e04c2e885c67bad3918e89e313f298a53ee6c772db0ac4b6a723d8da4eabaa72

Analysis

max time kernel
98s
max time network
114s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28-04-2023 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

957639998125a31c998b0104dba7f463d0659716a0a5b62fcc82eb28a0c0477b.msi
Size

270.5MB
MD5

522c0b0d445c62cdeb0a80bcce645d57
SHA1

5dad52c67d114f7a3a5a1e7ae5b15b581054d468
SHA256

957639998125a31c998b0104dba7f463d0659716a0a5b62fcc82eb28a0c0477b
SHA512

97da31389ca0986c5f63244573ad0edd6c83feb7e9c44557acfb51832db308c6165cdd390d1555ee8dec941cc0cb896fa1ccc59cbf7b9de9610003f0bd2e8a48
SSDEEP

6291456:FTUNwNgD8hhlK4sCC90uWHgnNfTSeHRAod2da0Dmq75UpY21DYJ5HI:1UN5DqKnCULtnlnAM2kE5Gco

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	2012	msiexec.exe
4	2012	msiexec.exe
6	828	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1964	CitrixWorkspaceApp.exe
1092	TrolleyExpress.exe

Loads dropped DLL 8 IoCs

pid	Process
1964	CitrixWorkspaceApp.exe
1964	CitrixWorkspaceApp.exe
1964	CitrixWorkspaceApp.exe
1964	CitrixWorkspaceApp.exe
1092	TrolleyExpress.exe
1092	TrolleyExpress.exe
1092	TrolleyExpress.exe
1092	TrolleyExpress.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	TrolleyExpress.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Citrix\Logs\CTXReceiverInstallLogs-20230428-123033\TrolleyExpress-20230428-123033.log	TrolleyExpress.exe
File created	C:\Program Files (x86)\Citrix\ClientID.txt	TrolleyExpress.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Installer\6cb34a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\6cb349.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6cb349.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7DE.tmp	msiexec.exe
File created	C:\Windows\Installer\6cb34c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6cb34a.ipi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	TrolleyExpress.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
828	msiexec.exe
828	msiexec.exe
1700	powershell.exe
1700	powershell.exe
1964	CitrixWorkspaceApp.exe
1092	TrolleyExpress.exe
1092	TrolleyExpress.exe
1092	TrolleyExpress.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2012	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	828	msiexec.exe
Token: SeTakeOwnershipPrivilege	828	msiexec.exe
Token: SeSecurityPrivilege	828	msiexec.exe
Token: SeCreateTokenPrivilege	2012	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2012	msiexec.exe
Token: SeLockMemoryPrivilege	2012	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2012	msiexec.exe
Token: SeMachineAccountPrivilege	2012	msiexec.exe
Token: SeTcbPrivilege	2012	msiexec.exe
Token: SeSecurityPrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeLoadDriverPrivilege	2012	msiexec.exe
Token: SeSystemProfilePrivilege	2012	msiexec.exe
Token: SeSystemtimePrivilege	2012	msiexec.exe
Token: SeProfSingleProcessPrivilege	2012	msiexec.exe
Token: SeIncBasePriorityPrivilege	2012	msiexec.exe
Token: SeCreatePagefilePrivilege	2012	msiexec.exe
Token: SeCreatePermanentPrivilege	2012	msiexec.exe
Token: SeBackupPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeShutdownPrivilege	2012	msiexec.exe
Token: SeDebugPrivilege	2012	msiexec.exe
Token: SeAuditPrivilege	2012	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2012	msiexec.exe
Token: SeChangeNotifyPrivilege	2012	msiexec.exe
Token: SeRemoteShutdownPrivilege	2012	msiexec.exe
Token: SeUndockPrivilege	2012	msiexec.exe
Token: SeSyncAgentPrivilege	2012	msiexec.exe
Token: SeEnableDelegationPrivilege	2012	msiexec.exe
Token: SeManageVolumePrivilege	2012	msiexec.exe
Token: SeImpersonatePrivilege	2012	msiexec.exe
Token: SeCreateGlobalPrivilege	2012	msiexec.exe
Token: SeBackupPrivilege	1548	vssvc.exe
Token: SeRestorePrivilege	1548	vssvc.exe
Token: SeAuditPrivilege	1548	vssvc.exe
Token: SeBackupPrivilege	828	msiexec.exe
Token: SeRestorePrivilege	828	msiexec.exe
Token: SeRestorePrivilege	584	DrvInst.exe
Token: SeRestorePrivilege	584	DrvInst.exe
Token: SeRestorePrivilege	584	DrvInst.exe
Token: SeRestorePrivilege	584	DrvInst.exe
Token: SeRestorePrivilege	584	DrvInst.exe
Token: SeRestorePrivilege	584	DrvInst.exe
Token: SeRestorePrivilege	584	DrvInst.exe
Token: SeLoadDriverPrivilege	584	DrvInst.exe
Token: SeLoadDriverPrivilege	584	DrvInst.exe
Token: SeLoadDriverPrivilege	584	DrvInst.exe
Token: SeRestorePrivilege	828	msiexec.exe
Token: SeTakeOwnershipPrivilege	828	msiexec.exe
Token: SeRestorePrivilege	828	msiexec.exe
Token: SeTakeOwnershipPrivilege	828	msiexec.exe
Token: SeRestorePrivilege	828	msiexec.exe
Token: SeTakeOwnershipPrivilege	828	msiexec.exe
Token: SeRestorePrivilege	828	msiexec.exe
Token: SeTakeOwnershipPrivilege	828	msiexec.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeRestorePrivilege	828	msiexec.exe
Token: SeTakeOwnershipPrivilege	828	msiexec.exe
Token: SeRestorePrivilege	828	msiexec.exe
Token: SeTakeOwnershipPrivilege	828	msiexec.exe
Token: SeRestorePrivilege	828	msiexec.exe
Token: SeTakeOwnershipPrivilege	828	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2012	msiexec.exe
2012	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1092	TrolleyExpress.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1700	828	msiexec.exe	33
PID 828 wrote to memory of 1700	828	msiexec.exe	33
PID 828 wrote to memory of 1700	828	msiexec.exe	33
PID 828 wrote to memory of 1964	828	msiexec.exe	34
PID 828 wrote to memory of 1964	828	msiexec.exe	34
PID 828 wrote to memory of 1964	828	msiexec.exe	34
PID 828 wrote to memory of 1964	828	msiexec.exe	34
PID 1700 wrote to memory of 980	1700	powershell.exe	35
PID 1700 wrote to memory of 980	1700	powershell.exe	35
PID 1700 wrote to memory of 980	1700	powershell.exe	35
PID 980 wrote to memory of 1732	980	csc.exe	36
PID 980 wrote to memory of 1732	980	csc.exe	36
PID 980 wrote to memory of 1732	980	csc.exe	36
PID 1964 wrote to memory of 1092	1964	CitrixWorkspaceApp.exe	37
PID 1964 wrote to memory of 1092	1964	CitrixWorkspaceApp.exe	37
PID 1964 wrote to memory of 1092	1964	CitrixWorkspaceApp.exe	37
PID 1964 wrote to memory of 1092	1964	CitrixWorkspaceApp.exe	37
PID 1964 wrote to memory of 1092	1964	CitrixWorkspaceApp.exe	37
PID 1964 wrote to memory of 1092	1964	CitrixWorkspaceApp.exe	37
PID 1964 wrote to memory of 1092	1964	CitrixWorkspaceApp.exe	37

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\957639998125a31c998b0104dba7f463d0659716a0a5b62fcc82eb28a0c0477b.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2012

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\citr.ps1"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wfelbctp.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA39.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFA28.tmp"
      4⤵
      PID:1732
- C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\CitrixWorkspaceApp.exe
  "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\CitrixWorkspaceApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\TrolleyExpress.exe
    "C:\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\TrolleyExpress.exe" "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\CitrixWorkspaceApp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003CC" "000000000000048C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6cb34b.rbs

Filesize
7KB

MD5
9067715b9036cb46cf8911d7d066461c

SHA1
68f926010aa0b78b31d16dfb2b480caab32f6df8

SHA256
7c37c9573faf69939a9a5cfb131f5f52138c48bb171c5a978a7ab968fddd9309

SHA512
6a6ef65f6e266139e706b6aedd282b3bce6e67450fa29af41aa72559f4926dfb13837ad6065e0b2f97583f0a10c151675c3206ad13736f75a687f9e7a6dbae1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Filesize
1KB

MD5
e94fb54871208c00df70f708ac47085b

SHA1
4efc31460c619ecae59c1bce2c008036d94c84b8

SHA256
7b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df86

SHA512
2e15b76e16264abb9f5ef417752a1cbb75f29c11f96ac7d73793172bd0864db65f2d2b7be0f16bbbe686068f0c368815525f1e39db5a0d6ca3ab18be6923b898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42919c409227b1f45aff7a3d48bd416d

SHA1
d823e80a834aec9d3c328a958296e091da3c6434

SHA256
9711c6f91d84de1690c02397ec6aa0b72bb1611bdb54b58e99598b29d07d404d

SHA512
d211521ef8502f379fd9fc6370d6faf257876422aa4a1c8bd4fa573702eab4065a5fccb8941aca067c278510372c3e526f856d85567c50ab465ea13ba2cdc395

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

Filesize
264B

MD5
f8e925cab7cf2260853fc6c2507e2737

SHA1
8842f091ef79f1df727bfa9efc9bfeac1016f5f8

SHA256
b6e7d286fa3410661790049ca818ad27b2802ca0149f7e223c1e1c748c3ec6b8

SHA512
7a802a3c548fe7ebcc42c4befbcd305fb9c6773522e89bdc44024a2bd12b3b832496fe7021a9ff1491e9d4ec266388cf7e7296a8bbb659c32c5c0431ab4c04f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab33FF.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\AnalyticsInterface.dll

Filesize
994KB

MD5
4bff4cc33f8ab15c1ac720b6699865e2

SHA1
2696dd32299ef75fec43c4807b56a71c4c277af4

SHA256
be31bb68f16d8cc98f46e7257bc49f26ad79c0bb2103e3ceceddd4ca1ac4f590

SHA512
07d7b2fcd18da018b81c102495d37eaf1221f8d9829fe483b7523ef0d73e820b038a12f63e37f1a513bc7090cb55fdecddc1adbdbff020c1479967b3df000a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\CitrixBrandingHelper.dll

Filesize
2.0MB

MD5
9492de748b5febc6c13b766842bf0a08

SHA1
2766bf3beef833de76998455dc08d5867bfbe57a

SHA256
05b74d3260f319b746907a4e57fd0e66b1b9b2082ac802830022c642935b0509

SHA512
2c102153694d6118d19ef5db5e11effe0dce5e937e4010cc6ad87578ea68776ae41f45d7f3c771a47ebe0dec30b2bd36c2201b8597b60e4a90ad6d3d7b1fe341

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\Receiver.ico

Filesize
264KB

MD5
aa1d501f4eb554413e2bcc3a2cb8cde3

SHA1
14757a2d8dcc8da22abf4a9d14cb6cbcd071282f

SHA256
e45cad74493df15b604449e27b3932c01e345f16e19ab8767a6fa23d50707764

SHA512
b718de474018b4c8d0da83c531c917b513234a386ba2aec839369988768e78a1bad9773e100fe89496c3f87dd3b6a99211ad3c0d211e8b108a7a2a10951e4305

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\TrolleyExpress.exe

Filesize
5.9MB

MD5
b1fb983c2fbb56c5954cb32f63b81ebe

SHA1
dbea158f714d4a8ee525f9c8a3de0c859f9ea1fe

SHA256
d5388d1cec333cb1fe008f4226c341a4209b291b8264fd7f8f6c4196257702a9

SHA512
6ceeff10a02262a8367249eca3f1b57b247e10745e9ee2b265f1c119e15dbf4441cfc5941125fbb7833eb7a78da1a60465ab1f5addd4f22659987fb73190a122

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\TrolleyExpress.exe

Filesize
5.9MB

MD5
b1fb983c2fbb56c5954cb32f63b81ebe

SHA1
dbea158f714d4a8ee525f9c8a3de0c859f9ea1fe

SHA256
d5388d1cec333cb1fe008f4226c341a4209b291b8264fd7f8f6c4196257702a9

SHA512
6ceeff10a02262a8367249eca3f1b57b247e10745e9ee2b265f1c119e15dbf4441cfc5941125fbb7833eb7a78da1a60465ab1f5addd4f22659987fb73190a122

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\TrolleyExpressUI_en.dll

Filesize
3.1MB

MD5
748674a3f4fb964b774c9df13c10e145

SHA1
2e115ca53fabcab37ca12177042e2b89794ee787

SHA256
b2a7f96b3c6345b1815e018fdebf122439deda71d715779644fd661a39b370af

SHA512
24d4fe341957af2b50de33abbe7c3f2e7fc33ad1507079141f96ae990d35ce74c8640cff274f00e76e839b06ccfaedea30222c44047cd494c2f8f4c7ed46b884

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\UtilityCpp.dll

Filesize
48KB

MD5
6a159a4511565020a725cdb2ed22755c

SHA1
3ea8ac65b1787ce006df7f9158646aaaac236459

SHA256
0a320d86ccaa9a2f43f8cc7a503eb4121078a84607360c6c4e13e0ce62d805df

SHA512
a595b23d879e3bc3cc52379a20182736d02c6bb5568fbd3270ad629d0f2069e2f8068483f550fe8e0ba2727902d563a70ee6cdafccac552bddfd40e852cf3213

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\CitrixWorkspaceApp.exe

Filesize
269.4MB

MD5
9fc9236fd9fc3fede8a6b2c64965696b

SHA1
0b090e64f788cd5ebf1a5afdd402d533facf2415

SHA256
046fc29661664bbc1e8c560c76bca11ef2386b0537ebb4369799f92e81e05dc2

SHA512
7d1b435a7d57c91ad766f8cca55545c7f2decf13427bbbaf21eb23ae498791ca469a1739419b1c8e4774e1c0b700b8257ef57ef14bd6f95db22eb63c3ef24d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\citr.ps1

Filesize
2.2MB

MD5
6f255f7dfc19b858d78285ea03ec8f1e

SHA1
4e03cfe945f403360d560f402cfeec8a4da51017

SHA256
23fab0dc1bdc6e0cfa3e3365b286d03382c495e7a5ccc9f9a5a01bbf86bc0b3a

SHA512
ec66c8ec98a9872dff89abfbe06057cc6dc9ce1199be021ef32201dcfe87e473cfe69c5db7fa61f6d09b19cef541af03344532833e37faeb2a3989c8bffd291a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFA39.tmp

Filesize
1KB

MD5
ffba87b4f3d6480f07f00a8bcee31c07

SHA1
ab3d3a6400ab422ee4cd7e77335dfffc01a32d28

SHA256
3bc93042faa5c6c8a36fc7c8c7167360779923032e10a3f26b04243459e9df5f

SHA512
1f72abd6ae44ef6812cd14b338136e4895d98f433c775e7b5d3c6798a10f1b99e991e1940dd889a8c6b9bb5ccc1c8522f96890f4f526aaad7da5ef0252da76af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3578.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\wfelbctp.dll

Filesize
3KB

MD5
1568691bf4494d60dc497e43ee950190

SHA1
e98a05f52052aba79f203798f1a61881e4e26af9

SHA256
2bd6cdfbe8c415a3dee42d177e99fcce8ade7828edd432acda4755c04007afc9

SHA512
3fd5708009f3db96ccba7d78d7465709f3740d80978b06268c36625aaf8ef85daaee8f74b9b4a92079cbc0d5ea2a023f23763a8cbbb4276cba271bf325163623

Download Submit
C:\Users\Admin\AppData\Local\Temp\wfelbctp.pdb

Filesize
7KB

MD5
68fdf8a654697d7b42defd1c849b7cc8

SHA1
908d52e075e021bcef0e531123428b3f38909100

SHA256
3e4eaf3e65a99369989407b294ca81d19787cfa18b5e45f5401479f5f5facc60

SHA512
af51e3a07a9d69fff78fd3b1b0c4d81544061d5ec58c55dac026c5e929b13dd3a1badd0325ab97e973713a6c9c7a52aed0d3151e6315d403af1e73b8be9ff341

Download Submit
C:\Windows\Installer\6cb349.msi

Filesize
270.5MB

MD5
522c0b0d445c62cdeb0a80bcce645d57

SHA1
5dad52c67d114f7a3a5a1e7ae5b15b581054d468

SHA256
957639998125a31c998b0104dba7f463d0659716a0a5b62fcc82eb28a0c0477b

SHA512
97da31389ca0986c5f63244573ad0edd6c83feb7e9c44557acfb51832db308c6165cdd390d1555ee8dec941cc0cb896fa1ccc59cbf7b9de9610003f0bd2e8a48

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCFA28.tmp

Filesize
652B

MD5
a024adb97ac776510b18c423ae8cd213

SHA1
57617d134bf7d287682f2d69fca8aa0ac67a3c92

SHA256
ef8f955927561d006c3e0ac8a745e2772101ee1e32f4515a29b5e06943ecbe25

SHA512
3bbd5e5b05237de4734ef1d66180bbc77a69be0908221f24180a81e871a1d1c8dbf64223acadab6fbff1b4a111f09385d9fc115ee9769633b0051e37a38e7dce

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wfelbctp.0.cs

Filesize
203B

MD5
b611be9282deb44eed731f72bcbb2b82

SHA1
cc1d606d853bbabd5fef87255356a0d54381c289

SHA256
ee09fdd61a05266e4e09f418fc6a452f1205d9f29afba6b8a1579333dc3ff3b6

SHA512
63b5ad7b65fd4866fb8841e4eee567e4f1e7888bb9fda8dd5c8dca3461d084d3f80ce920ae321609e4ff32ba13a55b7320282ce7201bb74a793d4700240360a4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wfelbctp.cmdline

Filesize
309B

MD5
4919cf79feef8c7b0ce8b454b18db2ce

SHA1
5b3505373f1c150d613832919dea4ca606956cb9

SHA256
db470a37cfeae162226c478274fea438601af1a1fee71f6ae476ac3a9c3be908

SHA512
c7c900ad07a081335597e3d2128f32f35ab89d3f48602e59ee6fc80633ed0cd1af7cf5b45c0da8381f461dfe62c977508d562ebbf801da727df3a50982ef4b7c

Download Submit
\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\AnalyticsInterface.dll

Filesize
994KB

MD5
4bff4cc33f8ab15c1ac720b6699865e2

SHA1
2696dd32299ef75fec43c4807b56a71c4c277af4

SHA256
be31bb68f16d8cc98f46e7257bc49f26ad79c0bb2103e3ceceddd4ca1ac4f590

SHA512
07d7b2fcd18da018b81c102495d37eaf1221f8d9829fe483b7523ef0d73e820b038a12f63e37f1a513bc7090cb55fdecddc1adbdbff020c1479967b3df000a87

Download Submit
\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\CitrixBrandingHelper.dll

Filesize
2.0MB

MD5
9492de748b5febc6c13b766842bf0a08

SHA1
2766bf3beef833de76998455dc08d5867bfbe57a

SHA256
05b74d3260f319b746907a4e57fd0e66b1b9b2082ac802830022c642935b0509

SHA512
2c102153694d6118d19ef5db5e11effe0dce5e937e4010cc6ad87578ea68776ae41f45d7f3c771a47ebe0dec30b2bd36c2201b8597b60e4a90ad6d3d7b1fe341

Download Submit
\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\TrolleyExpress.exe

Filesize
5.9MB

MD5
b1fb983c2fbb56c5954cb32f63b81ebe

SHA1
dbea158f714d4a8ee525f9c8a3de0c859f9ea1fe

SHA256
d5388d1cec333cb1fe008f4226c341a4209b291b8264fd7f8f6c4196257702a9

SHA512
6ceeff10a02262a8367249eca3f1b57b247e10745e9ee2b265f1c119e15dbf4441cfc5941125fbb7833eb7a78da1a60465ab1f5addd4f22659987fb73190a122

Download Submit
\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\TrolleyExpress.exe

Filesize
5.9MB

MD5
b1fb983c2fbb56c5954cb32f63b81ebe

SHA1
dbea158f714d4a8ee525f9c8a3de0c859f9ea1fe

SHA256
d5388d1cec333cb1fe008f4226c341a4209b291b8264fd7f8f6c4196257702a9

SHA512
6ceeff10a02262a8367249eca3f1b57b247e10745e9ee2b265f1c119e15dbf4441cfc5941125fbb7833eb7a78da1a60465ab1f5addd4f22659987fb73190a122

Download Submit
\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\TrolleyExpress.exe

Filesize
5.9MB

MD5
b1fb983c2fbb56c5954cb32f63b81ebe

SHA1
dbea158f714d4a8ee525f9c8a3de0c859f9ea1fe

SHA256
d5388d1cec333cb1fe008f4226c341a4209b291b8264fd7f8f6c4196257702a9

SHA512
6ceeff10a02262a8367249eca3f1b57b247e10745e9ee2b265f1c119e15dbf4441cfc5941125fbb7833eb7a78da1a60465ab1f5addd4f22659987fb73190a122

Download Submit
\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\TrolleyExpress.exe

Filesize
5.9MB

MD5
b1fb983c2fbb56c5954cb32f63b81ebe

SHA1
dbea158f714d4a8ee525f9c8a3de0c859f9ea1fe

SHA256
d5388d1cec333cb1fe008f4226c341a4209b291b8264fd7f8f6c4196257702a9

SHA512
6ceeff10a02262a8367249eca3f1b57b247e10745e9ee2b265f1c119e15dbf4441cfc5941125fbb7833eb7a78da1a60465ab1f5addd4f22659987fb73190a122

Download Submit
\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\TrolleyExpressUI_en.dll

Filesize
3.1MB

MD5
748674a3f4fb964b774c9df13c10e145

SHA1
2e115ca53fabcab37ca12177042e2b89794ee787

SHA256
b2a7f96b3c6345b1815e018fdebf122439deda71d715779644fd661a39b370af

SHA512
24d4fe341957af2b50de33abbe7c3f2e7fc33ad1507079141f96ae990d35ce74c8640cff274f00e76e839b06ccfaedea30222c44047cd494c2f8f4c7ed46b884

Download Submit
\Users\Admin\AppData\Local\Temp\Ctx-060D5D84-6239-43BF-863D-7F5355239D30\Extract\UtilityCpp.dll

Filesize
48KB

MD5
6a159a4511565020a725cdb2ed22755c

SHA1
3ea8ac65b1787ce006df7f9158646aaaac236459

SHA256
0a320d86ccaa9a2f43f8cc7a503eb4121078a84607360c6c4e13e0ce62d805df

SHA512
a595b23d879e3bc3cc52379a20182736d02c6bb5568fbd3270ad629d0f2069e2f8068483f550fe8e0ba2727902d563a70ee6cdafccac552bddfd40e852cf3213

Download Submit
memory/980-210-0x0000000000980000-0x0000000000A00000-memory.dmp

Filesize
512KB

Download
memory/1700-201-0x0000000002390000-0x0000000002410000-memory.dmp

Filesize
512KB

Download
memory/1700-199-0x0000000002390000-0x0000000002410000-memory.dmp

Filesize
512KB

Download
memory/1700-202-0x0000000002390000-0x0000000002410000-memory.dmp

Filesize
512KB

Download
memory/1700-200-0x0000000002390000-0x0000000002410000-memory.dmp

Filesize
512KB

Download
memory/1700-187-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

Filesize
32KB

Download
memory/1700-242-0x0000000002480000-0x0000000002488000-memory.dmp

Filesize
32KB

Download
memory/1700-186-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download