e2c7eeef1ff2c3237842
TLSH
T1A3D02B1D15F56D137E27991487E8E56174651A2713D0485C14498677A8015E9194F704
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 ac98a885ce53aab18119c364bce08a1d4d9d38bf503cde57a9c5d155f0a87439
MD5 c852523d3e11fdb78f7e9c7abb384d85
SHA1 00981c28d9fb9b399a2ebe0bdcb34f207544383e
SHA512 6a7fd2de491ffbbc40c706a3354260408ca67055a7c4731c2f948eebccd7485c3ba4341d3e75505b569d3c1b78295d5005d67648fec960784b4f385868de4e4c
SSDEEP 3072:COtZR/ECXHwcAvW9wAQlHQti4XbqMSeCK6SduAiQ:ptf/DkvEwASo5rqMSPAWQ
TLSH
T1B4044B542DBBB5A35E4ACE620C99BA9603F561DE2112771BBE306E505D03ABFCF17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 8c7602efe22cb85666dfca8b597ad0f33617fdd861c8bf7e951c305dfe59b3dc
MD5 de10d5794ceacb41f46aacbc68d07747
SHA1 167aa5e4fd0a87215579791b0bcfa181d7848ada
SHA512 6d7a173bbe00ac650b201daa93ebc17e0d4f345d5d321643ec500a76356f2e300ca626f3a414321e9c09eaf98258e5ef52c5f87cbb2b8a6d52d7636bce097323
TLSH
T1131121865FF4A1909AE356A0CAF8E1367CB424C66DEA34822CC688E2245776D7F0443E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 96a38b6eba68f440c891318a05812c586c9b39a22d6ee7fb9045a70bde3c11de
MD5 5388d3e50217159f7a26efd57a0a98b7
SHA1 43a097cd0628c4be1f36402aa856e960865f45db
SHA512 74db4be8b6b6324685e7ec161b5e8b7847cf89c454cd15c8772ba676dd87fc871175ba32e330a173c7562923dbfa1eae4187b9e788b31df4cc8c209e4285d975
TLSH
T10441FADB2B5E78A8FE41CFD92CB5C63B1E3861A752800D52B5F7C8D114CE795590A8CC
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 5195e63a73a7308693fc26f414521f005584ba37bf59675461421e039a089364
MD5 5556b9cb9e892bee729ff9655b851678
SHA1 d764a7db511c529184005dee9023ceead19e1c16
SHA512 4da7f8bf4177097e967709b2f00eb565210432adfb32033fa26a15c6a2d6863569ab17d9bb0a0b07304deace9091c94217040a8985a3fcdb41b6875037707481
TLSH
T17CC08C1C1EA20A06F2A8437C82D139039B208241F2418F492AF12A08D996B1A2838C6E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 23a12a4d61a8bf3ab966614db24e17d24c87a228d8e441baf80cb71f95c7b1f5
MD5 f524731e5e0bd0115670b25608b925d7
SHA1 2c4740bbd4e0a3dd93adbe50f1ba405ec1f9fee0
SHA512 db2a9c3035be4b4eb785dcca69483291a9e60354dc9a0346bb13127e63543fb23d5bbc0479306f3f0525f9497774d0937a67753946a626d508b9b248234ed7c0
TLSH
T1FFF05C3C12FC804DE075DA758ED5A2D56C15F623380889ED4EE04648E902F005CA153D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 515801cfe4660bde3fcd9fc8d5ad831416c2152b2e5bf203dc3897f77e46fb28
MD5 bb2270317ff7ff3836b1ed09fc42cc89
SHA1 69997a366ffe56929056ae23375d6b6a92476394
SHA512 2c78c659a1878f73e60fcd17c2e04c4bb1e5e3e3090e018e4148489991e45caa2d589c035a26f601f5015e272dad44da861afdba77fcbd502ed6d76aa12bea2d
TLSH
T1EFF02B243DFF427FF026D53893CA7272153AB21A340515781AB02308AA17E10E810502
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 0494d03eeec4c58d4da12be1cce8b5a3794ddcffb053f7c016bd752b4f285a99
MD5 e0d5a7297accecfbf2d1b9befda1ad18
SHA1 ae9782ae59d30dc77ece11e91137371fd9016b0a
SHA512 c29c56bf47ab8b37de7e3cbb2266d404f6dfee7d2df526f28e41b32ec0bf613f341fba6114974e8ca05c59caef2c7aced3eca5ae91f964b3953b9aecce1900a3
TLSH
T1B3F0AB0029BD002EF4B3EDB4C6E125B6F935F215780483F60B9A12416B62A010EA216F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 05bdc81a1a8e81d974f72b01298012db01c0445ec1938d4679ead0fb72785386
MD5 b9787a545bf286cd24d7e0f6db9d72e2
SHA1 a538dde4478d11cf0db093a2cbfa8f0b8b617cb2
SHA512 f504aa062826af21ed10c1be8ffdaf3d59ec9b53bff2cec71825fee208ab7915c56894e826e99db08a23d4e48caa3fda97aafb459cfbdbc74af8925dc33fb4a3
TLSH
T127D0A93427620205F020823AEA2042808AB06213B9928B8CAAA6240C282BF031EE082E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 37b81718e51480fd2cdc9b3e97be64ef44c89f202e9f1d9e0a8f3b4daabfc136
MD5 a638b0a056455ec97cc9cf7dbd2340e9
SHA1 7e6cc182633c2824d3407c61d0a94552aaff0f16
SHA512 4013495f60cbca51e71b3d8cb80107c8ee70eafaa4508e0c141f7da2b5db556f7fe1117982afbc68ea8ad16334a9ef6b7830cd1f68f28c72f4c4c28dbd904b50
TLSH
T13AF05C342EE2015EF672223D4AE85395D905B7053405C59916920A09FA67EC01D6283C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 6d52470f22c42dd1d3d81bae1b2102bb62a39fc5f718d02d5541fc897723c0a7
MD5 5f994d4df1d98e5249f2deb4e7c5b87b
SHA1 27d2d1503ebacf13afd791e6dafb0b8439c45b17
SHA512 6cc7efec5e5c08c0c746869c422c706556cf7d616aa46b4ee5f124c3a1c565cacba6f27126c570b36bbaaca29e387f3d1df09faf12c559c62e63eb35e8f9b510
TLSH
T1E4F0F13E38E7121FF222D6BC42D006E6A523F237320432ADFBB2030A1D46E54E860936
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 7db37018aedf60ec32c59e8e5e2b5316351b4ff4bca2f34909b9421412d2b57a
MD5 9f31e4c235fe6fd19f97d81b26106296
SHA1 6c071ff5a641d10f15071c10a17e2549f348cf3c
SHA512 f448ea7a2a509150e4f61bfc2c222fc055694642a7a575c503776709b03b51f282a8795030e275a4208ba1b992a4757cf2609d253ed14f52a0f06a59b6ef2a15
TLSH
T115C08C1C0AA60606F2A883B802C229838B208211F381AF1526B12A08DD24F162C74C29
MD5 SHA1 SHA512 TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
Size 10.8MB
SHA256 6f069f737309517181072586d87d3ea9f902d6371b2b23c9fc85de51af502e12
MD5 c7cf28128ef51308af1482e8e7a58710
SHA1 4c24171cfc6f7940908f506b8d840531b996b97c
SHA512 ab82332b30ae7b5ccd14d99dcd186e6666912201a6771ad9fdede649b8c3af10d8762ad8f35db5acacfbd6fc7766dd548e4d075a8a42e0fba9b51cdc1f88a657
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoK4nz3aSnhB:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSMV
TLSH
T1EFB633EB785E66ABD10D1C398E068E6635BC1BF19B644CC7EBC63DB24C50C531A23D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe
Size 10.7MB
SHA256 a9d2e63bcc1691dc2a19ce4ff154283744abbb7014d2e707ac8bc5c6e8daafa7
MD5 8f60059dc274805d1a499eb9800780a3
SHA1 62911380ba87ff94d76edc4c36463166548a266e
SHA512 aa1b944186d8443812adfe74f584d910dfaf3ab2fc99a4ea7033a3974ae82ab0754387397b65b3fed4b6de2930221a3b20ec20352de89115be46dc295e60b9af
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoK4nz3aSnY:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSM6
TLSH
T198B633EA785E56ABD10D1C39CE068E6635BC1BF18B644DC7EFC63DB24850C531A23E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SystemTrayHelper.exe
Size 10.9MB
SHA256 7939056f14c33d3b58c1beac9e1ab52a3e3df1ded0e0aa579979260d34fb6097
MD5 7110e780d9b45d4ba698a5f94d878188
SHA1 2ca59805563ec11a7edb4d06b0821106fc9e85cf
SHA512 ecf9757cd210b1a55b5ed84b718b7b7cdcec391451954797f68844b9addca1c2c90e3ebb17df3d505db9c57d66c3e124730f863350079bd8e3ade9a52e410de2
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoK4nz3aSnhf:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSMD
TLSH
T147B633EA785E66ABD10D1C39CD068E6635BC1BF19B644CC7EBC63DB24C50C531A23E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
Size 10.6MB
SHA256 08a9b19b186690230b3ff16dfa52d0a26f036c8b277b182c7b45cf330db79427
MD5 18e32e00e50265fddabbc936fb680730
SHA1 079bb68f43738bfbb1d11828e23c38edded72e3f
SHA512 770f1dda8c6bb9d04d830a07a0b524836942df0842ece0e4f92bb43040c5d8ad10f2c43d46287d9c75e0a6b38cb88174243985c985de8085079f70bfbb53aaab
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLSoK4nz3aSnN:TDpbgBr/4QAMQMrEGRONY/4VLjlBLSMH
TLSH
T13AB633EA785E66ABD10D1C39CE06CE6635BC1BF19B644C87EFC63DB24850C531A23D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download