6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
Size 3.6MB
Sample261110-wlsfwsvzhy
SHA256 6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba
MD5 11174267742b5b0b703ab4321420454d
SHA1 da02c7f4745924de1f5428e0010bb7c6f0665de6
SHA512 7bbd9f76285d328c86702fb212cba378f62ec15636ca53df5da04f69d99ad2789d3e45d2d068e659d6110235eb8e2b919c64311c6e9df693849c0af2021d8938
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbvn:Nafo9SWA6NnPAuzOpVWHt8bP
TLSH
T1BE0622E1686E2AABC05A4CBD8E169E2270EC5B71D7604C97FFC53DF60950CC21B63936
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1796	SystemTrayHelper.exe

Executes dropped EXE 11 IoCs

pid	Process
1796	SystemTrayHelper.exe
3436	SystemTrayHelper.exe
1252	SecurityCore.exe
2808	SecurityCore.exe
4520	NetworkHelper.exe
2568	NetworkHelper.exe
3632	CoreSystem.exe
2740	CoreSystem.exe
1120	NetworkHelper.exe
2668	NetworkHelper.exe
612	SecurityCore.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\NetworkHelper.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SystemTrayHelper.exe\""	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\NetworkHelper.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\CoreSystem.exe\""	NetworkHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
15	raw.githubusercontent.com
28	raw.githubusercontent.com
41	raw.githubusercontent.com
53	raw.githubusercontent.com
60	raw.githubusercontent.com
74	raw.githubusercontent.com
84	raw.githubusercontent.com

Custom signature

Detect suspicious telegram bot 6 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c50f-27.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c510-102.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c513-138.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c515-173.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c516-210.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af1-246.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4136	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4136	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4136	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4136	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4136	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4136	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4136	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
4136	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
1796	SystemTrayHelper.exe
1796	SystemTrayHelper.exe
1796	SystemTrayHelper.exe
1796	SystemTrayHelper.exe
1796	SystemTrayHelper.exe
1796	SystemTrayHelper.exe
1796	SystemTrayHelper.exe
1796	SystemTrayHelper.exe
1796	SystemTrayHelper.exe
1796	SystemTrayHelper.exe
1252	SecurityCore.exe
1252	SecurityCore.exe
2808	SecurityCore.exe
2808	SecurityCore.exe
2808	SecurityCore.exe
2808	SecurityCore.exe
1252	SecurityCore.exe
1252	SecurityCore.exe
1252	SecurityCore.exe
1252	SecurityCore.exe
1252	SecurityCore.exe
1252	SecurityCore.exe
4520	NetworkHelper.exe
4520	NetworkHelper.exe
2568	NetworkHelper.exe
2568	NetworkHelper.exe
2568	NetworkHelper.exe
2568	NetworkHelper.exe
4520	NetworkHelper.exe
4520	NetworkHelper.exe
4520	NetworkHelper.exe
4520	NetworkHelper.exe
4520	NetworkHelper.exe
4520	NetworkHelper.exe
2740	CoreSystem.exe
2740	CoreSystem.exe
2740	CoreSystem.exe
2740	CoreSystem.exe
3632	CoreSystem.exe
3632	CoreSystem.exe
3632	CoreSystem.exe
3632	CoreSystem.exe
3632	CoreSystem.exe
3632	CoreSystem.exe
3632	CoreSystem.exe
3632	CoreSystem.exe
1120	NetworkHelper.exe
1120	NetworkHelper.exe
2668	NetworkHelper.exe
2668	NetworkHelper.exe
2668	NetworkHelper.exe
2668	NetworkHelper.exe
1120	NetworkHelper.exe
1120	NetworkHelper.exe
1120	NetworkHelper.exe
1120	NetworkHelper.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3436	4136	6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe	91
PID 1796 wrote to memory of 2808	1796	SystemTrayHelper.exe	93
PID 1252 wrote to memory of 2568	1252	SecurityCore.exe	98
PID 4520 wrote to memory of 2740	4520	NetworkHelper.exe	100
PID 3632 wrote to memory of 2668	3632	CoreSystem.exe	104
PID 1120 wrote to memory of 612	1120	NetworkHelper.exe	105

C:\Users\Admin\AppData\Local\Temp\6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe
"C:\Users\Admin\AppData\Local\Temp\6c006b52c8fb047c282cc3d49f12dbb4b883db36ea31940c568fdd9079b591ba.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3436

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2808

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2568

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09A184963DB18218E7969055927ED546
Size 280B
SHA256 d715bcb4b19603107a525ed1f402809d9884464f985e6fadb258be7065db3610
MD5 0b22d6d944fcc7a7083bbba21522574c
SHA1 d55dd42499ae4671c74de7d9086b3137da7b10df
SHA512 42d7531e7f9b19bce718d65cfdb1cbd3db79d7b98a299d47c5226428a323400082d02325f2b0b5a967edc5ac2fa22e557bd2cb742dc7c0b9ad6694909b297e3e
TLSH
T137D02B0E99F579437D23C6109594D526701314741BE0A228AC24C32AB825D3F1F25120
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 311B
SHA256 58d1fcf9271a586bfbfae53b7c3ff43bba20dcdcd44f08a483a57025b4ba6827
MD5 d6037eeb7409b26c7c641f29bb8efc40
SHA1 646146d85aab585ba4289adbf05e1d2263df693d
SHA512 bbaa440b984682032a8ff249cc7bcd5b190a5661ef3d36f66ae3f864586ae9b0a745878cf4d8117a5b8039efc094a24a0a0d71199f78e813cefa0f79d34cd8a1
TLSH
T1FEE07D22E73C99C47221992C0F66406D7890011D89A4495679385BC54D463BB840B01E
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 3ad2ab88c78173824f34c3a8f78799a983e7907c17a767cefe92ec736b0017af
MD5 6a0ff8a73931feb880e25718580f7475
SHA1 ed3109729892632f8fc408733f0bc5f844cca891
SHA512 b75bac4bd8c5df6817f78a1fccd7ed97e2047ce4bc85622e09915298c09bd8354bf3992fae05e9ea7b8aa5b4cffcc3e90d6a3463aebd1ea8852fe987973c2dc7
TLSH
T1B441D8DAEA5C3064BF869F40593CCB362C78B291A688645571FFC8F230D6BE42D1A85C
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 236KB
SHA256 71cbb8ca30c0c1beee1cdb72d80628a53cd8ce678e7c013b92a424c5ef9b9a21
MD5 0b2c87aa936c1e236a0b8e97a5746137
SHA1 b39ff23b6618b1d7aa62a4192cccff5832d98b05
SHA512 8c8524b6e2307bfd0a9077f6b65de53879001e20ccd4d95b53e92681208038cb534939297de00b13f5762d40654bf19e392804c628383f8e460ed50f94e8ffbc
SSDEEP 3072:D7MKLRCV+6E3+bCtYuiRGTVzDZaJuJ1sGONRjBm1CI8S2as2O05ak:D7MKLM+f7+2zDZwU1m9m1j7Bsm
TLSH
T15B34EE589DB7F0665E8A9D618CD79E8E47F031DB2342621B4EA35FD01C17BDB8E6208C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 eb5d684d6c9c1fc72b425047f74e1d6ad36b190cc81f6cbfbd044bcacb132fb4
MD5 4f4bfbb0768dd4b6571c76bdb9d2da30
SHA1 50284555eecb59c80a8d5559160748c6c5d986aa
SHA512 e18e5f694cd0117533c32351fcf24415ea7135fc7caecc7561b03f0442f3e8255d02be82aecd3fb8c58a8b6020883a20f12c21c6d912ccea501a557416a56127
TLSH
T1FE1154C2DFE8F1819AE257B1CAE8D5267CB464D52DEA70C16C90C8D2349A75E3B0903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 3f13e844dec517f1b5ee52ea4bacb23645885531067da7597df44918b2655152
MD5 8b154fa94733b466b201660bbeb080b9
SHA1 f9a19fdad45c39998a381f630b4b10f23dadd918
SHA512 c0e15be1563d305e47820f6ca8b905115b447041ad4f45c2d92870c7203881826dcc6fa7d5e0e680f4162e74a7fad53b6f201184bcf95f8f0d67e3292891a418
TLSH
T15541F8DB9F4D7878EF42CF8B2DB6C47A2D78847490810885B5B7C9C221EEBA6690945C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09A184963DB18218E7969055927ED546
Size 484B
SHA256 c0e9a5b791a8c0955623804b4e7e858b4e102d1adb71212ce842599ed431f521
MD5 06315a2f5a48f198ddf8656e93795f10
SHA1 1aaaacfe3d482cb2b5847c7a3e22cfbaaf86aad6
SHA512 4c2812b4b6f288d412e79bb80ed8fdda7f4d06c4875f0d0a04d7a867945312c797344449cd262c5f3620f2ff492bd65e500e4ee8f076363090bf2bd88c3f7c1f
TLSH
T1A8F0AB2415BD421AE436E83882E57D75AC1EF6153B089BEB17620605AF61E500ED152E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 6cb940efb6069c808b5552a0e9c4a545b1254416a01712f4e2d4c7a99648385d
MD5 6c98b314947bcc79fd3fa9af230a2479
SHA1 2f7e0c1d63a41482310233867e1721f68ca60eb8
SHA512 e87dd1b24026d1d15150f8b1de90a6247c5ac85bd8eab1ed0d1ce30f86934d70c6890624eca27b3867cf05438c394bdc6618920a6f3c88f0ef810613df9485cd
TLSH
T12CC08C1C1AA24A06F2A8837C03D13D439B20C502E241CF061AF12A08C99AF163938C2E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 91528738e41d18cd85b16987a3287ffd4d2389f2bcf25badd78d1cb5e1d0bf19
MD5 cba768cdbfb6939b1c459505fdcf394f
SHA1 37171c4e45573a91cca684ef31c089a535fca6f5
SHA512 7215ecb26f027b8cedee88ebad1652282bddd0896d584056edfe701b714f2dd17b326c1541c94b78981b0c1b73f6a5bff96ff263710779eb082c4736a233c800
TLSH
T1A2F05C2D13FC847DE173DBB8CED567D5A819F237340842D816D3474C9A02B017C6162C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 e210b799dc2b40e112a1e73d388282490efef5713a6a392638ebcdad2902d634
MD5 fa85366e130bcc9625108ece130a784d
SHA1 d3e62995467ccf09c6597a7cd14e96d015fb0088
SHA512 9f2609dcac7848c54a8e1660c273997e2e38405c7abc7137b1947dc219bc823182d3f3ef9a9097dbb6d0d74d5459cb136b15c932b45dcbc0a03e653847dd9470
TLSH
T196F061543DFA613BF276F938C3C530710C37A317600659BA16B043086926E112C61526
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 b8ff75f3596c982c9228d131af7880208d80896d1866b734d6b1e08333e6164f
MD5 4f5e72fd5d761bfcf2ba93eec74b02ee
SHA1 c5e7bf7310a782ddf534b4f1f2f023e5b3773a5a
SHA512 b0f1660526b3948fb7ef0ecc8f29cc2e812045acd7e49c248e0e3d7971d6cb8efc140a3556c22e62697dde47412731522ecfd33872ed20d0aadf57f3a8d92ac8
TLSH
T1A3D0223927450E30F133937AD8B60B435984A307B583AB0F2B7B522C803CE6508B0C1D
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 a9aa9506cff47bf9059ba76172796db9864af0c043729b5a80174d04a1ed8dc9
MD5 07b2b6bbc07d96dabd0d868e9e024cbf
SHA1 2b5cdef768e4adf2dad893886d2f580c4165045b
SHA512 e879b90eaee23249b050c60566c020bd63b73f16546ca9f120d8e33eb8085ec1d7cbb46cf373f3943f0bb3e4adf6e242f65b163f1dfa33f5b371204dc87ebf76
TLSH
T163F0A31416D7502EF771627581F5539EED16F3563401D4661797534DFD13E801D1153C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 651c2392c960e4e535c5525bfee2885a121fa1778ca2d67a340cd6cb45af3638
MD5 f600be5a9024924ff8893dfa9c58ba86
SHA1 d21bb732b6add697abd4df0a30dbe2d297be75ef
SHA512 641a0ecc9606993f238cbdc2c52d019f7ac5a25a6215ddd8798e56f59727441dac36caab6cb2eb670ab1d331d5b04c8ad1d03cdd9af4c0f34a559921ed942e7a
TLSH
T185F0AB7528F7112EF3A2DA7C02C552D60662E13733053B69277182095E0AB00AA30D25
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 276a86f3cc9d0eef08fe0527884f9dc80d50699b2d588653b1020f2f16f7cd7a
MD5 e92b88646651e9a09f4865b68cc285b9
SHA1 bee3908d9729c5a04e60660ad0d6d9bd8b107dc1
SHA512 f22c7742b3f024cd02a0371ce979d5c00ed5f57a84f417300e3195e8d7f4a79516ae84c24612a4859629e2b6c7e6b608ad1e819a8d3228b51b2aa2fdb1dcbb34
TLSH
T1D3C08C1C07610607F2A893BC02C22D838A208210F3819F0226B62A08CD28F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
Size 4.1MB
SHA256 82839ea0419b4ebfd3b119a08bc3f9f7b781c127848fb47dafb982a90ac07329
MD5 5973a04bc3c62b322930edac833edb2f
SHA1 390f368f1932877d7697ad1a4638527b8e5b3d69
SHA512 e06ba7649cc4afd2dc096b3216809c0413d1476379192fbbba7e54a1e237dac3e2983da8b247e62e23d5bb68f40f077b4c1d0755dec5fdbfc6dd2fecf23f5dec
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbv/WHLrqy:Nafo9SWA6NnPAuzOpVWHt8bc3Z
TLSH
T1C51623E1686E2AEBC05A4CBD8E1A9E2270EC5B71D7504C97FFC53DF60950C921B63836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 4.3MB
SHA256 9a5e396d9ec1c31eb1228af6ff31a5e9ab6b0b4b2c730bc58debf29618e9db62
MD5 292a36a370288b6db05b48112cdcaa89
SHA1 6ee70c0220abbf560f453c3d2c81346f908eed3c
SHA512 a9e064dda7779cf805d9e4066f6fcf836b897f0037f21f1584ebfb819ff1aff30a5e9fc1ec849acfb59cb991849f04340253ae0d892f31d818f56675d069c920
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbv/WHLrqN:Nafo9SWA6NnPAuzOpVWHt8bc3Y
TLSH
T1342623E168AE2AEBC05A4CBD891A9E2270EC5B71D3544C97FFC53DF60951C831B63836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 3.8MB
SHA256 487850cce5e8a69414c80dace1057a0b55875b69c128cb044ac04f45d682dc01
MD5 fd0e34113469400096e7f78350f5d11f
SHA1 50994dfec254934f1be1bd271f2ed062a30cc59d
SHA512 f1c4954458836a6d9775eb3a11c4602e6d2965a432af43227c2147f3cf0aede3d2d9cb4c4efa0ae2d2f3796cc3b0be0cbf26ade1cfa65ca34f282def9354a64b
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbv/WHLa:Nafo9SWA6NnPAuzOpVWHt8bcO
TLSH
T1C60622E168AE2AABC05A5CBD8E169E2270EC5B71D3504C97FFC53DF60950C821B63936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe
Size 4.2MB
SHA256 3d4bf87addfae2e81d524a64c52053a9bbbb914d0da72bd4846bdf31e10a042e
MD5 4d2b7625ee0895860145318b99d573de
SHA1 7db8d3f3187d3caff213bc44d676cc5b8ed71652
SHA512 a133760c50e09cbebe3a766a80c00bcd2c7b96db261314f36fb56c42b6213e040123e2c2cbd36b45f9e0f926f095229335585e1a0d5a7675550918250dba999a
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbv/WHLrqB:Nafo9SWA6NnPAuzOpVWHt8bc3I
TLSH
T1321623E168AE2AEBC05A5CBD8D1A9E2270EC5B7193144C97FFC53DF60951CD21B63832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SystemTrayHelper.exe
Size 3.7MB
SHA256 13d3326e95426b22d6970db6f6ed2479218ede0d523aaca9fabfaf7e5199c861
MD5 ec46072f260d7871eff83b91bc653ecb
SHA1 56946151b9393a81b248928a3f13a9bf81852f41
SHA512 dfa3d6f13512fb4f6d5000bd8092a120766380d3b33c523cab3d93df88dab5edef302c4b0aa7f6c6ea8dd0499b7a2643cb3babd4bf0f5f181435690a14d6995f
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbv/v:Nafo9SWA6NnPAuzOpVWHt8b/
TLSH
T1C20622E5686E2AEBC05A4CBD8E169E2270EC5BB1D3504C97FFC53DF60950C821B63936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\NetworkHelper.exe
Size 3.9MB
SHA256 e0a0beace299ab2b74b883779586ab406e51e48d567d75d0d2a65ef67c5b4ef9
MD5 366b4388722cd79826123796caeae8a2
SHA1 e563f3c52dae9b8a92e7b91178361493a0c8faac
SHA512 c0865598154570012f3aa15b861dac9082cd4714d640063b35bb7abf8516a9426f26dcde6f06c45eb960b6eb3e16e49dae9c1c1e636683e3c56d0f4b2dd4b610
SSDEEP 98304:N90fo9S546RoO6NX3o2fYuzm4UZrVWkkU2flmFbv/WHLrL:Nafo9SWA6NnPAuzOpVWHt8bc3L
TLSH
T1FC1623E1686E2AEBC05A5CBD8E1A9E2270EC5B71D3504C97FFC53DF60950C821B63936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download