6e730445f480928385d507a3cfb776caba82e0097c4a754d427a1777dc649c98

Analysis

max time kernel
212s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27-01-2025 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tryhard - External.exe
Size

15.2MB
MD5

b032db979b409e9c010322709ccfa2ca
SHA1

ade674caa85fbce63b6226d100a3e1ca12b7abce
SHA256

6e730445f480928385d507a3cfb776caba82e0097c4a754d427a1777dc649c98
SHA512

9e62ceb443863659af0ba8334bd89138e0b557d67c4a9ff5c09a120dba2e3eae820b426122449fad70454296ec90889388dfb749dfe35f893cfc1a3b4c7bd016
SSDEEP

393216:znyYZteycGUMPXZ5MOD9dbH2urEUWjJjIfoo4jLxhI:zyiteycQZOOx1WdbJ8fUnxhI

Score

10^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 8 IoCs

pid	Process
2256	tryhard - external.exe
2676	tryhard - external.exe
1192	Process not Found
2032	icsys.icn.exe
316	explorer.exe
1652	spoolsv.exe
2140	svchost.exe
2176	spoolsv.exe

Loads dropped DLL 20 IoCs

pid	Process
324	Tryhard - External.exe
2256	tryhard - external.exe
2676	tryhard - external.exe
2676	tryhard - external.exe
2676	tryhard - external.exe
2676	tryhard - external.exe
2676	tryhard - external.exe
2676	tryhard - external.exe
2676	tryhard - external.exe
1192	Process not Found
324	Tryhard - External.exe
324	Tryhard - External.exe
2032	icsys.icn.exe
2032	icsys.icn.exe
316	explorer.exe
316	explorer.exe
1652	spoolsv.exe
1652	spoolsv.exe
2140	svchost.exe
2140	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001ad50-85.dat	upx
behavioral1/memory/2676-87-0x000007FEF6F30000-0x000007FEF75F5000-memory.dmp	upx

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tryhard - External.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2032	icsys.icn.exe
316	explorer.exe
316	explorer.exe
316	explorer.exe
316	explorer.exe
316	explorer.exe
2140	svchost.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
316	explorer.exe
2140	svchost.exe
2140	svchost.exe
316	explorer.exe
316	explorer.exe
2140	svchost.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
316	explorer.exe
2140	svchost.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe
2140	svchost.exe
316	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
316	explorer.exe
2140	svchost.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
324	Tryhard - External.exe
324	Tryhard - External.exe
2032	icsys.icn.exe
2032	icsys.icn.exe
316	explorer.exe
316	explorer.exe
1652	spoolsv.exe
1652	spoolsv.exe
2140	svchost.exe
2140	svchost.exe
2176	spoolsv.exe
2176	spoolsv.exe
316	explorer.exe
316	explorer.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 2256	324	Tryhard - External.exe	29
PID 324 wrote to memory of 2256	324	Tryhard - External.exe	29
PID 324 wrote to memory of 2256	324	Tryhard - External.exe	29
PID 324 wrote to memory of 2256	324	Tryhard - External.exe	29
PID 2256 wrote to memory of 2676	2256	tryhard - external.exe	30
PID 2256 wrote to memory of 2676	2256	tryhard - external.exe	30
PID 2256 wrote to memory of 2676	2256	tryhard - external.exe	30
PID 324 wrote to memory of 2032	324	Tryhard - External.exe	31
PID 324 wrote to memory of 2032	324	Tryhard - External.exe	31
PID 324 wrote to memory of 2032	324	Tryhard - External.exe	31
PID 324 wrote to memory of 2032	324	Tryhard - External.exe	31
PID 2032 wrote to memory of 316	2032	icsys.icn.exe	32
PID 2032 wrote to memory of 316	2032	icsys.icn.exe	32
PID 2032 wrote to memory of 316	2032	icsys.icn.exe	32
PID 2032 wrote to memory of 316	2032	icsys.icn.exe	32
PID 316 wrote to memory of 1652	316	explorer.exe	33
PID 316 wrote to memory of 1652	316	explorer.exe	33
PID 316 wrote to memory of 1652	316	explorer.exe	33
PID 316 wrote to memory of 1652	316	explorer.exe	33
PID 1652 wrote to memory of 2140	1652	spoolsv.exe	34
PID 1652 wrote to memory of 2140	1652	spoolsv.exe	34
PID 1652 wrote to memory of 2140	1652	spoolsv.exe	34
PID 1652 wrote to memory of 2140	1652	spoolsv.exe	34
PID 2140 wrote to memory of 2176	2140	svchost.exe	35
PID 2140 wrote to memory of 2176	2140	svchost.exe	35
PID 2140 wrote to memory of 2176	2140	svchost.exe	35
PID 2140 wrote to memory of 2176	2140	svchost.exe	35
PID 2140 wrote to memory of 1236	2140	svchost.exe	36
PID 2140 wrote to memory of 1236	2140	svchost.exe	36
PID 2140 wrote to memory of 1236	2140	svchost.exe	36
PID 2140 wrote to memory of 1236	2140	svchost.exe	36
PID 2140 wrote to memory of 2252	2140	svchost.exe	38
PID 2140 wrote to memory of 2252	2140	svchost.exe	38
PID 2140 wrote to memory of 2252	2140	svchost.exe	38
PID 2140 wrote to memory of 2252	2140	svchost.exe	38
PID 2140 wrote to memory of 1464	2140	svchost.exe	40
PID 2140 wrote to memory of 1464	2140	svchost.exe	40
PID 2140 wrote to memory of 1464	2140	svchost.exe	40
PID 2140 wrote to memory of 1464	2140	svchost.exe	40
PID 2140 wrote to memory of 2740	2140	svchost.exe	42
PID 2140 wrote to memory of 2740	2140	svchost.exe	42
PID 2140 wrote to memory of 2740	2140	svchost.exe	42
PID 2140 wrote to memory of 2740	2140	svchost.exe	42

C:\Users\Admin\AppData\Local\Temp\Tryhard - External.exe
"C:\Users\Admin\AppData\Local\Temp\Tryhard - External.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:324
- \??\c:\users\admin\appdata\local\temp\tryhard - external.exe
  "c:\users\admin\appdata\local\temp\tryhard - external.exe "
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2256
- - \??\c:\users\admin\appdata\local\temp\tryhard - external.exe
    "c:\users\admin\appdata\local\temp\tryhard - external.exe "
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2676
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2032
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visiblity of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:316
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1652
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2140
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Windows\SysWOW64\at.exe
        
        at 19:51 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1236
      - C:\Windows\SysWOW64\at.exe
        
        at 19:52 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
      - C:\Windows\SysWOW64\at.exe
        
        at 19:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
      - C:\Windows\SysWOW64\at.exe
        
        at 19:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI22562\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22562\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22562\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
724223109e49cb01d61d63a8be926b8f

SHA1
072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

SHA256
4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

SHA512
19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22562\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
517eb9e2cb671ae49f99173d7f7ce43f

SHA1
4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

SHA256
57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

SHA512
492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22562\python312.dll

Filesize
1.7MB

MD5
fb8bedf8440eb432c9f3587b8114abc0

SHA1
136bb4dd38a7f6cb3e2613910607131c97674f7c

SHA256
cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6

SHA512
b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22562\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
2a9a75881394cf3f5d3ddde34c19fe1c

SHA1
0255921cfa316a74e13eed0bb5cda3f45a77ceba

SHA256
0eea3b616221d0e3a89a5f54fbe208f18f27bd466f7035e449177a5bb2fa9378

SHA512
182a321cb9eecdcf4bdc389faa05cc18ffd2fa82aee0ce531a0fa525e60c8b99429e3dc9a89736252cc05b882de258f65ebbfc561dd9208a7194fbe8b60dfb9d

Download Submit
C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
207KB

MD5
03a09ed474f2fc96aa5a9760a49f18b2

SHA1
dc9be93b4d857791820f9ed01b37230df6664065

SHA256
c6248a08e69bf2d1ba7be25e574a5234460c6e0673fe6de88f22beb298c0e867

SHA512
3d20b6f5b80c54ce3634616250e1dd4534fd31890960acdb37e459ffd50d62a4a6d70699dab2e44fd3f297b5349ea1e3bfbfaab2f0b5ee06f58fcfdf9a7d74c3

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI22562\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
d12403ee11359259ba2b0706e5e5111c

SHA1
03cc7827a30fd1dee38665c0cc993b4b533ac138

SHA256
f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

SHA512
9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

Download Submit
\Users\Admin\AppData\Local\Temp\tryhard - external.exe

Filesize
15.0MB

MD5
9a734facf345e670da596dfafe58bd2b

SHA1
5da6d276f31aea758605321412c5a8aeaa31c9d3

SHA256
da93fb3f0ce8c6d5388607359db3388cd3448d5f291d984dd05a4ca851240a56

SHA512
66b3e76a28c15fcedab2b967476cfc32a4737ab598f6cf138346076bbb3154b3040b251a2e9f8372552fcd14732a0382472e9ec8212dc2dbc124545a8ab346d2

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
e387e3245b8270c962a7523eb8a0406d

SHA1
1931834a11565c29d347d1c16d8bf01dc47bc34b

SHA256
d9eb0356b0cabfc941b93106997e6f18ed2a62949251f1ad8c5e432ce897910f

SHA512
b95acf286ab48bc3745824e7953bc21bfabf0797bc55a8ce379dd14a38969bb1d76333b135ec53847fd9724abe3c85285676905575416501982f8fea5eb986ae

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
49bdf5ef97e93b4f258fb732084e70c6

SHA1
6a4fa73c081d4c0b4cdcacb784730208a731917f

SHA256
bcfb7650135e30c99188cca42fcb4b777771c6194ceabd22957ebae923d40fe2

SHA512
55e79b429489d7038bca0f6488d08ab60769279a92b6add6eccf53c13e7292eaffcdb77aada6bbd4b60e3f292994076dd785c9ad50f2a35f5e233e5cbe72a843

Download Submit
\Windows\system\svchost.exe

Filesize
206KB

MD5
a9a53f2aa98ecc890e90b8b31f6cc9ff

SHA1
e3e4e29c1eef88b39c371635e40b87de1c3dfaf6

SHA256
0458f661891d78ef1a79908c641cd5e263cc0fafd874be1679b66317bd391528

SHA512
c0a8e389f22825048ddb0aef162e1a17e40b5c64215713c8c5213c5e615d4f955f7f1a872b5e7f2fde73f4db8b79bf9137065d3352eb5f2d699fe388849cf8a3

Download Submit
memory/316-179-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download
memory/316-213-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/316-214-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download
memory/324-150-0x0000000002940000-0x0000000002980000-memory.dmp

Filesize
256KB

Download
memory/324-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/324-211-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1652-209-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1652-193-0x00000000004B0000-0x00000000004F0000-memory.dmp

Filesize
256KB

Download
memory/2032-210-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2032-165-0x00000000025B0000-0x00000000025F0000-memory.dmp

Filesize
256KB

Download
memory/2032-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2140-201-0x0000000002D90000-0x0000000002DD0000-memory.dmp

Filesize
256KB

Download
memory/2140-215-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2140-216-0x0000000002D90000-0x0000000002DD0000-memory.dmp

Filesize
256KB

Download
memory/2176-206-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2676-87-0x000007FEF6F30000-0x000007FEF75F5000-memory.dmp

Filesize
6.8MB

Download