fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
Size 22.3MB
Sample261030-xeh5baev91
SHA256 fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e
MD5 205eb3a6352e9d30126bdc77345d651a
SHA1 d0c20589d428fcde6c414fbd1530503d79bc48c3
SHA512 e0a9f0c5b5ea94951887e962125bff786b13b28022d7df33a723691b3f68efa861368e85ca40bde5e7e51e67a432991a2c7d5c5573bd7f698c4b4aabb8337627
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkQID195zc4WQxSOxpWuyD8Ziyc0DP+aED:4JwMrcMGL9qxhpWaGZ
TLSH
T17C3733A97C5D1E6BD10A4C78CD068D7279BD5FA0C728CCC6EFD67DB24810CA21632A67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2704	WindowsHost.exe

Executes dropped EXE 12 IoCs

pid	Process
2704	WindowsHost.exe
5708	WindowsHost.exe
1888	NetworkHelper.exe
3128	NetworkHelper.exe
5808	SystemTrayHelper.exe
5828	SystemTrayHelper.exe
1560	WindowsShell.exe
980	WindowsShell.exe
5500	SystemTrayHelper.exe
4164	SystemTrayHelper.exe
5712	SystemTrayHelper.exe
3556	SystemTrayHelper.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsShell.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SystemTrayHelper.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\SystemTrayHelper.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\WindowsHost.exe\""	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\NetworkHelper.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SystemTrayHelper.exe\""	NetworkHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
15	raw.githubusercontent.com
28	raw.githubusercontent.com
38	raw.githubusercontent.com
41	raw.githubusercontent.com
53	raw.githubusercontent.com
65	raw.githubusercontent.com
77	raw.githubusercontent.com
82	raw.githubusercontent.com
92	raw.githubusercontent.com

Detect suspicious telegram bot 6 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c51b-27.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c51d-104.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c520-139.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c51d-173.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af3-207.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016af5-211.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 26 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5752	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
5752	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
5752	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
5752	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
5752	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
5752	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
5752	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
5752	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
2704	WindowsHost.exe
2704	WindowsHost.exe
5752	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
5752	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
2704	WindowsHost.exe
2704	WindowsHost.exe
2704	WindowsHost.exe
2704	WindowsHost.exe
2704	WindowsHost.exe
2704	WindowsHost.exe
2704	WindowsHost.exe
2704	WindowsHost.exe
1888	NetworkHelper.exe
1888	NetworkHelper.exe
1888	NetworkHelper.exe
1888	NetworkHelper.exe
3128	NetworkHelper.exe
3128	NetworkHelper.exe
3128	NetworkHelper.exe
3128	NetworkHelper.exe
3128	NetworkHelper.exe
3128	NetworkHelper.exe
3128	NetworkHelper.exe
3128	NetworkHelper.exe
5808	SystemTrayHelper.exe
5808	SystemTrayHelper.exe
5828	SystemTrayHelper.exe
5828	SystemTrayHelper.exe
5808	SystemTrayHelper.exe
5808	SystemTrayHelper.exe
5828	SystemTrayHelper.exe
5828	SystemTrayHelper.exe
5828	SystemTrayHelper.exe
5828	SystemTrayHelper.exe
5828	SystemTrayHelper.exe
5828	SystemTrayHelper.exe
1560	WindowsShell.exe
1560	WindowsShell.exe
1560	WindowsShell.exe
1560	WindowsShell.exe
980	WindowsShell.exe
980	WindowsShell.exe
980	WindowsShell.exe
980	WindowsShell.exe
980	WindowsShell.exe
980	WindowsShell.exe
980	WindowsShell.exe
980	WindowsShell.exe
5500	SystemTrayHelper.exe
5500	SystemTrayHelper.exe
5500	SystemTrayHelper.exe
5500	SystemTrayHelper.exe
4164	SystemTrayHelper.exe
4164	SystemTrayHelper.exe
4164	SystemTrayHelper.exe
4164	SystemTrayHelper.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5752 wrote to memory of 5708	5752	fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe	90
PID 2704 wrote to memory of 1888	2704	WindowsHost.exe	91
PID 3128 wrote to memory of 5808	3128	NetworkHelper.exe	95
PID 5828 wrote to memory of 1560	5828	SystemTrayHelper.exe	98
PID 980 wrote to memory of 5500	980	WindowsShell.exe	101
PID 4164 wrote to memory of 3556	4164	SystemTrayHelper.exe	106

C:\Users\Admin\AppData\Local\Temp\fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe
"C:\Users\Admin\AppData\Local\Temp\fc91213ba6769f27447de248d3d0b915da91dcbd9dc2520d8b68a28aa5c6b81e.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5708

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1888

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5808

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1560

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:980
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5500

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3556

C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09A184963DB18218E7969055927ED546
Size 280B
SHA256 76e75586cf1aebd37511a52f10a8287d91441db2dc7749c12ec560652e49a1d4
MD5 e602d20a00525043692e4ffb6ebd215f
SHA1 f46e47f177ee6ed0cff3239a098850719c70a4d1
SHA512 c0c58963784188945cae91d45f871d90e48a1a3cf942d48af97cfa44fd7dbfb193ac0fc577409a530311f97dc133709f5a3f5fca385174286ca731ac4f538e5f
TLSH
T15CD02B1AC5EF69937C73CA3050D8E1043402105416E1BB29794EC3ED5E19AFF1E05100
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 399cbb85e57a18784952233af6cbe8c1939145c6a4458afda0657727da43a2a0
MD5 b0a22cd21c93d89e10fd9acbb13b8061
SHA1 5a84f5d64332d361c9fb361a1409bbde7a8ec545
SHA512 4c3a7c758ab6478a06858e9dc9e6de9e27c0377f8d2900e1446a94d1981a8d42174565709f82d877e7786c47fd61e1905e2a84a5eab639cab13adc3b482cbf02
TLSH
T1BEE0722BA70C92E6BE6248246ED1482A7C51100E46C0E22A3A3882D80C437DF8E07408
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 44fd34742e7377eb1e4b0bf627ff20bf0d170877caed27e509edf68c72f24a18
MD5 b7594163fde89ac6324c50b1ef3b9a73
SHA1 7dd9552b7023722466ddbe5215d66ca0afb7167c
SHA512 c461f71452bd89f21de0c438ea6968c15033536de904c07da433dde779daba137cae8246424f80f1005e8d7b0dc0568a91f41947d4c159f200f9be34bccd4a05
TLSH
T1B141D7ED6B2E7114FF828E446634CA363DB9F2D0C4C5915974FB8CB2684ABA01C06C5C
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 197KB
SHA256 22e762291ffab5d93c7b5baa8acd19383ca791979df1c28fdf7531ed863f9465
MD5 a559272d97dfdf74ba01501cf56cb349
SHA1 e5c33826dd1f125b516f0273d7c0015e41ea2834
SHA512 9de07c5486ac44e833f9f4ae671d306b0ce22f519665b2b29031d8a7c8ee657f76b8151c604e7141958ad8fe38e1dcf70e377884f45e145f9c02400dc5b58db7
SSDEEP 3072:x9Ed1UsKvuu2SVvNcJJQ5Y71R3/PPImNLC7PelqLB3bOdu6:xKkVvuu2S3cJfHPImRhu+
TLSH
T103142E286DBBB1619E0ACDA24CD6AA5E42F071DF1312631B4EF76ED01D43ADB8E4744C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 1986c7fcf5a66a14925811de8ed70801c4f85985fb4b570053f43cb4609b8164
MD5 3cca64482cebaf68f07ed63a774867de
SHA1 09f4e383c6a4d0bdf95a2d2206d250271781c7b9
SHA512 76d871d14002fcb297b9d64e8c4bb6f2704f79b338deae95906c46fd27439680740f782c38b4177c964f0be31467a1d0c14394ab864a0075fc9e93e912a01220
TLSH
T10B11E1879FA4B05099A6C671C6F8C5227C74708619EB78D12892C856249EB6E3B4943F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 d5cc1a9e4672e7970968aaf1cda3344bd6497973f48ff725b44e84e3387bf964
MD5 18fcc7424be0c70677d9dd36fdf7476e
SHA1 dfcb36c73e6292421640357d448c5de14ca70555
SHA512 bddc2d015722211944b05b4ffcab0e7b6be9940cf10ba7d8f396c0928fa32a41a31cd468e259e13fd7be1ebd4396d3de9eb5b75546379ef2a6d9c308f14056ae
TLSH
T18541C5E71A593558FF468FD958BAC9382E3DA568A1C4184278B7C48215DEB812C068CC
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09A184963DB18218E7969055927ED546
Size 484B
SHA256 b6b2b8b339d2997c598f67ef793a53912617c734a2f5d23f0951015bdc710522
MD5 d58a43326c12cec81428495fe6773963
SHA1 77b1a0b24b1af3f7007fef27a0771cc940d7af9c
SHA512 e085fda13e29ef8d22e7d4e2ac12af8c112d2b5e33ba0315b2dbba7ee629c9e122a041829f6613bd9f47a398d534b8af820b5c7c32be0d32bbd034d4a3e14c5c
TLSH
T14FF0552018F9011AE072993DC6E4772AA82AF00A6A0966FB0699830A9A62E440C8252F
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 1d5189eab0d933163045f6b40f68640cde1cc1f6469838d275bdf1da7788f25b
MD5 d52cff01cfe6e127a136361a2e50ca3f
SHA1 ba37b13f714e3271e88d5871c40e56891e418284
SHA512 c98308429137567be3be583571f6604753dad07e3fcc5869a586501681f9274471b3efe77b1fcd64f5f6eafc67b9834d6ab202fc5a7ab800a93e2722dc69d4b7
TLSH
T112C08C1C1AA24A06F6A8837C02C13A43AB209101E6458F051AF13A08CEA6B162838C2E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 4b7c0533ff90e20e5768e179dda69923ca5cc1bc461beebd69bb91ae8b4e9b77
MD5 62101c20115e5fcfa14f79bd2be4a6a5
SHA1 2fb987b977eccd90774a07b9f34fdf960d483a13
SHA512 98c57644e077ddbc8932edd11c6b654c1f181a02b11a9bb4c3f0aa24757d0cfd8a61a8194bac52c6595d6a48a6f2dfb7de554960a1f9ea2348c0b94268395274
TLSH
T167F05C6803F8905DE072CE78CBD5A6D1A916F11738094AE40BA247089943F011C9143D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 4769696c44b28632e4a6521a6f6f519a550815b4df3de55aea2e5c26df5fb90f
MD5 6b06e9945ae971f8e2a906ee18475fc0
SHA1 809def2ebda7c9a3b558e191d417ddcaf2820239
SHA512 7b514dbbd53a33d4100d5d2be6b44c3126437cd7339c01f13d0ef0c9d7a0fdd58e0acd3c31257fbe41d914221001e0559097d013bbdb835444fbbdd159e91c4d
TLSH
T163F068BE39FE547FF473DA3903C532B5962AE215300926B437F22308AE64F607C9121A
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 5fbe15ff02a223cf37b66a735fccf0f7199b817a04f5c3a38eb0e84ed9c76056
MD5 ee4c0136cb23f935982d3c9fdf40874f
SHA1 513727340cfd479c09a8040d83672b66dea72085
SHA512 f6a0c055800a5edd58a8fc488789a0ef2ef54bad85de6a2ded51b7927d1d601c1f366d4528265eaf92d0db1c85e7c13ede5d5d413656bf0ea21fd13d2511074c
TLSH
T1C4D012291B142336F27DC2BDC5559681EEB10B74E89647982BB3164CDC6CF552E70D1C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 e24bb054cc73296e9353299e4fc444a63bb38a9c6d13d6ac002ff689fc3f7bf9
MD5 bd3f196730904bfc55e04f80aa0f1ed4
SHA1 36829640473bb5b3df6afe8a7e364ec5f600a01e
SHA512 22e77268c8e36fa08fd65fca01330222eec92a9a92f39266241af9202b293f025c30344849f06ed2a87ae281f66fa35b106e9203da1b5ea0f2655e0f0ad33d57
TLSH
T1C6F0A33D1BD2502DE636A7B946E553E76E05F39F3804C87516D50709ED03F007D11539
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 f87c3eb38a60ac439cfbfbef07f00ad0bfd7493d7b7e128fa16e77478538f533
MD5 3e19e7c1662d7df72e6c4ffdbf4a9b84
SHA1 012811401d36f6fac7bae59cee07b0a4111d717b
SHA512 487dcf8c82a258a823c7cc585a31e4faae34727e20be9b8607aea4ef1740c3815f9c6bebc15f8c8d02525d7f468a1261ef1b7bd43bf4c13017b38a7c619c9c2f
TLSH
T141F0AB3E30EB025FF162E5FC02D922C58577F23731083A6D6AE19305AD55D00B9E0918
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 2645d48abccd0e77b8443699e4916941d89995c783ed494fff830924e832a674
MD5 53dcda2e79375900da672d2972613068
SHA1 f9f42e97604c15b209b526e57e2d1b46285167c3
SHA512 d59486113841db15a2971b5aead32b0fabb27985df066b90e67725458020f68b7970727b7f8ebedd0348b7415371e0f882acd3796f1053ddfb44be428f9a5ff2
TLSH
T164C08C1C06620606F2B883BC02C27A838A208110F7859F052BB16A08CD34F122838C29
MD5 SHA1 SHA512 TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
Size 22.5MB
SHA256 dc1189586d90e2ffa430cddf4e36939f1fff1285ee856de5cc01457191ba13cf
MD5 78328698de8bc6f90bbb2e6e8cd1b2f9
SHA1 4bc09c3807a6b1e5a54be11856a163f84bd1d315
SHA512 5bfd31777dc47092eb9c48fda94c5b656d3ebaf8b1d6e50d3046e84186632a6ab5d47a0cf59ba3509cc30207808956a3c729e1b917dabd50202d2785fdad3951
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkQID195zc4WQxSOxpWuyD8Ziyc0DP+aEW/:4JwMrcMGL9qxhpWaGM
TLSH
T13B3733AA7C5D1E6FD10A4C78CD068D7279BD5FA0C728CCC6EFD67DB24810C621632A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemTrayHelper.exe
Size 22.8MB
SHA256 6a0fc34014af0e89480aca5e0127ca17fbe15e97fd6f7ec347d2cee6b1ce2891
MD5 75ed051c92f21b5683e8ccb5feda6def
SHA1 2266baab73ddd58c31e7e1bc97db079856138fce
SHA512 a57b44357cb0bd9531538c20156bc78f84a311179263b7ddab74f54b053b2e5335c383bc5475eef2d4500f919e28c9df181fb1e8fcd2e7c1626f088cdbbf0c88
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkQID195zc4WQxSOxpWuyD8Ziyc0DP+aEWj:4JwMrcMGL9qxhpWaGy
TLSH
T1303733A97C5D1E6FD10A4C79CD068D7279BD5FA0C728CCC6EFD67DB24800CA21632A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
Size 22.9MB
SHA256 9b17ae6f7f51927dd65a762735d96c91c8c7aeb3f0b53a1645ffad1eb10f751b
MD5 f9a641aab3e79c4d2701847292091106
SHA1 bf67e95f99f99d8e0d4c0a5a800efe432d8393c2
SHA512 c3ab1d7432602079c5ced38dab3d71588fa5692c7b410d6f2cc57073f1ffc188a0869619e7f11f02d1e37c6e3249158d87f337db8330c72571ecc0b0b9df50ce
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkQID195zc4WQxSOxpWuyD8Ziyc0DP+aEW2:4JwMrcMGL9qxhpWaGb
TLSH
T1163733A97C5D1E6FD10A4C79CD068D7279BD5FA0CB28CCC6EFD67DB24800C621632A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
Size 22.6MB
SHA256 9771a08e08aa175d8a48aaf76e0b0032b3e3904ccfec794c68ba3adadc2a631f
MD5 e7c9bc97c51ddfd3b07fdbb16bca6c71
SHA1 74c494ee615f5aee909f72d64eda1a090057ede3
SHA512 caf0a00cfe7b2bc0178a264a7bc0646570bf7fd404b3d69c0ee1aa38bcf383b512b25c860040151a93ebd6635b0bf9462b78868e69fe7c1dec29b07099c6ef76
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkQID195zc4WQxSOxpWuyD8Ziyc0DP+aEWp:4JwMrcMGL9qxhpWaGc
TLSH
T18A3733AA7C5D1D6FD10A4C79CD068D7279BD5FA0C728CCC6EFD67DB24800CA21632A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
Size 22.4MB
SHA256 c53222605aaf1106ff066f934eef80edb8b2b8f3990f040cd637f843d3e02267
MD5 1dcd8bd16f9a3438361f7dee283ce77e
SHA1 73b98025c15e035a4980dd65e637b8314beb3616
SHA512 af7aa8f47082d5b7bc2635238d33aa08695026a9e23102a07702a92f3120ae1216fbcfe7e02afccf40e27bf577cee5793ece46fa6dc72ea8961a1436c00b8363
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkQID195zc4WQxSOxpWuyD8Ziyc0DP+aEWn:4JwMrcMGL9qxhpWaGs
TLSH
T1133733AA7C5D1D6FD10A4C79CD068D7279BD5FA0C728CCC6EFD67DB24800CA21632A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
Size 22.7MB
SHA256 7400eaeccb45769d2211673b69d0cc0d3750498104b62386d691727bc7908ac0
MD5 ca85cee32b86ede885788d100c6a54dc
SHA1 be0ee28596d1b85b69ec7b34581bf5a5ec950392
SHA512 11b301bb1639ec718bbad2e0a7f7af7840140149255539a82fa4075d08ec134265dea0cdc31b05bf53ea697bb2c1f90fc94c09ed53fee6faf5863330f32f7196
SSDEEP 393216:TDpbgBr/4QAMQMrEGRONY/4VLjl5AEkQID195zc4WQxSOxpWuyD8Ziyc0DP+aEWD:4JwMrcMGL9qxhpWaG8
TLSH
T1B23733A97C5D1E6FD10A4C79CD068D7279BD5FA0CB28CCC6EFD67DB24800CA21632A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download