hxxps://filebaseprotector[.]com/JXNjsy291OskMZJxnYYsax?a=0&u=152869&t=&tracker=4859406108312131520&m=155&f=155&source=1723920

Analysis

user interaction
yes
max time kernel
329s
max time network
334s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://filebaseprotector.com/JXNjsy291OskMZJxnYYsax?a=0&u=152869&t=&tracker=4859406108312131520&m=155&f=155&source=1723920
Sample261002-ghyfeazbmd

Score

8^/10

bootkit discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	252	chrome.exe

Uses Session Manager for persistence 2 TTPs 1 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000006900630061007200750073005f0072007600720074002e0065007800650000000000	icarus.exe

Executes dropped EXE 8 IoCs

pid	Process
1164	avast_one_free.exe
4192	avast_one_free.exe
4356	icarus.exe
2944	icarus.exe
5568	icarus_ui.exe
4864	icarus_ui.exe
4888	icarus.exe
1064	icarus.exe

Loads dropped DLL 4 IoCs

pid	Process
1164	avast_one_free.exe
4192	avast_one_free.exe
1064	icarus.exe
4888	icarus.exe

Checks for any installed AV software in registry 1 TTPs 6 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	icarus.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	icarus.exe
\??\F:\	icarus.exe

Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	avast_one_free.exe
File opened for modification	\??\PhysicalDrive0	avast_one_free.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\icarus_rvrt.exe	icarus.exe
File created	C:\Windows\system32\icarus_rvrt.exe	icarus.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-719.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\x86\aswProperty.dll.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-708.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-m-019.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_flag_id.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_simple_delete.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-224.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-285.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-040.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-407.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-697.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\Licenses\lexbor.txt.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-148.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-189.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-l-079.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\OobeUtil.exe.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\pdfix.exe.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_simple_diamond.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\RescueDisk\background.png.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-s-074.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\x86\local.crt\api-ms-win-crt-math-l1-1-0.dll.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\x86\local.crt\api-ms-win-crt-time-l1-1-0.dll.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\aswidpm.dll.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\privacyControl.js.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-s-033.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\locales\cs.pak.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\locales\pt-BR.pak.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\aswEngLdr.dll.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_flag_al.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_flag_to.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-189.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\ashShell.dll.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_detailed_product_secure_identity.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_simple_status_failed_filled.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-193.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-655.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-731.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-s-121.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-s-374.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-l-073.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\locale-fi.json.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_simple_device_phone.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\Inf\x64\aswArPot.sys.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-294.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-m-338.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-m-660.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\Licenses\libPNG.txt.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\task_performance_logger.dll.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_simple_chevron_right.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_simple_rescue.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_simple_vpn_protection.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-649.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-052.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-m-148.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-s-122.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-s-373.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-l-069.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_flag_de.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_flag_gu.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-697.svg.ipending.13f0e1c3.lzma	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\locale-hi.json.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_flag_cg.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-m-186.svg.ipending.13f0e1c3	icarus.exe
File created	C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\light\i-l-081.svg.ipending.13f0e1c3	icarus.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	avast_one_free.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	avast_one_free.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	avast_one_free.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	avast_one_free.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avast_one_free.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avast_one_free.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
252	chrome.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus_ui.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	avast_one_free.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "0EC03442A4E93B807782D73BF46C389D"	avast_one_free.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	avast_one_free.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAwKMmxR0whkaE32fhwWPNnQQAAAACAAAAAAAQZgAAAAEAACAAAAAMLHf5KKXeVZqzgeeu/o65JqzAefs11RQ+L0veoiGXOQAAAAAOgAAAAAIAACAAAAAQy/mdloGPx4Nnhisi828TFk3BR+ATXk0WFyydW4JP3IAAAADpVwYwrQTF9wprEpyfMZD3dQEK0JVgI9jdJ0j7KAU4CSWFntCngODrFTANktE0xwxWEXzejHE0fjLLNaaTaB2eTWp91THBlJ+44zZHY3iyCvl4DKN118ov/8svX/swOIIeK250nqTEcDq0eGOTpEP9zNpcZOJs2vkOlaj3jmsLF0AAAADgC0xs/bTv+pW3Xk/8uTBXlecF+eZZA1vIy1mv8us7Crs6E//PS+sQTbgJyYQtY2OwpMBRGgXO+Gv5eX3wKKzU"	avast_one_free.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "b4e7df88-04b0-466f-9b7f-91b01f15fb91"	avast_one_free.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5568	icarus_ui.exe
5568	icarus_ui.exe
4864	icarus_ui.exe
4864	icarus_ui.exe
3796	chrome.exe
3796	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe
Token: SeShutdownPrivilege	5752	chrome.exe
Token: SeCreatePagefilePrivilege	5752	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
4192	avast_one_free.exe
1164	avast_one_free.exe
5568	icarus_ui.exe
4864	icarus_ui.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe
5752	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2100	ShellHost.exe
5568	icarus_ui.exe
4864	icarus_ui.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5752 wrote to memory of 5392	5752	chrome.exe	88
PID 5752 wrote to memory of 52	5752	chrome.exe	90
PID 5752 wrote to memory of 52	5752	chrome.exe	90
PID 5752 wrote to memory of 252	5752	chrome.exe	91
PID 5752 wrote to memory of 5116	5752	chrome.exe	93
PID 5752 wrote to memory of 5116	5752	chrome.exe	93
PID 5752 wrote to memory of 1112	5752	chrome.exe	94
PID 5752 wrote to memory of 1112	5752	chrome.exe	94
PID 5752 wrote to memory of 5860	5752	chrome.exe	95
PID 5752 wrote to memory of 5860	5752	chrome.exe	95
PID 5752 wrote to memory of 2244	5752	chrome.exe	96
PID 5752 wrote to memory of 2668	5752	chrome.exe	98
PID 5752 wrote to memory of 5404	5752	chrome.exe	99
PID 5752 wrote to memory of 2668	5752	chrome.exe	98
PID 5752 wrote to memory of 5404	5752	chrome.exe	99
PID 5752 wrote to memory of 1988	5752	chrome.exe	103
PID 5752 wrote to memory of 6000	5752	chrome.exe	102
PID 5752 wrote to memory of 1988	5752	chrome.exe	103
PID 5752 wrote to memory of 6000	5752	chrome.exe	102
PID 5752 wrote to memory of 2404	5752	chrome.exe	104
PID 5752 wrote to memory of 1352	5752	chrome.exe	105
PID 5752 wrote to memory of 2404	5752	chrome.exe	104
PID 5752 wrote to memory of 1352	5752	chrome.exe	105
PID 5752 wrote to memory of 5320	5752	chrome.exe	107
PID 5752 wrote to memory of 5108	5752	chrome.exe	106
PID 5752 wrote to memory of 5320	5752	chrome.exe	107
PID 5752 wrote to memory of 5108	5752	chrome.exe	106
PID 5752 wrote to memory of 2448	5752	chrome.exe	109
PID 5752 wrote to memory of 1188	5752	chrome.exe	110
PID 5752 wrote to memory of 5380	5752	chrome.exe	111
PID 5752 wrote to memory of 1764	5752	chrome.exe	112
PID 5752 wrote to memory of 1764	5752	chrome.exe	112
PID 5752 wrote to memory of 2212	5752	chrome.exe	113
PID 5752 wrote to memory of 1164	5752	chrome.exe	126
PID 5752 wrote to memory of 4192	5752	chrome.exe	127
PID 4192 wrote to memory of 4356	4192	avast_one_free.exe	128
PID 1164 wrote to memory of 2944	1164	avast_one_free.exe	129
PID 4356 wrote to memory of 5568	4356	icarus.exe	130
PID 2944 wrote to memory of 4864	2944	icarus.exe	131
PID 5752 wrote to memory of 3796	5752	chrome.exe	132
PID 4356 wrote to memory of 4888	4356	icarus.exe	133
PID 4356 wrote to memory of 1064	4356	icarus.exe	134
PID 5752 wrote to memory of 4512	5752	chrome.exe	135
PID 5752 wrote to memory of 4512	5752	chrome.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://filebaseprotector.com/JXNjsy291OskMZJxnYYsax?a=0&u=152869&t=&tracker=4859406108312131520&m=155&f=155&source=1723920
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff7138c728,0x7fff7138c734,0x7fff7138c740
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,49355209877201047,1274873248069989446,262144 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:52
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,13829945674241690737,6903671019038230937,524288 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,6438821144539742147,8129233084961063846,524288 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,8674171651598123696,15164622821481325830,2097152 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,10669941701031866560,7854314269052048831,2097152 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,930767941311098980,16027379208114757068,524288 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5556,i,13848298214898674403,1910963876602433256,2097152 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5568,i,7078939424097254501,12279068486396329648,2097152 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5548,i,13496674571919258073,11638844202571538706,2097152 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4884,i,767240970428282633,2159398210044321685,2097152 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5600,i,12330174646563774435,18071444142804442803,2097152 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5736,i,2842760091304369354,5239111410908117131,2097152 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4780,i,15092066506315385268,12998303227064086821,2097152 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5464,i,3296745848007467517,15917868884021491402,2097152 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,8670364943265675376,16957446449501905026,524288 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:14
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3372,i,5642750976735865988,9960827094548442317,524288 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3212,i,11715856586192217554,802031868424372116,524288 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:14
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3336,i,9751381705346173008,7606114196538796696,2097152 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=788,i,13280402132649839428,13310032275650168549,524288 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=1128 /prefetch:14
  2⤵
  PID:2212
- C:\Users\Admin\Downloads\avast_one_free.exe
  "C:\Users\Admin\Downloads\avast_one_free.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\common\icarus.exe
    C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\icarus-info.xml /install /sssid:1164
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\common\icarus_ui.exe
      C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\common\icarus_ui.exe /sssid:1164 /er_master:master_ep_7afcea00-b363-417c-b654-76cc373e03a7 /er_ui:ui_ep_34aaac51-a444-436e-b7c4-e7a296b406e6
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4864
- C:\Users\Admin\Downloads\avast_one_free.exe
  "C:\Users\Admin\Downloads\avast_one_free.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\common\icarus.exe
    C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\icarus-info.xml /install /sssid:4192
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\common\icarus_ui.exe
      C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\common\icarus_ui.exe /sssid:4192 /er_master:master_ep_651a1068-37ab-4245-9ef8-92632f16c4fa /er_ui:ui_ep_c692aa36-2a83-4570-86c0-9f21b1a3de4c
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5568
  - - C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\avast-suite\icarus.exe
      C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\avast-suite\icarus.exe /sssid:4192 /er_master:master_ep_651a1068-37ab-4245-9ef8-92632f16c4fa /er_ui:ui_ep_c692aa36-2a83-4570-86c0-9f21b1a3de4c /er_slave:avast-suite_slave_ep_a17f3308-d756-46be-a07d-43c81c214739 /slave:avast-suite
      4⤵
      Uses Session Manager for persistence
      Executes dropped EXE
      Loads dropped DLL
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Drops file in System32 directory
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      PID:4888
  - - C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\avast-av-vps\icarus.exe
      C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\avast-av-vps\icarus.exe /sssid:4192 /er_master:master_ep_651a1068-37ab-4245-9ef8-92632f16c4fa /er_ui:ui_ep_c692aa36-2a83-4570-86c0-9f21b1a3de4c /er_slave:avast-av-vps_slave_ep_98e89e4a-7cd2-4d37-956c-4c2cbbf58943 /slave:avast-av-vps
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Writes to the Master Boot Record (MBR)
      Checks processor information in registry
      PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6136,i,12896115051975960234,14692566345816326941,262144 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,16366751655524879574,10653967034063257014,524288 --field-trial-handle=1908,i,10745516064106283568,16712754354317917697,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:4512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2224

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x0000000000000500
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:1156

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

event_manager.log

Path C:\ProgramData\Avast Software\Icarus\Logs\event_manager.log
Size 142B
SHA256 d869ace5bba0023c33790651af331b2d0bcd6739832befe312bda92d7e093e75
MD5 6c99c47fe65eec67b0f3f7b54bdbfc3d
SHA1 e55cb2cd9f5a634b26d549a2bc533d2af6e81d69
SHA512 4054a5284c75a427db4dfa14818d70edfb603dac85173f58dc5e7b2cd17c242bcdff37a8c5fc31540fa2d67f6218f8c6ca23ce97d3989adc5ff3fd4d506f694d
TLSH
T1B1C02B220C0D79F4801F0338F7A07D0914F4A1F21C1C8B0834CE9C0C3B5F40612C60D4
MD5 SHA1 SHA512 TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 17KB
SHA256 82d1ae137e1511f5cd281d3e2298de5feb923cd15ce7b855e402229187fc9796
MD5 830f1b77b09ff7778b2fa4e86c0caa45
SHA1 5e6321424735608afce920467fbedd784749d231
SHA512 520f11c0eda1b214ef27c3289122211b613227d976f1dbb0ae0690c4752c66d2130ac67b4b90e0396b18d516e99ba667faf4f16af3ce582f121916affa7eebda
SSDEEP 192:2nMpBb0K5xlcoQcoBfzhSPbd1lgnVDUnzEEFqkFFBT77BTRRBuD1Bu2rH3AINrBN:2nCuuzrgQ2dWD5DoNgcnZX5ug
TLSH
T12E826D159D6EB43759331F4C79887FDD81F663B52A38109CF2CCAE98176A80CA4DBB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 33KB
SHA256 42c4880f86176660c91afbb96c98d9b2991db73f4897cc1e41794745b956c574
MD5 8b4f63d07fe895ac2b3fe2311cc558e3
SHA1 8397168cadbc6730d3bc6a8763c777e9db45b136
SHA512 fbabd190bb5f6e44586d6a67214426a870b083f57d86cd09667baa1e7e9132b9da76f2c2e47658276f8717e1b4a32f2cc60ff8b88005643dd69766d5672224e3
SSDEEP 768:2nCuu3+QtiZX5uw3CeiKrC+miU//fDpdTN:EkkZX5N3NRrC+miU//Lt
TLSH
T139F2D2019E6EB43755331F4869847FC981F673B63A7C5058B2DCAE882B7B80DA4DFA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 168KB
SHA256 ee70599b26dc79e9308b83c3e9c4caeda5fc0bb9bed421684d376426af3a95f3
MD5 e79ae1daab3e6071e2333920c0fbd152
SHA1 38e931f86ac11d320edebf8d732317d7ac5037eb
SHA512 186aa99bc501118e8dfd1ab5bc3966775ac914be8dff9f0e5df90610d27b26f86a762f161ed9202cb32437a7e96c8bd73f4466966549ab718cd6db37935fc937
SSDEEP 3072:EkkZX5HRrC+miU/dEJf3YIw/y+KD+/JZ+zd899hvgu7b9x2NLmAnMDLvEPno64kh:DWj5V
TLSH
T122F3A8414D3EF1B656334749E588BF9586B1B3E63AAC44A872CCF60C377ED0428DEA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 1.3MB
SHA256 e404b10fdb6ab47cd6447d7d95328f3086489170e36f8cf3a25f12a9472caf68
MD5 7218f4efc597d0ca1f6b9f9d4380973b
SHA1 633cf8a5adeb4483f8975448e8816962542519af
SHA512 70fcb93951866eb020bfd3818992a9cb998efeddf2f3fc609b223dd1b731e65011e062cb7d1c056542d2c7b932479bb2efc0fc2a15a8d3fafc8b81af6de0c18e
SSDEEP 6144:DWj5Xx+90KGJai7XqbLMPxC94xjIOoAbUI5EZORyOadZ+2Nko+y2SIDzqj9BCZ75:DWj5Xx+90KHLYqLI
TLSH
T1925535169F1DB1BA4433034CA1897FC856622697B1DC0CCFB2EDA2047F7FD0961E9A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reporting.log

Path C:\ProgramData\Avast Software\Icarus\Logs\reporting.log
Size 49KB
SHA256 b8d72594d10043b7f5b6b95af3e1b83af352f80bad33af294ec822cc02a4e65f
MD5 30a1594986603c4807ba4481ebf69ba5
SHA1 152d45501155991a469b93700161f834878fab94
SHA512 5e6fc2b3bcddfcf349c2cb05a0398214d072f6ffb19b972370cdca867b8627ba5eaeaacaffa33d1c932b1833397f7e21c86c8daf9614695c1bd4ccee79801730
SSDEEP 1536:UluE5TJ6pkuw5TJ6pQuE5TJ6pMuE5TJ6p+TcquE5Ts6pLyTd4uE5TJ6puuEDBjDv:U15TJOm5TJOq5TJOO5TJOns5TsOLKy5v
TLSH
T18C33106DF90024818F2165CEEF32BFDA0D957A9D3B51D684DED19A88483CA7F83611CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reporting.log

Path C:\ProgramData\Avast Software\Icarus\Logs\reporting.log
Size 4KB
SHA256 75e89b7deb1e9ad42a6534633a2eb96a4595481cb35f1624e91d865adab56c64
MD5 0fb281b217672ecef955733526bcd10c
SHA1 9a33df9ece081f24e904bb1e64a58ee74d020346
SHA512 9221143fcbedd7608e8a43d9bdfe7f209b4bde7ddd3ba8811f044dab0cb2935f4ccfd894f2f21926b57754dff1c46a4572aa97cb33d9e1a46859d18617ea9046
SSDEEP 96:GN6CzgAy0rs23OWp6I9KpbXxvDT+JzgAy0rs23qp6thBKpbXrHV:NCzRrs2cmYbXhDT+JzRrs2d7BYbXDV
TLSH
T183A1742CFD1235D14F240A1BFE713ED92E9979DD2B61C189EED0A988446D32AC3F009B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reporting.log

Path C:\ProgramData\Avast Software\Icarus\Logs\reporting.log
Size 23KB
SHA256 a12e6ac18c840e3f205a85240afc2fde229f5d17f97abc6773f86f29118b6cc3
MD5 fd0d580b78c4febfc8c045da60ef9191
SHA1 78557e701a37412cc094ae41a4041f71fffc75f4
SHA512 25a7f18c2e6ae374de6c592021ac52e119e455a7fb32af3ed18239b18e534480248a1cdd18646bcc142f0fc4a3b35a9ff0beb433c8b96e6c1da8a3ce122bbecc
SSDEEP 384:eoGzys2w5weZV01sk5lX+VC+zys2oH5weZV01sk5lX+V16CzJs2cmYDhX+JzJs2l:eTP2w5hZVv6lXOC+P2E5hZVv6lXO16CV
TLSH
T1B5B2316DF91024818F2559CEEF327EDA0E957A9D3B50D584DEC19A88483DB3F83A11CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 831B
SHA256 dfab3f360b0c990300f21d83cb1f8c00a0366bab1074fef20478a90d449a466d
MD5 91e0b0ba955bb1a0d7f4e7b76bc5a3a6
SHA1 e0e3531f0e5ff6ee862815a3fefcfbbbf77e51e2
SHA512 4b44f4fc8731cfbdc899c01e3b5a1f709b164729dfc02e699e0787181599b7146bd093e896c1b9a787cff6c2d73d8c2e334b4b83236e915279022c81197bfde7
TLSH
T15B014E110C79B97B74290B0CE2C8BF1C3619F0258DAD48893F8E63387BDCD2A4AD5970
MD5 SHA1 SHA512 TLSH

Submit Download

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 16KB
SHA256 8420b9f7db4cc342ddf2f9caddcc60ecee68d73d67ad81f7f8ae874dd6f1bfb3
MD5 3dff0979a3bbc69c4cf58212de4342ae
SHA1 a89344a442dbff6d034bef173ffb916e054a8ff0
SHA512 d9187754bd54bf5a30108779460a676fde2e1684135a93c9a19355ae924c9c3bc3e3d49693b3501163809919225137cdbf48433ebc18f32fd8c980d12f3f5dbb
SSDEEP 192:3Km3KmJ7dmMzLPdd61BwVsKWHDd61vwnsKFDvKqonoDHL6ycEGM2DBNr4YJXRDvZ:31315MPw2rMZwssTPruDl
TLSH
T16D7231350D2BF4B2522A070DE09E7FAC7275F0665EAC09D435CDB61CBB2CC12E997A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 18KB
SHA256 15344b9c139858ce2298707b3edc71eec0826ebef18eaa3d741abdd08ad29efe
MD5 c1e408d6dad1d910fa0ebc91875223c5
SHA1 da3e3a21a4ee34d1e034b458b6669e1cda36b5af
SHA512 057ffe7576cc79352fa2d1993608804794de15f3fc0affa568d0ab561a47e73b8a0cdbdb0d95a82d1ab319dc0e3b0ef19ba6b97b2abb45afd8feedf8ac6324c4
SSDEEP 192:3Km3KmJ7dmMzLPdd61BwVsKWHDd61vwnsKFDvKqonoDHL6ycEGM2DBNr4YJXRDv/:31315MPw2rMZwssTPruDQJe
TLSH
T1098224350D2BF4B2422A070DF08D7FAC7275F06A5E6C499435CEB61CB76CC12E997A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 18KB
SHA256 8e3ad2cf4c38899d747ed87a10e5d72ec79a2cfbb10c93fb751977cbad303603
MD5 dc1741790a26e424e260e14f0ef1ee77
SHA1 955d73e9a6582c8f3afc46f5ea31270890d7b1d4
SHA512 a53431bb5d3a775833af003f4a4852423414524244228514a332d6b34008ce4037222c151452b3099b8d3df42780ad2d7a7c2c294aa32be72a848a05cdb1b98c
SSDEEP 192:3Km3KmJ7dmMzLPdd61BwVsKWHDd61vwnsKFDvKqonoDHL6ycEGM2DBNr4YJXRDvJ:31315MPw2rMZwssTPruDQJw
TLSH
T14C9213350D2BF4B2422A070DF08D7FAC7275F06A5E6C49D435CEB61CBB6CC12E996A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sui.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sui.log
Size 11KB
SHA256 e91d00d0cf7fe17f8647746e802c4f86a3519a830668b8128df3fd8752c1227b
MD5 35f86530af9499772782a94e522bf62e
SHA1 f16d38145f77e963106f5fa884929526891379b0
SHA512 5940be424dc4537d15ebf1e07715f46f27ef0a1fcd5c0292dae22037db1d545510677f79afd48f789bb51c33c75159f1cba5f9bedd66e0de2d3d3b5b63919be8
SSDEEP 192:7jc4TPuoFsCYhhBrzzBrAABrm0BrzyJ39WM4BGBGM7BnGX2/JXCn06snbCZuPNui:U4DuoO2CnInGMPwP9P+npn93nTn9KYTX
TLSH
T115427E044C2FB037A32B1B0D76C82F9E877627EA22581459979C7E9C2356804F4DFF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.ini

Path C:\ProgramData\Avast Software\Icarus\avast-suite\icarus.ini
Size 781B
SHA256 4777a01f9d2414c75ce71a7228b4e30f58bdb369de5f1f034f32969f752b56fa
MD5 b692e16b9f6a28f8ff02f2ab958f0e8b
SHA1 dd5591b76b314f438034652703615af940a52cd6
SHA512 438996f2d1b54b364fb31dbea173adc34f2f3520a037b7868e0806ba608433565d69e7ecddd50216d97500f4044cedefb194656018e03891b3c46876793e416d
TLSH
T16E016D66F9A6C792443AC7B8D3244EF1B58D30135C1362C273CFB92971C6A283A5D05D
MD5 SHA1 SHA512 TLSH

Submit Download

temporary_proxy.ini

Path C:\ProgramData\Avast Software\Icarus\settings\temporary_proxy.ini
Size 278B
SHA256 8e511706c04e382e58153c274138e99a298e87e29e12548d39b7f3d3442878b9
MD5 b8853a8e6228549b5d3ad97752d173d4
SHA1 cd471a5d57e0946c19a694a6be8a3959cef30341
SHA512 cf4edd9ee238c1e621501f91a4c3338ec0cb07ca2c2df00aa7c44d3db7c4f3798bc4137c11c15379d0c71fab1c5c61f19be32ba3fc39dc242313d0947461a787
TLSH
T194D05E5307FA0008F1B74A58EBB898F2573378152F4DC02CC0C0121F84F2805892BBE3
MD5 SHA1 SHA512 TLSH

Submit Download

2333b9f1-9058-46f6-ac53-df941b3112a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2333b9f1-9058-46f6-ac53-df941b3112a7.tmp
Size 5KB
SHA256 5e5f249d384d23e32ae9c9124446cd9d745ac6722511283a22a054fffe0b6df8
MD5 f4cf16874be6be8384be8f980f1e52af
SHA1 2b674eb5913af4cc8987443c2c03b1c64901b397
SHA512 889e6f7382302600a23993433f1141f7516a404e23a4560b975af0d182bdcaec339c4bc95f4e470a722af03f5811900c1d3c943b3cf990a6d3134234c92cb811
SSDEEP 96:+bJod+DYOC49mjc0XQKgfaHtpZl5YSl8h4otop5c4DsB6hdGGfvY7Bnub0gRNC3A:+towR0jhgKR3ZkiU2DgmvKBnub0guCX9
TLSH
T10FC107B1A86DAC774CF7A444B1133E47C9B8316B6950BE18EAED1E0C01E35EC63C2567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

251aa542-4597-47f7-9602-99caa2321f84.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\251aa542-4597-47f7-9602-99caa2321f84.tmp
Size 4KB
SHA256 728c3c956653b09d062c1718a7e60dbf6d2b9292fe67de1d6a0c46ee00458662
MD5 d538acf7a5e2179aed9fa10d3cc3bb19
SHA1 f2c4efe7277c87e09c64040342a79ec20187ceb2
SHA512 779f8cba17d209ab402dc61554f1e32d77c46998ee611db7b92b4dc69dbb188dab238dabdd2f25acafb0a985a05cee875a348097ddee8e82225855ff1e75ddbe
SSDEEP 96:sC0d+DYOC49mjc0XQKgfaHtpZnm5gRDotok5cVDsB6MGyvY7Cq00bOZ5v4a:sC0wR0jhgKR3ZnzDUD0g8TCq00bOz
TLSH
T178A1F6B1A8ADAC7744B7D400B053BB47DEB831676851AF40AAED1F1C10FB6EC1382567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3379161c-eb09-4606-b246-4470f48e3d35.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3379161c-eb09-4606-b246-4470f48e3d35.tmp
Size 5KB
SHA256 ed9bbb9a35fa86b0cb52c33b6cda761f5e2ed7acd35236b7a226b7fb2a635e35
MD5 01d231ad7ed9481d17844ed24214117c
SHA1 f8355585110382d92112ac10b45179bdc20440d4
SHA512 3277e0f5a06c7e2d520c9a7f08744489a616ee2745218812d45aed1a59dff2c10b5cacee3c70261a88c27be650b8d4b3f4e1b355aace3f89a0e3aae9f438863a
SSDEEP 96:+C0d+DYOC49mjc0XQKgfaHtpZl5YSl8h4otop5cnDsB6h3GyvY7BUsn11Qzb5MDB:+C0wR0jhgKR3ZkiU2OgJTBdnQEIwb0cH
TLSH
T1FFC119F5A8ACAC7348F3A551B0133A47CEF931A76901AF50EAE90F1C11DB5A82386527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

640d7e4b-9077-42dc-99bc-7aeead2a0dab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\640d7e4b-9077-42dc-99bc-7aeead2a0dab.tmp
Size 51KB
SHA256 dd6494f6abfc2c49d0fec6b70861ff99dcab21b991d8cdc14328a0e69c0f1952
MD5 d07fbeb2fef1fe69e6b29fad397028ca
SHA1 59f63ca775c5b13390c679e091054deaf4a750b7
SHA512 c0f96e7d4bd76fdb9787fb0a599a8c1d5420f53d88b082c638f3c7ab0d29189fdc60f9aabc4e5b68df4f9c0fd6086aabc5c6615840de7569b059afb2c1ae802d
SSDEEP 1536:2x4CrtaKe+znm22GaDQYI/CwrHIDNMxx+q:E4B+zJ2GQYqAH7xxF
TLSH
T1E333F1F5EC7C3C374192F515F1165F8AAFEC3013D828AB28C5981F4801E6DCAAB65176
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bc069b4-8e4e-47db-9bf0-b033628c008e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8bc069b4-8e4e-47db-9bf0-b033628c008e.tmp
Size 5KB
SHA256 17226ed67e2097b8005fbc342f7040d1d722e3bd1a6096a5861035c3472417fa
MD5 bf00fe04876b7c1e22603e9fe785fd7b
SHA1 2f0a31150a99c1e195cded8354b3f1ff9e65eab0
SHA512 f44cea23b878045727d28b39b527053fb8400e25a812a55d678febce96311a9332773cb42fd53b252779d2f9b4ccd7291c1f1756ff154634b2e32acb2674437c
SSDEEP 96:+bJ0d+DYOC49mjc0XQKgfaHtpZl5YSl8h4otop5c4DsB6hdGGfvY7BUsn11Qzb5S:+t0wR0jhgKR3ZkiU2DgmvKBdnQEIwb00
TLSH
T170C12AF5A8ACAC7348F3E551B0133A47CEF831AB6901AF50EAE90F1C11D75AC2386527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91276edd-a2aa-49cb-bdbc-e1b5715b6370.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\91276edd-a2aa-49cb-bdbc-e1b5715b6370.tmp
Size 5KB
SHA256 d29be934221fbfff751f65d67a23301c8d6af28c83729a5e77e2b8d46c5cd0c7
MD5 df44ebf15081120a6869064914cf4fed
SHA1 f7393e493ef3e69af1fc2a4218bd6643a0482349
SHA512 ddef436bfd41f9e03ba692d06e573f4afc6a82582f31f37e43f6f201ea46d3f0ac06e2cc2eb0ef44dd18c7ff812d93e5e7452fd01b59655524cbce2ce2623f1f
SSDEEP 96:+bJ0d+DYOC49mjc0XQKgfaHtpZl5YSl8h4otop5cnDsB6h3GyvY7BUsn11Qzb5Ml:+t0wR0jhgKR3ZkiU2OgJTBdnQEIwb0cH
TLSH
T19CC119F5A8ACAC7348F3A551B0133A47CEF831AB69019F50EBE90F1C11DB5AC2386527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

990016e5-d7e5-4651-9ed1-2774d5eceb67.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\990016e5-d7e5-4651-9ed1-2774d5eceb67.tmp
Size 5KB
SHA256 4e30294db4a437a133300b3e154dba9e112271a2f00ca7d1487ba0191b878c13
MD5 1478fa642662ad4d9c9809b6c0be80c0
SHA1 0d3a20637d59c714f1c038c73eb91ca3086084d6
SHA512 bd80f56ff2a5fb675f328b42624834bf005d7210f7d42d9fa5e9f74cb71a09de262f1c0296801f4546699012b0d87763a7c7142551c0e0e9fd203e70dbf95fbb
SSDEEP 96:sC0d+DYOC49mjc0XQKgfaHtpZl5YSl8h4otop5cnDsB6h3GyvY7BUsn11Qzb5MD2:sC0wR0jhgKR3ZkiU2OgJTBdnQEULb0cH
TLSH
T1F6C128F5A8ACBC7348F3A551B0173A47CEF831A76911AF50EBE90F1C01DB5A82386527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26b87794-f204-44fb-8728-45090159b7b9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\26b87794-f204-44fb-8728-45090159b7b9.tmp
Size 11KB
SHA256 3b896d547b11857fe43cae422c3345799159dc339fa3940fa269e362e0c51fcb
MD5 d97cb569f6f796542714b4fbc0531bc2
SHA1 064c228d98172a988958020a374d00b5f3477150
SHA512 48f0411bb68d40fa0e2ebe2a8a03adbd623aae8fed2cfac566bbe12e24bf59b39e94ce07243f9fae7d25f979745e52366ef9d2098253a440e5b7316174864c25
SSDEEP 192:76ReeSDVqv72vAPRp2Ka9jHsb+WNnncaPM2Ex2sMkw3WVyIsnAUgR:OReeSBmi6XqdwcV2Y2BXuR
TLSH
T11332726EBE20753B5DDAD229FA257753E6F5203224952E84EBF88E3C10D75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5546f500-e86a-4a09-8652-e87b778b303e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5546f500-e86a-4a09-8652-e87b778b303e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

86e40793-9a40-469c-a2e9-fa6e18f9f3c0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\86e40793-9a40-469c-a2e9-fa6e18f9f3c0.tmp
Size 12KB
SHA256 7803106c2e681d5762f4c22ef9d757dd16ad257e978544725e41b2dec0598807
MD5 29f921378d22a39b6b916fd08d62bed1
SHA1 adf895957f64a92506f3a2e8e858e8662757f554
SHA512 69f354de62aac0086d34ed9774760e11583612216f49e3a7039ab8367804ea2f9574b9f8e3ea312529b09af8fc5ff9b68c800beecad5e7d7fce136c30c18de0c
SSDEEP 192:76ReqSDV1v72vrPRp9Ka9jHsb+WNnncaCpEAx2sMkwpWVyIsnAUgE:OReqSBFibX7dwc1Ek2BJuE
TLSH
T14442936EFE10757B5DDAD229FA25BB52E2F5203224902E84E7FC8A3C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b1c67a4-6bbd-44e1-849b-1da82c258ec7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9b1c67a4-6bbd-44e1-849b-1da82c258ec7.tmp
Size 11KB
SHA256 b4367c5bb6d809a5751f6576c4db496700d9191a19f810ac0f78ba0436d73909
MD5 d560e15f8d9eaf7a9ed75f964352c88c
SHA1 5b3e325ec45242ce6c5c4afbe5a20f378e339f8b
SHA512 8b69f4f04f8e7d3d81beb8b627dec6afc9505f7f8eac1174fe10069c03b1ae8752e0cfea4faa9723256b7ceb4e70acdab8d2655ee8b47c5796aa5fc839985c5e
SSDEEP 192:eCB4K6Kc7KxkXqK4I40pUZNCgVLHrKHfFKslEQ0+XzKD/RE+ErUkKN9y8NKodgPG:LBjZc7KxkXqKf/pUZNCgVLH2Hfgslm+Y
TLSH
T1F732D827A48DAE7F0FD8D91DCC166F4B6DB5029632680C24A6FF9D0803A578E114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 192B
SHA256 90473f6fd67e79feb3e6c62ffafe754514a6d803d430f9ff6d8be89a99ae6b26
MD5 547eb339ec582b48075b969e64c550c1
SHA1 8d8e6d68f744343a580e4e54bfdd6c0f8637e663
SHA512 693d56f0ee55395464a6e4031bf7c2ebf5561eba7b3ba50f6eaeca07fb6b6ce04f2443ebc2ceeb1e41c45e7ce7b820ec1b1e954df75c142f8472c82f63e86ee1
TLSH
T1BBC08C4440F0D003EFE7223488EB1440A630002C731FC287435892683C567FE004230F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

222f34bf-7363-4bf4-aab5-82e1f338b75c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\222f34bf-7363-4bf4-aab5-82e1f338b75c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

41b9c69c-ce09-4b93-90c5-2d12e34e380d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\41b9c69c-ce09-4b93-90c5-2d12e34e380d.tmp
Size 4KB
SHA256 2ed2289909f02a4f0fcb956b7f2d816a6130f871929bb455578c707a548f4d70
MD5 341545312d6a4354777594938937d95d
SHA1 8d593f813d5a37891c649cf19a9f49701e7e8d5f
SHA512 66fe2cc41ce44fb9bed87eda7427a02aec2eba383b68020796dd5174d46838e101368d0ce07690fba6ab37fd2fd31da10faffdd1ccf949b522279db0813311cf
SSDEEP 96:DIdGpe1B13oNIJNIJII5IHkIJII6wGIJI4:DIdGpe1BZoNIJNIJII5IEIJII6wGIJI4
TLSH
T1F5919DF7D3E8866D89415AF8EB256E1ACD290D14532D3C2AC8D4AE0F93E3871D64068F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50aca536-70c4-4562-8a31-965d3d8d70c3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\50aca536-70c4-4562-8a31-965d3d8d70c3.tmp
Size 4KB
SHA256 b983220380e921696b9d3a7ab5a47d6002e703114b656e33a9972b6e3970d7c9
MD5 a62f6f0b210b80ff7e14633a20d621fc
SHA1 eb9bbe1dc3d2500ba42e8fa882a93dc6b21be4b1
SHA512 1cd6fd74a84b4f09a860f17491beae7a322c357fd5475a8b97ab22dd3576c5e5672165855808d41d7ee134a77c95669015995cf7f20b947491ff6a5291503b30
SSDEEP 96:DIdCIZ1pe1B13oNIJNIJII5IHkIJII6wGJIZJI4:DIdCILpe1BZoNIJNIJII5IEIJII6w8It
TLSH
T1DDA19EF7D7E8866D89415AF8EB246E1ACD2D0D14532D3C2AC8D4AE0F93E3471D641A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f280f7ee-4e93-4465-b8f8-41b658512fbb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f280f7ee-4e93-4465-b8f8-41b658512fbb.tmp
Size 4KB
SHA256 7cb3b10240150d205727afa52bd0a1ff36331b621ba94ff2154d1dabe15bba07
MD5 7cf4afdf2d92f95f1d309753d74be3ba
SHA1 641c0927283254667682a1f560f6b74c817ec17b
SHA512 ca2aa719f36a09baf0e347b51e47603d04fdf9cde1205d2bd8edc6ee8f7cd6dd299c5605b4ca5bdd99a30f117a15829e4f25619b7d9ed22af7bd2b014d5c0b6d
SSDEEP 96:DIdGpe1B13oNIJNIJII5IHkIJIIT/vXIY:DIdGpe1BZoNIJNIJII5IEIJIIT/vXIY
TLSH
T17E919DF7D3E8867D89415AF8EB246E1ACD2D0D14532D3C26C8D4AE0B97E3871E24068F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1199165-b75d-4a91-8b9e-69cb1f9dfa25.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a1199165-b75d-4a91-8b9e-69cb1f9dfa25.tmp
Size 11KB
SHA256 2ffba7f030b5ca8d8c3370a1ff9ee4430d6907b50dce89f2cbffdcfd89d6f7c5
MD5 c8c05ce722cf6e6121cb09d7ebda22c0
SHA1 5991c527ebf99c3b9ef0a87319eaf1b27c4ce107
SHA512 fa9205c817c9e89bfd8a5876c617792c99713f30276b7de1432a2c06fa3c6ae0a0dda347525511de1241d2cb0de2a1cc71b1eeda544b61a3d5a618c429c9efcf
SSDEEP 192:76ReqSDVGv72vAPRp2Ka9jHsb+WNnncaiZYAx2sMkw9WVyIsnAUgE:OReqSByi6XqdwcZYk2BduE
TLSH
T19E42936EBE50753B5DDAD229FA25B752E6F5203224942E84EBF8CA3C11E75CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8ca9a67-3ef3-4c45-9149-a0f34943f8c5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a8ca9a67-3ef3-4c45-9149-a0f34943f8c5.tmp
Size 12KB
SHA256 8add36cce5578ab4ec9b0f09aa93a96f9b91477ea29c79285f8a3bb617390500
MD5 b1c4fbc9732e1020799085a2d31c3dfb
SHA1 fc392429c3d686e2e3066404275b93aa1baf4c09
SHA512 1e522c6a5ebacaeb08fed15ff3b1ed0fdc7b7c9ebc5a3b6149f3eb69c6ae60ac84af1beed858bbf498fab1dd8eaaa8c772c488e7dc1fff61ede0e9f0bdf5bbd3
SSDEEP 192:76ReqSDVVv72vrPRp9Ka9jHsb+WNnncaiZYQx2sMkwpWVyIsnAUgE:OReqSBlibX7dwcZYU2BJuE
TLSH
T1F042946EBE50753B5DDAD229FA25BB52E6F5203224902E84EBFC8A3C11D75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e8cd90f-e7bd-44a2-9ed3-5112d3b50502.tmp

Path C:\Users\Admin\Downloads\2e8cd90f-e7bd-44a2-9ed3-5112d3b50502.tmp
Size 413B
SHA256 c599c31ca32eba66bd5b788717ded21610c618a91d010d65f493d370e5374b4b
MD5 1f795b115a9921289d536956ac82cfff
SHA1 3c6cd34a46d96eae48f00458028109d24b13c77c
SHA512 46f9347d1dad52b3201d76fcd630c5930d2e17ac935fed54ef3926c0e4315c8cfb0a81c50c5584115edf562a8b44f34495bd289685ff121d8579548e2a2bcd4c
TLSH
T1EFE07D2ECF70E4C6CC9871F6094AC000D13C05D3EB091F07ECC0D13910C06781D85A21
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 48292.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 48292.crdownload
Size 1.7MB
SHA256 0798e282e854bd8750a4a57e2f2d3d6b3e1c08d8db0fcacd1f49e15990ecce60
MD5 d1f5acc44df9ab71b5e9de53a9ae22f6
SHA1 d8ad8bcd1bac7b80923a9838b1b8e8e0c3ebf507
SHA512 cb7779b3de47b9489fed2abe60dd11c7e26197c8e283b931ca7d8cfeb8ee4e44b7a3b7e38166919968f6d4b2afb371a6ceebbcde9006b1c88d94c687fa20cb5f
SSDEEP 24576:fEtqZ3vv0hVY+ID0GQ7w9T4vdhcsUCpvSh0lhSMXl3q2w4aVRFTUWA7W:fEA/v0oQ74k3clCpvPK34aVvTUWA
TLSH
T1E8859E203F46C53AD49B01B1952DBFAA866FAF744BA140C773E03E2D6D741C22A36767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bug_report.exe

Path C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\common\bug_report.exe
Size 6.2MB
SHA256 eb20d17c1cfc8bfd31907712de0ea338af754508a7a7f41115be8c6ca13d72da
MD5 232d6fcea8b64318e0a617c4b60f9b67
SHA1 170c727ae1a65e397db0aaba49f338adfc5fbd84
SHA512 148452e623533d8cff51ce40ea1591279377e2647d63be9f973fecb885c33bcbb2d1aa0b698f4a65455375675939c80421af1c7850f2cd2255ee282bc7b088bb
SSDEEP 49152:J2dHHul4h5QW2YAa+vdwlgCq1DzQWnmNAY27FpjNsc22UVSQr5ubpTsfKTkvu3GU:fYAIrCf5R5LmvSK3z1Wwxhc
TLSH
T149667C1E7A2E00E9C1BFE1788A47950BEAB17895433597CB66E18E550F13AF19F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dump_process.exe

Path C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\common\dump_process.exe
Size 3.9MB
SHA256 8fa809a39d921d5f56afec11ae8f28d99c80e20291fb82027ce7841c258b9bfe
MD5 6ecc64dba77f5842f16cc4b70ddeb19e
SHA1 fe9cad29562920ad15f625c8e31de0857a2c0dc5
SHA512 2c9b0ee56441d08103dc679d62a411c81c810df09be35b6699600335235418b7a23f9db241142e1e32147f2c4dc99ff0d76ae4888671d76918eb7030f2ff5eed
SSDEEP 49152:rBdEpfK4eMmbxFu0Cd0d092h4smr0JbxZRahtPtMt0K8JxC1GTZyXSi590bx:z+oUXPy0
TLSH
T12C166B1EBA1D00E9C1FEE17D8686550BEA713CA1433597CB66E0AE590F23AF15E7E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.exe

Path C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\common\icarus.exe
Size 9.4MB
SHA256 49408501e5e21eea915d10202b728a09fe3dda38813a9352ad37eaadec5efe74
MD5 3566a83973adf991a14a72e742088add
SHA1 2de0671e24ed0c2e1dc1333b634e69d2a308a950
SHA512 8b5de895c1b93d764c785c00b1163c50a7ceda1004dc3d1e576206758bab3ddc22df3ba7862aa1b5c2a28b31a61468bec4a39fcb525d2c0ed8cac25ef3a749f6
SSDEEP 98304:QGDZb/Yr7uiK7+v4pzWyyTAInAaQMDrDEQDpv0I:QGDZjYnPwpzWyyTAInAaQMDVN
TLSH
T1F1A65C1EBA6D41E4C1FED1788647A41BEEB17C95033996DB66E08D461F23AF09E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_mod.dll

Path C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\common\icarus_mod.dll
Size 16KB
SHA256 48f98abd8622c54729bc7a6b253971f527e6620203492d5ed0ba7d26d7936530
MD5 35479c961dec4808134c8b592f3ee64a
SHA1 76413ce32bf217ba86b96e6143aae4fb17d6205f
SHA512 6bf81bcbafdc52f94f5800642fa5137d67b8bbdbfec39cf039772620b666f8939529ac5e2b9bc8045c7dd0e2efbe4b15a4ccc40422717c885da8bf356906840c
SSDEEP 192:3D8fyQYbR0otqS/qas+pPIKfhig1/C59jq7Ggfi8Lzon0XMdPf43x++Xa21Rpb:3DUORdDls+pwKNsZqnJLzo4Mwx7bLV
TLSH
T1EC724A473F302982FFC74D74A4C54BB7AE7077A2AF1588D64970819CAD91BD13A2816F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_ui.exe

Path C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\common\icarus_ui.exe
Size 12.4MB
SHA256 4c4c025911ba02a39f3c2aa7f5a3c872d915dff19fd8c531e9c8c23309353d6f
MD5 b368205a9df1d184e7529e6cc7c24fbb
SHA1 fe75c6313ca672a566e1a5132182b6bbbd258223
SHA512 e1e1f19521310a53c9e4216120d633bdd810eecd3944ccec4420fdc9f6b861e77bddb5b839cb2b978c087ac9999c7397cf6037f9ec555e8ed443cdd1d43c3b24
SSDEEP 98304:9OJm7FoYZAc+GsxyP8mptjQvHa59cJZaBE1bNaI5byrqNuQ:9LpoYZAcIxm8mptjq6TcT3UIkrqNl
TLSH
T1E4D67E2A76A880E5C1BEC0788A5B950BE7B37895133497CF12F15A5A1F376F09E7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\common\product-def.xml
Size 2.5MB
SHA256 f77e47bd51a0306516bba1e925967b2ec9453dfd25ea5a0fcea14ea7cd0035ca
MD5 fa6f4e160c1890ad1327b84334e261f9
SHA1 796fbc62f0a92b693716122cc20142b9560641d4
SHA512 9f155af302c1459241cd5cf08b240142b5dd4d778d13da7b91cfe77447e200f3462918ea15b0566d2b6d9af3b763c4f35e35c4d4c8a6d1f5b8600827a92b1d23
SSDEEP 24576:zXijEM5U0w7Ey0EzdP4LQ6I0vYWHlmGOp77jAQPIIOb151eUMaklF9LqKhIjYZ:7iYMLfyRPR0QCmjR/F45Ob9h6C
TLSH
T10CC540793A5E7D7F724A50EBB480B881628FED78C9E05C53F1B33140A153EA29E71A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupui.cont

Path C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\common\setupui.cont
Size 698KB
SHA256 94694edc1920ede6776ea325983415651b460256a7d4842faf48e0107acd61ab
MD5 c75c156ec4ab09e03d31b0c758f0bc55
SHA1 47b0fa81530619afb7505b1276675be719f612c8
SHA512 e35e48387e9eb90a35b1aca1044d9d244380d0a9c627e70e0cfb09aabffbe39576ea1d319155238a29c98d27c4029bb6727791bda66c4fce28741639e4355200
SSDEEP 12288:Ia0CzZwkoXuqqTk+u6+awLvXmnPQeYBnO9r55QwNL8KrzO5rXc1EqYnSJHy79IYr:IHC2pXfzTCPQeYo91ewNzO4EqoiHy2Yr
TLSH
T152E42339676AE2E146CCDDD5E49A70A5F239AC2DB3FBDD231B607B8450BE48C3C40185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus-info.xml

Path C:\Windows\Temp\asw-a84ebcec-2884-4c61-b45a-b100888fc18d\icarus-info.xml
Size 2KB
SHA256 f1f062cf4bdff7146dbf5795d4429c64c7019f933352f83f2ed581a1ed5ebda7
MD5 1eb9c7a705f507256282751398eab2f3
SHA1 af13b4f5d9c525a8d297cac8d7561844bb0e1114
SHA512 9c29ded4feaf54a87b2a755ac34e720c0001477c365b983f0fd062058e711bd1691ce41bcc2992e749d8e19c13421b93e8e1c364a1155b558cea4eab921c5007
TLSH
T1F85163B9A13CDE17371A51FFB094BCC267EFFC964BA44A2341137082DC6B9E52946174
MD5 SHA1 SHA512 TLSH

Submit Download

policy.def

Path C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\avast-suite\brandingdata\av\licensing\policy.def
Size 3KB
SHA256 4a32ed196f5532592dd77f7606f0f57fb13bdb9f8f2b5ae29eb05ea33ad69ba3
MD5 f33ba357f62ae86f9029ace908fc0da2
SHA1 eee7368eb6331280e5b95bc2099d15634327d9f1
SHA512 db1c5358e89b8b61080d46c00cbac216c09cb4982280c796fbc81af6d6072def3b1a101922fa1a35ed83c487580d8f861318c452fbc6441db33f2cdd0e32d626
TLSH
T178714F5D2C16A6FF3A87A7B39E025FFA7DF984C18F2811A475AE5E0D11A498C05DC01B
MD5 SHA1 SHA512 TLSH

Submit Download

policy.def

Path C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\avast-suite\brandingdata\bg\licensing\policy.def
Size 718B
SHA256 25cb063707d322d112c4f6d9b10dde10a8e381bcbf56f5e50ba853232c79d0dd
MD5 2f86ce9f00990bdd5574ba9c85651280
SHA1 042e0d369b4131dda69b79bd89139dc53db511ea
SHA512 4bc5873be7a70143735470b81bdcc38dc4a9ccb41444c55d01540bde92c9cb12b2864a66852f2a0251f64b3c32fd5b163b1a3437c33a83f6727dea64527d7987
TLSH
T19E01DB8C6C1696EF3A8BA3B3AA515BF77CF855859F285194309EAD08025998C41CC01F
MD5 SHA1 SHA512 TLSH

Submit Download

policy.def

Path C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\avast-suite\brandingdata\tu\licensing\policy.def
Size 2KB
SHA256 2f12d0f88b2d4a0d70a546551141dd7506bc447b4abc0678b41390b2fe342fb8
MD5 595d1a68d7f5ad816de3ea02de202dab
SHA1 6aebf77cf237570b063c6bd7ad8707eeffea6dc9
SHA512 dea1d70d50da3f13a0731c62ea7e857437e6eb0ec5309bdd3d2e152da75504c4dc09ce84d44a68a1675fd3959c30d7448651dd5c9dc86cbdec5125317c98e547
TLSH
T17041675D2D16E6BF3A8BE7779E025FFA7CF984809F1851A0349EAE0D12D858C45DC00B
MD5 SHA1 SHA512 TLSH

Submit Download

product-info.xml

Path C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\common\product-info.xml
Size 11KB
SHA256 af96b7c8242000910f5f343e972d082dfc07544671dd3a953f41170e53be3dc7
MD5 69767e8f9363bc776aff48805fa4d264
SHA1 48ad71ec075bdb0de2154fb5d2fd3f4fd37dfa57
SHA512 f733648318ee4a43b8cb68730b5f9c9093aafdbf835996f617cc0ddfaccbc30117b26689a4e5cee22588388463ef42a7d89fab7460e07f5122108723076b0ed6
SSDEEP 192:6ne9+g+E958/mN0duJK1/VTU8wJOQBr3mE4rODD/xsDdBi1OzuWRPu+LyiguDSjT:6nxEHEmNit08GSrJKW14GDSjT
TLSH
T1393242B5222CFF6B321FA097F0D47981729FFC2D9B982C13E1273180A29B578AD45975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eclk.edat

Path C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\eclk.edat
Size 32B
SHA256 cd36ac59fd5925a4157ca4861eafc68c59c4749ea008577bc53ea5361b34b968
MD5 a251aef3b73682878278149c0a97104d
SHA1 3f9fea55a6f22f7c1d5ca6c7ac23d271fa959245
SHA512 476405226d8164dfb56a57537b405be56b5a719a155d9276a05efaa2fe35e82e816bef0d0e410e154c53276324b5cc834fd84c49eb5cdebd942ac45546dc8776
MD5 SHA1 SHA512

Submit Download

ecoo.edat

Path C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\ecoo.edat
Size 21B
SHA256 9b4f8075a4dcfa845fb9a5ab852acc69d0ef13f34cb69b2c0897a8f71ee809c6
MD5 3e4d7970d54c28427dd0bae65b1245b7
SHA1 a88f14dcab0c98c5cc871f829a0f431381bc7350
SHA512 5b5bf83f081696dd1f5a60b70a85be774fae126952101e2d8ebc4af26de858f10eac83a9e4b5cf4e67af8b7b7a216f5b7f88afe2c7f48607bba6def2c5df0ada
MD5 SHA1 SHA512

Submit Download

epps.edat

Path C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\epps.edat
Size 80B
SHA256 c6528b50bbe1265eeb1beb88535e7f6257075daaa245ed693e9ac38511b297bf
MD5 5438e42d44c84deaf1c0d2ff11760e49
SHA1 87a6d26a9a158a169f2808ea1702daa188865498
SHA512 ff1f32e2379a4f6d0b642d31baaf558090dbe2ed6031f88f25438d0100f89651cea3af3690dbef151f3c3fce0582d0fbf5b85b7392ad7a885815d957cd8041a5
TLSH
T195A00188D40182F320A0D20073889187301A00C45E49318D79FAF94A2389B8B9AA84E0
MD5 SHA1 SHA512 TLSH

Submit Download

giet.edat

Path C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\giet.edat
Size 6B
SHA256 a0cd707a34d69fdf819bced9e5ac7cc10eff0877689930daf023f7a706c2f3ee
MD5 9eb99fdadd0a780aaabec82148621330
SHA1 ce3e9e223fe8665486dfaaed2869fc8a797e6661
SHA512 8122c81df90fb542584ccbff5ebb6e9cc812e70c4ed4e24a8f8c2fe8705024d1b92ed94dde31a859c261e06f4a1824004cd3d3d222baaf50d021c24afe857032
MD5 SHA1 SHA512

Submit Download

icarus-info.xml

Path C:\Windows\Temp\asw-d3b52657-afa2-4679-b71c-b7994816ec47\icarus-info.xml
Size 2KB
SHA256 a322007675f181eed8c2819e1390ffc11e0ade8ee4511a41606e39718d2eca3e
MD5 d0c5950a7252c64d6f89b6e54836f9b2
SHA1 0f4a798d40173268a27b55715ed79267ac248527
SHA512 622f74da3264f8e2c31c0028311a3b5c8a116dd53110154061ad503cf48f42b6d029c9b16612c9702253148ed87c009bf126296bdeb1d47b25de364156098f6b
TLSH
T1395154B9A13D9E17371B52FFB094B8C267EFFCAA47A8091341037141EC6B9D12946174
MD5 SHA1 SHA512 TLSH

Submit Download