94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
Size 11.8MB
Sample261018-sdl3cses2j
SHA256 94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e
MD5 0020ca27378099fdfc80e83bc6b3fb4c
SHA1 25d063556addcdd08e6734c8a2dee3971f9e24c2
SHA512 ffd489d4eafd3c750514202be68b7094dab0bdefed28f1126c1b65925d42289dfcb4bd94e49a99c1763208645fc5295c6fd0f1b4ec2b20555590f8f7c7cad14d
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muq71EB7:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkc
TLSH
T1CCC633DA685F5B6FC10E5C798D068E7239BC17B1C7688CD7EFC67EB20840D921622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	ServiceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	WindowsShell.exe

Executes dropped EXE 5 IoCs

pid	Process
2264	ServiceHost.exe
3004	WindowsShell.exe
4992	WindowsShell.exe
4540	WindowsShell.exe
4724	WindowsShell.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsShell.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
18	raw.githubusercontent.com
32	raw.githubusercontent.com
47	raw.githubusercontent.com

Detect suspicious telegram bot 3 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x00070000000244c1-27.dat	suspicious_telegram_bot
behavioral1/files/0x000f0000000244cd-45.dat	suspicious_telegram_bot
behavioral1/files/0x00080000000244d7-103.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsShell.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3160	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
3160	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
3160	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
3160	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
3160	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
3160	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
3160	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
3160	94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
2264	ServiceHost.exe
2264	ServiceHost.exe
2264	ServiceHost.exe
2264	ServiceHost.exe
2264	ServiceHost.exe
2264	ServiceHost.exe
2264	ServiceHost.exe
2264	ServiceHost.exe
2264	ServiceHost.exe
2264	ServiceHost.exe
3004	WindowsShell.exe
3004	WindowsShell.exe
4992	WindowsShell.exe
4992	WindowsShell.exe
4992	WindowsShell.exe
4992	WindowsShell.exe
3004	WindowsShell.exe
3004	WindowsShell.exe
3004	WindowsShell.exe
3004	WindowsShell.exe
3004	WindowsShell.exe
3004	WindowsShell.exe
4540	WindowsShell.exe
4540	WindowsShell.exe
4724	WindowsShell.exe
4724	WindowsShell.exe
4724	WindowsShell.exe
4724	WindowsShell.exe
4540	WindowsShell.exe
4540	WindowsShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 4992	2264	ServiceHost.exe	101
PID 3004 wrote to memory of 4724	3004	WindowsShell.exe	107

C:\Users\Admin\AppData\Local\Temp\94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe
"C:\Users\Admin\AppData\Local\Temp\94235aaddbe2b58ae1380a8d20c90d1394ae78fc7221df9d69ee22289cfb0a9e.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3160

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4992

C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsShell.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4724

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 312B
SHA256 f81c4d14e873614514725d56abd8f0be34b6f5d4477cd74ca95c932b5983b14b
MD5 0227e28c5d089b59e4d0861b677bd89d
SHA1 7cb7b790d9d3c5abb7127e2c4e472490554db2f5
SHA512 53f9b98fe942c6cd7ced07851b93000da0f866d115b17752fb3fabc8da3ff5e238e07645bf902f960d7da00b809e0f5b63bbca0dd63c4c3ba2236eba97c42989
TLSH
T17AE0E716F70D58943B76CF5DCDA1196F7C73301950C44509282D54E44C031E64407498
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 4547662d95ffc6ea63e0bd4c6c75463c95d594c7239e111791a1debfbe75513d
MD5 6e3001ed97ef86477e390f9a610b311d
SHA1 fe32dfc96fd3e54ddbccc89b78df22abe8396af2
SHA512 14026ccf65e8c7a9009af766e180543791a6ad31b532280afbe017ea7081ea7fd89d922296486f004eb4a58149f7a0a93c8f270e05b7c873fcc3d0ef9088501b
TLSH
T14A41B8ED2B3C3824FF86CFC14939DB372E79B1D49544645532FA85623045BE52E1549C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 97e8275b1265f18faa1c822b003da554dc4f197c3ef7e8d7b4e6f954a57592f5
MD5 51247251ca18ff9d40f011c533b0831c
SHA1 df10b4463b52638d64f3a534e7206be9b92754d5
SHA512 123959014a85fbb83f01c1f726852ded60a542a1e45c0544d6dcd522c6daca513b378fd40f99cb6dde38e0d66b02238a8dd3e3d91a4b23731976d0a4914a7eda
TLSH
T120D02B16C2BD24923D63DCA1D981786570B39A7A63A6551A7498801A9806AEA1D09298
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 185KB
SHA256 752a3be6aa420194142f366b3840491646a843e46e3c9f6562f1b946f9723dcb
MD5 22bcfc307899b47371e87a3bb3d2198e
SHA1 8865149fee3a9b9ebd7a509eb93adb37b408fd2e
SHA512 c1d42010d4816d7642c92100d21ff3f4bfa8ab0419b8e6941e1048ede2238cd2d7ad514000efba8eaf6b1aea0656790c9b89d071ef908106095d22229d25b3db
SSDEEP 3072:pO909JXxqzrYgNGuPFj0CxK1YlM10RKfgYdgghuch:pOgc4CGuPFj1xKItaDh
TLSH
T1C0042D186DBBB1619F4ACDA24C9AA95E03F571DF2312331B4EB76E901D43A9BCE0744C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 2c65fe8529a61d5cc1afdb06dfc967b9f37eeb990b48429ca01e53bb025e1730
MD5 6c5363f6a24862199d9e4fc7c51525bb
SHA1 706ca3488bc9e0a1a11065e0b33fa8fe6284a3d5
SHA512 01b431413358b6dee565915138564dea3fc892edb85590f919f4041ca99e422b143ff0847cf3d68ea7f4793200c4ef0b1aa460d741de4dd458d1b976ffae4ef9
TLSH
T1C111258B9EA4B0D15AE256E1C7A8D9327DB434C52DDA34C02CD1C4C720AA7593B0C03F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 47cc72276c7e7123695877ae67e518432f8f22c0cf1d11cdbe544ab8797d8f3c
MD5 bd1fd34b7f60f70bfd63216208350a3d
SHA1 521872d8f6948ef0a19155062d2cfb7e5b139ade
SHA512 a85a9029d2dd8e0f69e45c6f4c7c60b85d60bf5fb2a68cc138ac6b6c042b34a6401dfedbfd4aeea2d12fad8759b2728e06c1a7d6f88819a69bcd1ae84155f5ec
TLSH
T153411CD75F4D7854FE41DF461874C6361D3CA061D1844C82B9BBC4C704DE7CA2D1689C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 01853c992fb4bbcf34d01c1ed264965ffa77cb9737c15c5b7bfbfde90d53f0f6
MD5 7e87f52b32dbf2988aeb1d05390d9ab4
SHA1 46f58f7a974b357eb885a617702ef89131d5c050
SHA512 3f27e40fdcd1938e97c3f54493eed57628ad656ffed695a80ecf175e6b995aeebc6cc9de40c79b0ccacfc62c41924946b9ead5f86e667d389c8dd60e2c39189a
TLSH
T176C08C1C1AA60A16F6B8437E02C13A03AB208101E2428F051AF16A48C9A6B166C38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 e11df81c785de1a87bc2f5beab2d97815d230337487658003db2cbc34da3e375
MD5 fb179af27b6a76c3952b813b8a443f6e
SHA1 9d244162c2ec5a8c6044fd1104d36157a70eceff
SHA512 48d46b855c6a779ea05b5dbd6ecef2c5d3653899290d2635a0e4478e2c5cdc065dd92bbbf3f689aea2701d619293a27d3441a43db44c34fafb0853177b500513
TLSH
T192F05C3C1AFC457EE0B3DE7D67D8B7D25D15F1162404059856E24F48EA40F412CD1529
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 dee12342a6be2e0d5cddd56186abb545fcb8b09679ba96a7bf0113991c67837e
MD5 4278b6d5216c06796b4215720aef156a
SHA1 13aaaf4227a3443d5722a0aaababf1db4ca1895c
SHA512 918757f38cd8df9b56e02a554aee492e567c40e5eec0307942851ab29b275e422a5bdd65207902b60b07937bed3d45cc2805f50297be924ee97a2649b0649e8e
TLSH
T193F0225D39FA957BF033EEB853C632B40A36E20A3001657927B133093E16F107C22201
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 eaa943d2e9e39aaf8d1f024380fac8d280d4f437812a4f99764fae0aada3f396
MD5 9e8bd1baec940f029627a2e104477432
SHA1 a274239f54059e4e51ad0bf8a92497ba9595122f
SHA512 7dcb8d064bb9f6f578e17f95154fcfc08ff7cb6e6d21cbae8629a5c57b6b77c615ab29da85a22f8a8d50eac82ca8a8b6eab857b2ae33ddd16c2c09c5f7fe2ac8
TLSH
T162F0A314057C406FF4B2F87AC2D521B9F525F11674055EF686D70B055905B002C51A6E
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 2adfa0d3cf9108545c95f92ad1d03eed92934a40950ef668e89685012a1d089d
MD5 ef99a14503b9454b2e6b8447347e4120
SHA1 3416958beb97510f42619b4805e9e0552bc5de40
SHA512 174397dd5e303ea8cb19397703a3b53d91ddfb995142f7130190d02a89d724f05fe883ab4d8d626ec18de875ddec2bc768061689a63bf0c5291e4867b002b948
TLSH
T19AD0A9380F220134F120A2BE98630E8009A02807A282AB0E1AA10408882AE030C9290E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 208aaf3da245a824e5e2956c7b5a0eb03e9d6d126900ee9fa372ac32ccb9b4dc
MD5 411fcde0f686a1424abe867b3b05bba7
SHA1 f2ac27ff6850649fd91a2cac85cdb877ff544e78
SHA512 bb1a1054b0f3bfcc42186d039de25c683721f6ed961095847c4cca729b46d3def490b1f3c8180af9f8a85b7ed2d3d28db63e89f9f9be0d45888ff96d8458e381
TLSH
T1EAF0A32425F1411DF13227394FF8939BAD19B6973404C8B929A5070EE917E015D1273C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 2aafae3388a508b02d1adba0ad822e273bd2c3f1106c93950d616f27cc5e1569
MD5 c8cc8e947350aa5ec5512d5c41bf05b8
SHA1 d9f08877e2d09c21fbc55ca0b7b3e604e7af7669
SHA512 f58b1541d98e76a5da383115f5850d9e47c52d89187db4cbfaf56e4a14d6e03c025b42baffe066ade4bdfdc77db6a5987d065ac3f4a5710fb91a9c7e3e573f99
TLSH
T120F0AB3829EB015FF2A2EAFC82D501D981E7F2333708275A66A142045E07B40BE60E2A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 24e56f5de0f54716a00327b912e82412be1941a93b381831535a5b34a87a5cc4
MD5 f986c340ed5c82d352ec73944e37d1ef
SHA1 3436e119000dacfdb7988e855d734ce193454e5e
SHA512 890094ffa8956bf94d1f14d154c4abe6db19ddf535de09150d85289d617add9323aecbee82ee65785ccb8a2be653e2273349aa4842cc03c03be740fa9401f614
TLSH
T14CC08C1C06650617F2A893B802C229838A608110F3819F1126B12A08CD34F126834D29
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
Size 12.0MB
SHA256 96af256005f1012f1e746b1d937d2fbd3e73246bfe61135549353bc388ec38f9
MD5 31826600006cbe82c7e4cbfc2ac38a0c
SHA1 8397a02f197e8d48eabc3bce6437e37954c9993a
SHA512 07db512aa7bd898e2d442ed820d162190af831ee9de78289433e9369644fe097744bb1b8f1b3bd5ac985f45d2b053afe71c336d7fb34c8853eb055b07165e4c1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muq71EBu:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkJ
TLSH
T19EC633DA685F5B6FC10E5C7A8D068E7239BC17B1C7688CD7EFC67E720840D521A22D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
Size 12.1MB
SHA256 f131e63b6e8d429cf1e93fac448cb4541b7787e862c4e2313fb8790cf93f57b6
MD5 e3ce8d71280bef6496fa07aacdcd93c1
SHA1 d1e0f2e448615a82649fcc000e9f8d554ad38166
SHA512 d65a7977c8433dab040b7af30c8188a4d2bc9cf6bdfc294266d2b8d6fabbed4f1490cacdaa85c40bbb0906f63d7cca0874a3820b80e8d1d9bde37419694cc48a
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkbdpREDZK:4JwMrcMGL9g5
TLSH
T180D633DA785F576FC10E1C7A8D068E7239BC57B1C7688CD6EFC67E720840D922622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
Size 11.9MB
SHA256 fc34381782115d4a7d3b774ba022f02603f7c3f27df1a321030d9b6250f4c9a8
MD5 02ffada45234f825f5f82100c89a9b13
SHA1 126b3ac9655234c0074fca77a18e579d4179227e
SHA512 526fd12215a75e3497dff13661f56b1cb0cf5b7b29115f488cb0c1e357a399dab3eabc23c4787bb162962b37de682bdf89bb9e076c713989cfc89975539d2f03
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzFAEkCg/y9muq71EBk:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkl
TLSH
T1E9C633DA685F5B6FC10E5C7A8D068E7239BC17B1C7588CD7EFC67EB20840D921622D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download