a5262b0c7f941f48acfb6ba722f2ce5f87269eb53e13ef33b94e7ddfeef691c3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe
Size

1.5MB
MD5

03c0233773e7a8b9c85238d83600ff4a
SHA1

e71d64f606c39360a284387eb306719058058dfc
SHA256

a5262b0c7f941f48acfb6ba722f2ce5f87269eb53e13ef33b94e7ddfeef691c3
SHA512

09f9fb91451815f0bfcc5b9d45f473e6dba8bce7dc66e713ca2c0b39ba3b09fce5b43e7fd7ed6564b3abee97292f74eb011d3c91071063e3019834e760332d1d
SSDEEP

49152:QWUMv5De9/yG9/ooooERQr0tb6H8RlOuQhRe4hvR:QWUMqyGB0Z6H8Rl4y0

Score

6^/10

bootkit persistence

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avast Software\Avast	icarus.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe

Executes dropped EXE 3 IoCs

pid	Process
2304	icarus.exe
2900	icarus_ui.exe
1676	icarus.exe

Loads dropped DLL 6 IoCs

pid	Process
1876	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe
2304	icarus.exe
2304	icarus.exe
2304	icarus.exe
2304	icarus.exe
1676	icarus.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus_ui.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "4DEC930631D6A523D3820D3CE1249367"	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "fb199cc1-5324-4516-aab6-cd6d784966ae"	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "4DEC930631D6A523D3820D3CE1249367"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "fb199cc1-5324-4516-aab6-cd6d784966ae"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAIsT8jOTV+keZhOEchKmQoAQAAAACAAAAAAAQZgAAAAEAACAAAACVpLE8l7+p7XLuz/J82ZD+3u4pBgQVV1PvHChootSCCQAAAAAOgAAAAAIAACAAAAA/8TYZKGRoGRvq4a8fY6HX+jsHU0M6mqYSAhT6FngkTzAAAABrO73oafte8gBh2tCF11UqU80Sui52c6J0/V0x+F5rPcjhgl8NK9+79rpYwWNENy9AAAAAJkFC8KryPIC6KXQ4DIMGHQDIfehuhhfbN29nINJgdDughgW2kmqp8QvKbKHoO/hd08MmofVgrRsYKHX43jxQOw=="	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "fb199cc1-5324-4516-aab6-cd6d784966ae"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "4DEC930631D6A523D3820D3CE1249367"	icarus.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2900	icarus_ui.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeRestorePrivilege	2304	icarus.exe
Token: SeTakeOwnershipPrivilege	2304	icarus.exe
Token: SeRestorePrivilege	2304	icarus.exe
Token: SeTakeOwnershipPrivilege	2304	icarus.exe
Token: SeRestorePrivilege	2304	icarus.exe
Token: SeTakeOwnershipPrivilege	2304	icarus.exe
Token: SeRestorePrivilege	2304	icarus.exe
Token: SeTakeOwnershipPrivilege	2304	icarus.exe
Token: SeDebugPrivilege	2304	icarus.exe
Token: SeDebugPrivilege	2900	icarus_ui.exe
Token: SeRestorePrivilege	1676	icarus.exe
Token: SeTakeOwnershipPrivilege	1676	icarus.exe
Token: SeRestorePrivilege	1676	icarus.exe
Token: SeTakeOwnershipPrivilege	1676	icarus.exe
Token: SeRestorePrivilege	1676	icarus.exe
Token: SeTakeOwnershipPrivilege	1676	icarus.exe
Token: SeRestorePrivilege	1676	icarus.exe
Token: SeTakeOwnershipPrivilege	1676	icarus.exe
Token: SeDebugPrivilege	1676	icarus.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1876	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe
2900	icarus_ui.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	icarus_ui.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2304	1876	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe	28
PID 1876 wrote to memory of 2304	1876	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe	28
PID 1876 wrote to memory of 2304	1876	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe	28
PID 1876 wrote to memory of 2304	1876	2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe	28
PID 2304 wrote to memory of 2900	2304	icarus.exe	29
PID 2304 wrote to memory of 2900	2304	icarus.exe	29
PID 2304 wrote to memory of 2900	2304	icarus.exe	29
PID 2304 wrote to memory of 1676	2304	icarus.exe	30
PID 2304 wrote to memory of 1676	2304	icarus.exe	30
PID 2304 wrote to memory of 1676	2304	icarus.exe	30

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-20_03c0233773e7a8b9c85238d83600ff4a_magniber.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\common\icarus.exe
  C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\icarus-info.xml /install /sssid:1876
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\common\icarus_ui.exe
    C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\common\icarus_ui.exe /sssid:1876 /er_master:master_ep_4ac9af95-dc80-4c46-a8b0-c6adcd2d4f7b /er_ui:ui_ep_5c4f1119-164d-4da1-98e3-350f67748e85
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2900
- - C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\avg-tu\icarus.exe
    C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\avg-tu\icarus.exe /sssid:1876 /er_master:master_ep_4ac9af95-dc80-4c46-a8b0-c6adcd2d4f7b /er_ui:ui_ep_5c4f1119-164d-4da1-98e3-350f67748e85 /er_slave:avg-tu_slave_ep_233eae82-6e6a-46dd-bfcf-6d8df28d7adb /slave:avg-tu
    3⤵
    - Checks for any installed AV software in registry
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AVG\Icarus\Logs\icarus.log

Filesize
44KB

MD5
05b842973ddc1f5a78a0bd070e520c83

SHA1
b4a9f1f0a0f8f9fa8d87c26434d026b446231d06

SHA256
0da66e51ef81723a20b5764cfa0156f492d3092f8964729d35f3fd9848697af2

SHA512
c335ca7cb99ad1f81a5f17d01d01412970869b5d8f0e555607f35e64237b22dcd98ee2f5b4527976d0a7b5788c6a7c5ed6cbec3ceb51a83355375310b893939c

Download Submit
C:\ProgramData\AVG\Icarus\Logs\sfx.log

Filesize
11KB

MD5
4b2589ae36bd021008a6fc303d8fa6d4

SHA1
491685f6e25f3bf35d6d68066541f588a9d1e439

SHA256
e4fec2b765eaae416d7d88592cb9772818a1e96a9dec384478c149f7d2884e49

SHA512
eb293d6ebc5ad85e9ee1714b3064179218e7f5d214958ea48d7dcf109e9ec84ccfa89777af454d74bbf7b70977d98edab38b7e6ecc00ec020e29e5c6109d38f5

Download Submit
C:\ProgramData\AVG\Icarus\Logs\sui.log

Filesize
12KB

MD5
6473f8b189ac0536914048ad04d855a0

SHA1
07e12ca8adc9ad3b740b58e2e3dbad9050b3186c

SHA256
af0e748998012211bad731bf8f048d0021253ce62087d1728d6a5a4dda7208d3

SHA512
c6a53352cb35166c3c980773b381dafad7dd62afa50f28d24fa661af471a22a1406a4fc91dee03986bcfb38d7aa52ca715fb9f2a046593749c1d0e9edef5f39c

Download Submit
C:\ProgramData\AVG\Icarus\settings\proxy.ini

Filesize
278B

MD5
b8853a8e6228549b5d3ad97752d173d4

SHA1
cd471a5d57e0946c19a694a6be8a3959cef30341

SHA256
8e511706c04e382e58153c274138e99a298e87e29e12548d39b7f3d3442878b9

SHA512
cf4edd9ee238c1e621501f91a4c3338ec0cb07ca2c2df00aa7c44d3db7c4f3798bc4137c11c15379d0c71fab1c5c61f19be32ba3fc39dc242313d0947461a787

Download Submit
C:\Users\Admin\AppData\Local\Temp\D566D7D7-DCD6-471C-8109-BE0AD33199E3

Filesize
64B

MD5
168f03c5c241049561d93853fa2304dc

SHA1
ee086aa5bc60436a75015003cb2dd27ae57620ff

SHA256
374d172fa5910a136fd3adba14744e6f740efc9dd62e34f870ea5698e349f60e

SHA512
169897b850ad3fa154452c34b87813f31723914110bf41e711c614e18b9850d036a2083cf908286a406d45db1c4a51f3b320792672b3287cfca08e756b5ee179

Download Submit
C:\Users\Admin\AppData\Local\Temp\F07D8C6A-04B6-4025-869C-70A788D7B5C0

Filesize
72B

MD5
3a111d9bd11e55eab1f3145ae7295821

SHA1
a2d640847aef5ee72a76dd5cde07f1e7fff13e18

SHA256
514a349057e44f9409f336c44679819d0d57329e94c135a75106ef44d1159dca

SHA512
7983f9c38ec2f17898300fe370924f25455ca29c5db2b1214351a379f30f93c629e7781caf0025797e52093abac560e061992378d44938ed133d715d91243c33

Download Submit
C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\avg-tu\config.def

Filesize
549B

MD5
d74cac8e23617717dcbac5d12be7e108

SHA1
573f84282e738e302b822eb9842500bf1b4b3b39

SHA256
a7f55316856c9eddb54a08fee7cd386aa07c27034c0ddd784cb0f4fc2fb0c55b

SHA512
b482cbeef3789d2c74e8035488aca68b33b395e1c561223a3c9a3cc5687a89cbbad88a84e4bdef8d1a55dfa831089075086362b02781726b55f260727af49052

Download Submit
C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\avg-tu\icarus_product.dll

Filesize
1.2MB

MD5
2f8931c51ebbe01d0c1d87d5ad2d652f

SHA1
a322fec62bbfe4d8b46199bc9001b4af74bbaf93

SHA256
add1dd3fb660dfb534317cb29e18a37e82f4e27000004ef29213914a6b6d5cfd

SHA512
2018cbf3179db624de67860370b80c46d8dbf59c9286e24c89e4edbf348720e38080aa1c5f8c6519593960057eb7fb3fa19b490bda5bc5fcafed2654dbb57890

Download Submit
C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\avg-tu\product-def.xml

Filesize
228KB

MD5
75fa646c45a8991f3b6978844588670e

SHA1
24cd6e97d367b481d173bac4fafc6e0b83f5537f

SHA256
6727dd70125f8c3b6f209b8bd08eef1c2b2be322e552720ccc986863d3c2eb11

SHA512
3e387b529ce28c6f7332637f57e973cea96a862012a40dc7f50a4e33e6258d67ac7bfce0005263de37633a47b689a10187d61a3202db1610fec4b9bab0e174a0

Download Submit
C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\common\bug_report.exe

Filesize
4.8MB

MD5
0c0f0ca2bb49dfa3743e9d4156007c70

SHA1
042fdfba346a89a83f0c782117038a82b29a28d1

SHA256
0e1865702916ae47aafc54c6199e3a73acb735ae888f9a8dd7bc4656268ef9ea

SHA512
e15f826ce67d4d5224cdcefc3194a5a9144e152ad16136f5774d2ca29484fc11e778e2e9d114af80ad2a99907bd4999e6eef95c7b7dbbe6a7829d67c1b6bbc92

Download Submit
C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\common\dump_process.exe

Filesize
3.4MB

MD5
c22d80d43019235520344972efec9ff2

SHA1
1a2b4b2a52d820f9233ca0201be9ee7f6d82adbc

SHA256
5841a3df4784e008b8f2c567f15bb28cdb4cb4ca35c750f1108dfb1ccb6011f0

SHA512
f1cadbc3077379a6d7e36b8cf3bc830f44b5e668d4a6c0ce6b62bde292498c4f41c6588c5eba2599aa67524acfd125b7f23c419ae2b4a8e4afea7708aad83edc

Download Submit
C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\common\icarus_ui.exe

Filesize
11.8MB

MD5
7ebae16a6ea514e55f7160c3539261cc

SHA1
ae74b3af4926b6932aea68a32c7c8727d53a94e7

SHA256
f27f92f003505dbca839513d233198211860de0ef487973a5ce0761d8e8ebfb9

SHA512
f7c7c084517785f21ae0bd82509ddc31e985edbe9e07f275414806afa3f696037340ea0e6091221a5d81250adf170ca0fa4345915d000eaba6034a9db0f61369

Download Submit
C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\common\product-info.xml

Filesize
6KB

MD5
ca24f226325bdc68559f6b406eb272a1

SHA1
b730d609ca398767f0a1eebe20aceae9cae82faf

SHA256
7c73d3d03aa3f302aeedf1abb83d5f82a87ca3c51fad7b1e70b7cf11abfca5dd

SHA512
aa3638faf1ee9d52384e32d09ecc1ae328c6ef66c96cf6eac5c537c8fc214cf64df6547e86a0ce5fc5d1af8620e7d16b9c70b813033ed99a874c1eab7208e372

Download Submit
C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\common\setupui.cont

Filesize
257KB

MD5
c95dc978812b51e1b9aa38c27faf3b1a

SHA1
70dee9e4f828652f6be927a193be6938bc175ce4

SHA256
4bafb54cd8637586dbfe316ea6e7f9f50010ff021f813128490d2a9c34a89bf0

SHA512
5202548902634ee28ce8fdab32f1fb8797881e3643b74d892da0155c3e90cbd98e837a85069c5bf1b06518e8355660486e63abefe41b2a484b4683f29fb1f0d0

Download Submit
C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\ecoo.edat

Filesize
21B

MD5
3a2ff5ed213d45609010fbe77af4ec60

SHA1
b535f9ef303729f4960b11b36d63c9f167ec8255

SHA256
fa8e405287ff833e6358bed301daa1cf3af4180d35a460ef279ef6233eb32d18

SHA512
b4adb5113080b48a727e78ccbcfe729efdfb698872b27c89044c64c455be1b2268d53e86dfaa09191f658213a89fec0ca48d99aeb7df6e0cd51c9c782798f78f

Download Submit
C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\eref.edat

Filesize
50B

MD5
1ad7d2ba9576699782fa98b5e3f56b53

SHA1
56bfc6c24a3771ccdaeea74752eea474c9cb0a36

SHA256
49d8afe968f3f48f995d7ad9168b509b417139ee4debfd38ae345c382146fd32

SHA512
4b063265c1787d3141c3dfb1bc00753f97983353ee95916be21553a9cde68cf348c3134de93c80f8b6f3b2a5efa06d9c2a92bbe2fe026c337c423931a15d0177

Download Submit
C:\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\icarus-info.xml

Filesize
1KB

MD5
e82d0502a7d8b32202332d337e033e3e

SHA1
07951d10580aadcc866cb49ccf5aee9934db2c3b

SHA256
2cfd764c4d2c195c3eed616c452f336b6f3ddd128586c51d62bdc55784cbec97

SHA512
6ba6e99402622add037ff0d5be0e4ccae2bb7ee25fd7c0744b467ca53b10ec69fa103ee038c43490a424eb127d70c0d13ecd71f1c959e1b4dd25d8d56962ad54

Download Submit
\Windows\Temp\asw-8a7f7503-4940-41a6-b448-17d0bb32aa9b\common\icarus.exe

Filesize
7.7MB

MD5
97856ab19be2842f985c899ccde7e312

SHA1
4b33ff3baeba3b61ee040b1d00ebff0531cc21ef

SHA256
2569a72d3a55ea7ad690d708907245c221664c5c88cadbc19e1967135fa40514

SHA512
b2f57fd7c482977ebf52b49e50e57f60f1bf87be5bbf54c0dcfb3038c0f46b89c70f10161fab7585d01b90c4fdc00b86932444f32528fed04b514c6746bff29f

Download Submit
memory/2900-79-0x000007FFFFF70000-0x000007FFFFF80000-memory.dmp

Filesize
64KB

Download