6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
Size 3.6MB
Sample261110-wlsfwsvzhy
SHA256 6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba
MD5 11174267742b5b0b703ab4321420454d
SHA1 da02c7f4745924de1f5428e0010bb7c6f0665de6
SHA512 7bbd9f76285d328c86702fb212cba378f62ec15636ca53df5da04f69d99ad2789d3e45d2d068e659d6110235eb8e2b919c64311c6e9df693849c0af2021d8938
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbvn:Nafo9SWA6NnPAuzOpVWHt8bP
TLSH
T1BE0622E1686E2AABC05A4CBD8E169E2270EC5B71D7604C97FFC53DF60950CC21B63936
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	WindowsHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	RuntimeBroker32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	SystemTrayHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1720	WindowsHost.exe

Executes dropped EXE 8 IoCs

pid	Process
2216	WindowsHost.exe
1720	WindowsHost.exe
1228	RuntimeBroker32.exe
3304	RuntimeBroker32.exe
5068	SystemTrayHelper.exe
2524	SystemTrayHelper.exe
2016	SystemTrayHelper.exe
404	SystemTrayHelper.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsHost.exe\""	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\RuntimeBroker32.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\SystemTrayHelper.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\SystemTrayHelper.exe\""	SystemTrayHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
48	raw.githubusercontent.com
59	raw.githubusercontent.com
74	raw.githubusercontent.com
79	raw.githubusercontent.com
96	raw.githubusercontent.com
22	raw.githubusercontent.com
23	raw.githubusercontent.com
40	raw.githubusercontent.com

Custom signature

Detect suspicious telegram bot 4 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x0007000000024375-29.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024381-109.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024387-145.dat	suspicious_telegram_bot
behavioral1/files/0x000800000002438b-181.dat	suspicious_telegram_bot

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\{Œãwùp\UserSession.exe	SystemTrayHelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	RuntimeBroker32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SystemTrayHelper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4228	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4228	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4228	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4228	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4228	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4228	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4228	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4228	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
2216	WindowsHost.exe
2216	WindowsHost.exe
2216	WindowsHost.exe
2216	WindowsHost.exe
1720	WindowsHost.exe
1720	WindowsHost.exe
1720	WindowsHost.exe
1720	WindowsHost.exe
1720	WindowsHost.exe
1720	WindowsHost.exe
1720	WindowsHost.exe
1720	WindowsHost.exe
1720	WindowsHost.exe
1720	WindowsHost.exe
1228	RuntimeBroker32.exe
1228	RuntimeBroker32.exe
3304	RuntimeBroker32.exe
3304	RuntimeBroker32.exe
1228	RuntimeBroker32.exe
1228	RuntimeBroker32.exe
3304	RuntimeBroker32.exe
3304	RuntimeBroker32.exe
3304	RuntimeBroker32.exe
3304	RuntimeBroker32.exe
3304	RuntimeBroker32.exe
3304	RuntimeBroker32.exe
5068	SystemTrayHelper.exe
5068	SystemTrayHelper.exe
5068	SystemTrayHelper.exe
5068	SystemTrayHelper.exe
2524	SystemTrayHelper.exe
2524	SystemTrayHelper.exe
2524	SystemTrayHelper.exe
2524	SystemTrayHelper.exe
2524	SystemTrayHelper.exe
2524	SystemTrayHelper.exe
2524	SystemTrayHelper.exe
2524	SystemTrayHelper.exe
2016	SystemTrayHelper.exe
2016	SystemTrayHelper.exe
2016	SystemTrayHelper.exe
2016	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe
404	SystemTrayHelper.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2216	4228	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe	92
PID 1720 wrote to memory of 1228	1720	WindowsHost.exe	97
PID 3304 wrote to memory of 5068	3304	RuntimeBroker32.exe	100
PID 2524 wrote to memory of 2016	2524	SystemTrayHelper.exe	104

C:\Users\Admin\AppData\Local\Temp\6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
"C:\Users\Admin\AppData\Local\Temp\6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2216

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe"
1⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1228

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5068

C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SystemTrayHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2016

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09A184963DB18218E7969055927ED546
Size 280B
SHA256 d715bcb4b19603107a525ed1f402809d9884464f985e6fadb258be7065db3610
MD5 0b22d6d944fcc7a7083bbba21522574c
SHA1 d55dd42499ae4671c74de7d9086b3137da7b10df
SHA512 42d7531e7f9b19bce718d65cfdb1cbd3db79d7b98a299d47c5226428a323400082d02325f2b0b5a967edc5ac2fa22e557bd2cb742dc7c0b9ad6694909b297e3e
TLSH
T137D02B0E99F579437D23C6109594D526701314741BE0A228AC24C32AB825D3F1F25120
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 311B
SHA256 58d1fcf9271a586bfbfae53b7c3ff43bba20dcdcd44f08a483a57025b4ba6827
MD5 d6037eeb7409b26c7c641f29bb8efc40
SHA1 646146d85aab585ba4289adbf05e1d2263df693d
SHA512 bbaa440b984682032a8ff249cc7bcd5b190a5661ef3d36f66ae3f864586ae9b0a745878cf4d8117a5b8039efc094a24a0a0d71199f78e813cefa0f79d34cd8a1
TLSH
T1FEE07D22E73C99C47221992C0F66406D7890011D89A4495679385BC54D463BB840B01E
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 3ad2ab88c78173824f34c3a8f78799a983e7907c17a767cefe92ec736b0017af
MD5 6a0ff8a73931feb880e25718580f7475
SHA1 ed3109729892632f8fc408733f0bc5f844cca891
SHA512 b75bac4bd8c5df6817f78a1fccd7ed97e2047ce4bc85622e09915298c09bd8354bf3992fae05e9ea7b8aa5b4cffcc3e90d6a3463aebd1ea8852fe987973c2dc7
TLSH
T1B441D8DAEA5C3064BF869F40593CCB362C78B291A688645571FFC8F230D6BE42D1A85C
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 236KB
SHA256 71cbb8ca30c0c1beee1cdb72d80628a53cd8ce678e7c013b92a424c5ef9b9a21
MD5 0b2c87aa936c1e236a0b8e97a5746137
SHA1 b39ff23b6618b1d7aa62a4192cccff5832d98b05
SHA512 8c8524b6e2307bfd0a9077f6b65de53879001e20ccd4d95b53e92681208038cb534939297de00b13f5762d40654bf19e392804c628383f8e460ed50f94e8ffbc
SSDEEP 3072:D7MKLRCV+6E3+bCtYuiRGTVzDZaJuJ1sGONRjBm1CI8S2as2O05ak:D7MKLM+f7+2zDZwU1m9m1j7Bsm
TLSH
T15B34EE589DB7F0665E8A9D618CD79E8E47F031DB2342621B4EA35FD01C17BDB8E6208C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 eb5d684d6c9c1fc72b425047f74e1d6ad36b190cc81f6cbfbd044bcacb132fb4
MD5 4f4bfbb0768dd4b6571c76bdb9d2da30
SHA1 50284555eecb59c80a8d5559160748c6c5d986aa
SHA512 e18e5f694cd0117533c32351fcf24415ea7135fc7caecc7561b03f0442f3e8255d02be82aecd3fb8c58a8b6020883a20f12c21c6d912ccea501a557416a56127
TLSH
T1FE1154C2DFE8F1819AE257B1CAE8D5267CB464D52DEA70C16C90C8D2349A75E3B0903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 3f13e844dec517f1b5ee52ea4bacb23645885531067da7597df44918b2655152
MD5 8b154fa94733b466b201660bbeb080b9
SHA1 f9a19fdad45c39998a381f630b4b10f23dadd918
SHA512 c0e15be1563d305e47820f6ca8b905115b447041ad4f45c2d92870c7203881826dcc6fa7d5e0e680f4162e74a7fad53b6f201184bcf95f8f0d67e3292891a418
TLSH
T15541F8DB9F4D7878EF42CF8B2DB6C47A2D78847490810885B5B7C9C221EEBA6690945C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09A184963DB18218E7969055927ED546
Size 484B
SHA256 da250cbaa177e5a53a2c8d6d6141ff8982e02fac36566275fae9add9c6be025f
MD5 f03b1141170f513a12392b880cad4893
SHA1 52a2051219760b3a3ac8e09e33fb1e357e15a150
SHA512 1dea917ffc8cf0481133259e9bf0ecce71210c817147edcd045f29a2474f4b16c41aa30769ea82389e65b71b671d3323c6d93a9eb0a21ec89b8496d23c50c30d
TLSH
T12FF0AB2405BD031BE436E87882E57D75AC1EF6253B089BEB17620605AF61E500E8112E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 62c9d0a40f00f737ab2f6a4ba36f168d567070088d98823291d1477fd072369f
MD5 ab414feac76865e7af15fd14287f449a
SHA1 b43c530810d699851c3fc8bd1299ac79e29e1d3f
SHA512 f9169f105bcfe5aad4e4c97d42763192752487361f071bd037a6d76e7cf8dd026f4d1843eed765e25c1e49a7eb77e793e79c449eab6a74cf51c95083522eaaf9
TLSH
T11CC08C1C1AA20A06F2A8837C02C13D03AB208202E641CF061BF12A08D997B166C38C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 242de3022b775ba0acc587ae40cba7b90c2a9883cd4c382be4b7ec124bf64ec1
MD5 23a1d9fcc040bf260fbc0deaf47879c6
SHA1 f69c1eac3035362a6ad928d2a5881f86925cd611
SHA512 18befd8f5ce8a51a4e9e683372855faf22fd50d64d04cd1191456419c98fdf912c3f07774bbccf43f25bcc535bc6c075b761fcd856952aeaa0a3b7f35a235843
TLSH
T17CF05C3D13FC843DF173DBB8CED567D5A819F237340842D81692474C9A02B052C6162C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 36909ff8397df85038bedc6bfbd116d3d11a569b32c81a092f4076659e18af02
MD5 ebd6f373c8d5a7eba15277fa60992234
SHA1 f3e00c662f8f288bd72147875cd8c3d94e1df916
SHA512 19b5d196213b6c1b7add3d1628ec263cd0f203a48000893ba41daa750dfb192a3f9d4e152abd6eb9e47420b7ba1e75604d4135263321980e14bd9ce554c09f60
TLSH
T1D1F061543DFA617BF276F53CC3C530710C37A316600666BA16B043086A16E122C61526
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 b6faff5eb89da6d2bca1bc9fb9c4f73131870d8c22d9fbc0306574c4a21805d4
MD5 8a8c3ac4c16a213b0de6fbba829e69a0
SHA1 296a1bd937442554ef8112734ece6943c471e746
SHA512 c7dc89e7d65ab2bd631d4fc1baf490f735b52c12d396901120ab8c4943e00c184194b3c6e4006b43f01d772082d85235f3b704a63eb9fe3a1f488a12c4120cef
TLSH
T178D0223827440F30F032937AE8B20B436990A20BB1C7AF0F2B3B632C802CE6408B0C1D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 a29e7bb70326cd09cbcb6669f1486e4418ae9a2deb88465e3ddeaa1ce47d9d3b
MD5 d299d388060739f9671ee0be9913d86c
SHA1 c16f2b8b97a783f3beb65009f9b44463e936ab1a
SHA512 42f1c541184784e9225208a6bc37b3a0a87b7ba1afb3e9fadfa2baab8888a053b31918a493d4b86b29e0ddb8929b38e1d6842d41e5e75a25221d0f07acf5b96c
TLSH
T1D2F02B1806D7902EF332223981FAA3AEED19B3663401C4AA17A7034EFE23E801D2143C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 c3ac7df243d45e74e3766809702c70ca12595bb296ce705c0a3e62eb15fd6ba7
MD5 087edf4cd0ecdcdd667d4cf8aed26b33
SHA1 76c06869330506b6d0b56cda639cc21fbb75fe95
SHA512 81df3546c5969296d9e8aa668727a635793e3ac4d060bb5648db3fff46722632b269459e10cb9ec7d120cd5553ce690ac8647a7c0ac3bd0634c45a91a38dba0b
TLSH
T116F0AB7528F7116EF2A2DA7C42C552D60662E23733053B69677182095E0AB00AA30D25
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 85079edec321357f0c19c93e83eb8e54b81d4d66d7e429c21e41ee97a7a71048
MD5 279d1094b50892ea52a2c6db66f2821d
SHA1 f977c13b37d76dd98ca0989c6ff7486270077df3
SHA512 4408aa26dd7f38b5c300b742e7c71f6a5476c78278fd87a790ca8abc175e2875d72cdbd670f6ca6d333097a952e3913f026e60decfb17730cfbdef436fab14de
TLSH
T1D1C08C1C47610626F2A893B802C22D839A208111FB819F0627B12A08CDA4F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
Size 3.7MB
SHA256 144d5c8a119ba095174c49cd1dee62f9e96d5034d7bc52bfce91b712f8a29b63
MD5 70f65cb330010985bea3befe1b8243f8
SHA1 1beb0899251b1a753a200513e19d466dde85d6be
SHA512 db19829b1befb46a3d68976271f116e0bfb5e5151f5af9f248a69afb9c7dc3935d8ebc14bf0cdbec7df02dc2b223676b1ef3a65ed0e204a0dfa1e13e2da41938
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbvw:Nafo9SWA6NnPAuzOpVWHt8bY
TLSH
T1C10622E1686E2AEBC05A4CBD8A169E2270EC5B71D7604C97FFC53DF60950CC21B63936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemTrayHelper.exe
Size 3.9MB
SHA256 8886183eac5d765482a395dc73c1ac6f06863a934371933be6ed23537a2be9d7
MD5 c35fc2358654cc787e8682d22c87f5cc
SHA1 61e1452160d42a489466109cd0f99f888343c661
SHA512 56603466fa2cb84524e64b298da45cff2422a4fdb1e5ebd049f201911bcf49dfae7c415c6fdd5fc5501d086899cd0d3cbe51909255959d94a3a683f323735f3c
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbvTk:Nafo9SWA6NnPAuzOpVWHt8bbk
TLSH
T19A1622E1696E6AABC05A8CBD4E169E2270EC5B71D3644C97FFC53DF60910CC21B63836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
Size 3.8MB
SHA256 04b3e75d799572d74ff4740721c6ef795cac894fe85fe65c19192ea00eb1291c
MD5 30efe483a35bd083e396fe1cfb71b196
SHA1 c6344e3a3c60ee65becd7aaf3f0dbdb8411a515b
SHA512 55d628301039d05af991f119cd132631be20e4c488f379743c3fe73aec6da67eee79f8b8872891c609feda79237022c6ab09d44dfd375c93b0b6cc6ee2040909
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbvTd:Nafo9SWA6NnPAuzOpVWHt8bbd
TLSH
T12B0622E1696E2AEBC05A4CBD8E169E2270EC5B7197604C97FFC53DF64910CC21B63836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
Size 4.0MB
SHA256 e3385a30b4e97c7be51d60e7c7f4783e976c5d182cd1de6a6a9b74a8134e0162
MD5 056077a319e56dc921fcff9ef6b49251
SHA1 90b7570fab83fa54defd36b2f47d7f884040b8fa
SHA512 e8557a5a54b7893c67e3bfa594e2cbba5fcfef72aad377f21e6e7d42a89a1858acb6391aa2cecab1a4391a7310f9a020cc9a2f0de5a868bde7d5c933c0aa6041
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbvTR2M:Nafo9SWA6NnPAuzOpVWHt8bb9
TLSH
T1831623E1686E2AEBC05A8CBD4E169E2270EC5B7193644C97FFC53DF64910CC21B63836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download