4e58458ae897bf173de10fe025f99af7faace937b88a0c4b6f36c3c674ae7115

Analysis

max time kernel
106s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

utorrent_installer(2).exe
Size

1.7MB
MD5

241ce365f228ee5f74d81b3fea14e09a
SHA1

700b05506dd3eebb4b87ff545f6d2bb6af6a3ae3
SHA256

bf4ee47d0df1870104f4fada8a68c2fb29e94fea9284c7bb6a6b385a718d8a18
SHA512

bf3756fb2b037a10592498f08e6eb3bad8f50da4ff9e96703e646a69ea1481e6801023abb3b1aae923fb2c68bb21ae5bb50f8e675b57ff90504c8e7ee8f81593
SSDEEP

49152:9BuZrEUT97LZxMPrlDZFBmS06nIJOZobMP:LkLp/ZSr97Bmb6naO6bs

Score

7^/10

discovery evasion persistence upx

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	utorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	utorrent.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002329c-101.dat	upx
behavioral1/memory/1032-110-0x0000000000400000-0x00000000009C2000-memory.dmp	upx
behavioral1/memory/1032-136-0x0000000000400000-0x00000000009C2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ut = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe /MINIMIZED"	utorrent.exe

Checks for any installed AV software in registry 1 TTPs 9 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	utorrent_installer(2).tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Browser\Installed	utorrent_installer(2).tmp
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Avira\Browser\Installed	utorrent_installer(2).tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	utorrent_installer(2).tmp
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\AVG\AV\Dir	utorrent_installer(2).tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Browser\Installed	utorrent_installer(2).tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	utorrent_installer(2).tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	utorrent_installer(2).tmp
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\AVAST Software\Avast	utorrent_installer(2).tmp

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	uTorrent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	utorrent_installer(2).tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 5 IoCs

pid	Process
404	utorrent_installer(2).tmp
4124	uTorrent.exe
1032	utorrent.exe
4412	component0.exe
2536	saBSI.exe

Loads dropped DLL 8 IoCs

pid	Process
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
4124	uTorrent.exe
4124	uTorrent.exe
4124	uTorrent.exe
4124	uTorrent.exe
1032	utorrent.exe
4124	uTorrent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	utorrent_installer(2).tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	utorrent_installer(2).tmp

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.torrent\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\uTorrent\DefaultIcon	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Magnet\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bittorrent\Content Type = "application/x-bittorrent-protocol"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Applications\uTorrent.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.torrent	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.btapp	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\uTorrent\shell\ = "open"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.btsearch	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bittorrent\shell\ = "open"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Applications	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.btkey\Content Type = "application/x-bittorrent-key"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Applications\uTorrent.exe\shell\ = "open"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\MIME\Database\Content Type\application/x-bittorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\uTorrent\Content Type	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Magnet\Content Type = "application/x-magnet"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bittorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bittorrent\URL Protocol	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bittorrent\shell	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Applications\uTorrent.exe\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\FalconBetaAccount\remote_access_client_id = "3443517988"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\uTorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Magnet\shell\open	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.btkey\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\FalconBetaAccount	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Magnet\URL Protocol	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bittorrent\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.btsearch\OpenWithProgids\uTorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\uTorrent\shell	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\uTorrent\shell\open	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.torrent\OpenWithProgids	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Magnet\DefaultIcon	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.btinstall	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Applications\uTorrent.exe\shell\open	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.btapp\Content Type = "application/x-bittorrent-app"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.btinstall\Content Type = "application/x-bittorrent-appinst"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.btsearch\ = "uTorrent"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.btsearch\Content Type = "application/x-bittorrentsearchdescription+xml"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Magnet\ = "Magnet URI"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bittorrent\shell\open	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.btinstall\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bittorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bittorrent\DefaultIcon	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	utorrent.exe

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	35	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	36	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	39	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	80	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	30	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
404	utorrent_installer(2).tmp
2536	saBSI.exe
2536	saBSI.exe
2536	saBSI.exe
2536	saBSI.exe
2536	saBSI.exe
2536	saBSI.exe
2536	saBSI.exe
2536	saBSI.exe
2536	saBSI.exe
2536	saBSI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1032	utorrent.exe
Token: SeDebugPrivilege	4412	component0.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
404	utorrent_installer(2).tmp

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 404	372	utorrent_installer(2).exe	91
PID 372 wrote to memory of 404	372	utorrent_installer(2).exe	91
PID 372 wrote to memory of 404	372	utorrent_installer(2).exe	91
PID 404 wrote to memory of 4124	404	utorrent_installer(2).tmp	101
PID 404 wrote to memory of 4124	404	utorrent_installer(2).tmp	101
PID 404 wrote to memory of 4124	404	utorrent_installer(2).tmp	101
PID 4124 wrote to memory of 1032	4124	uTorrent.exe	102
PID 4124 wrote to memory of 1032	4124	uTorrent.exe	102
PID 4124 wrote to memory of 1032	4124	uTorrent.exe	102
PID 404 wrote to memory of 4412	404	utorrent_installer(2).tmp	105
PID 404 wrote to memory of 4412	404	utorrent_installer(2).tmp	105
PID 404 wrote to memory of 2536	404	utorrent_installer(2).tmp	106
PID 404 wrote to memory of 2536	404	utorrent_installer(2).tmp	106
PID 404 wrote to memory of 2536	404	utorrent_installer(2).tmp	106

C:\Users\Admin\AppData\Local\Temp\utorrent_installer(2).exe
"C:\Users\Admin\AppData\Local\Temp\utorrent_installer(2).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:372
- C:\Users\Admin\AppData\Local\Temp\is-A0QT2.tmp\utorrent_installer(2).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A0QT2.tmp\utorrent_installer(2).tmp" /SL5="$40160,875149,815616,C:\Users\Admin\AppData\Local\Temp\utorrent_installer(2).exe"
  2⤵
  - Checks for any installed AV software in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\uTorrent.exe
    "C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\uTorrent.exe" /S /FORCEINSTALL 1110010101111110
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\nsh54CE.tmp\utorrent.exe
      "C:\Users\Admin\AppData\Local\Temp\nsh54CE.tmp\utorrent.exe" /S /FORCEINSTALL 1110010101111110
      4⤵
      Identifies Wine through registry keys
      Adds Run key to start application
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:1032
- - C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component0.exe
    "C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component0.exe" -ip:"dui=2397ee06-28fe-4eaa-8777-f7014368c353&dit=20240509130516&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100&b=&se=true" -vp:"dui=2397ee06-28fe-4eaa-8777-f7014368c353&dit=20240509130516&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100&oip=26&ptl=7&dta=true" -dp:"dui=2397ee06-28fe-4eaa-8777-f7014368c353&dit=20240509130516&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100" -i -v -d -se=true
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\xeysgzac.exe
      "C:\Users\Admin\AppData\Local\Temp\xeysgzac.exe" /silent
      4⤵
      PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\nspB4D1.tmp\RAVEndPointProtection-installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nspB4D1.tmp\RAVEndPointProtection-installer.exe" "C:\Users\Admin\AppData\Local\Temp\xeysgzac.exe" /silent
        5⤵
        
        PID:2272
      - C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
        
        "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
        6⤵
        
        PID:184
- - C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component1_extract\saBSI.exe
    "C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component1_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component1_extract\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component1_extract\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
      4⤵
      PID:4644
    - - C:\Program Files\McAfee\Temp2890373203\installer.exe
        
        "C:\Program Files\McAfee\Temp2890373203\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        5⤵
        
        PID:1876
- - C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component2_extract\avg_secure_browser_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component2_extract\avg_secure_browser_setup.exe" /s /run_source=avg_ads_is_control /is_pixel_psh=BjYV6dEDZfwoKKvin0lr4lLrsf1bH8M8pyqMPqIgQPJeS8NOMZGVy6rfBgyf916tHyGjNCSc9kvBdHd /make-default
    3⤵
    PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\AVGBrowserUpdateSetup.exe
      AVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9230&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies --auto-launch-chrome"
      4⤵
      PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:3652

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:756

C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GUME8FF.tmp\@PaxHeader

Filesize
28B

MD5
18330208ef6aab76efbb3a2f5074711b

SHA1
94001289de5db8513ddda6dc0cc4a5a9236479d3

SHA256
3aa0aaac67bf9f5ae6ff29f44303897fec3d0a56d508240d909ebbce273c40ee

SHA512
2a47dec6bcbf06aebee24e6b8997e14fc9f2a26ca78df714459021015778e3d0190c5f6a02271ff01e3a5763d078f5a9384e97d888b4d495c3981923202b0269

Download Submit
C:\Program Files (x86)\GUME8FF.tmp\@PaxHeader

Filesize
27B

MD5
939ee98d23d3ce9a0c8a0fe9aac02cf2

SHA1
b48224bddd5ad890d749f1dd16de6f9c5d9b2af5

SHA256
cea3426ac194b93a31f869d26e69045effc10a0d89962220724557136625ba39

SHA512
caddc19a06aa9bba35641c5b8b2055c18e7f8c89f0603869be5ef7b283c83ab4efc1213ba18c536007babc492ced62e406ba34af96c3a949d3378b5cae0ad881

Download Submit
C:\Program Files\McAfee\Temp2890373203\analyticsmanager.cab

Filesize
1.1MB

MD5
635c7b63b1ec1ff1c0a56667be5a1f24

SHA1
62b4ff9fab8f0fa32c57314b860e877bc5d2d17e

SHA256
1d8fe7339b326dedc6c5e967c9082b1ee236b6d04cb1edf60a9bc74cfcf3adcf

SHA512
bedfc527719d02318aa11fe56a0d343e731b24ad73d30842a38c202a6b113aa2fc7c4df130944595c3d06a4664eef670e83299b684f4fd203e60540b94a040d2

Download Submit
C:\Program Files\McAfee\Temp2890373203\analyticstelemetry.cab

Filesize
57KB

MD5
fc2f204b92db0e8daec09ae45cedbc96

SHA1
5d16a19f70224e97cfc383143ddbf5f6b5565f19

SHA256
22f38866a64fcc685be87a949f17d0bc85d20c9d5f6aec1ad469d59f099383c6

SHA512
32fd7845c34ff4df8b7ec5d041c4de1a577cb686d7b6b9bfe10897edd1b5dab503ff1fd5b6e729f0a081fff41d5b273cbd188dd7952c27366cf3f5c3b3fd3637

Download Submit
C:\Program Files\McAfee\Temp2890373203\browserhost.cab

Filesize
628KB

MD5
eafee561b67277cd03fd209443ccb6c8

SHA1
2e4b749ebb0151a0580758fc7dceb6a0ec212242

SHA256
fa209407e199e4784f08026bdc7ec3fffa006f91030bd97507b753026232b742

SHA512
d78e72159626fa6b74571b74acff5e25be5361d0177d6e03c7c38eacac49ce9629023c38ad18fa170be1b68562baa3387c3cf45f42c717f2e19e2cdbdff786c5

Download Submit
C:\Program Files\McAfee\Temp2890373203\browserplugin.cab

Filesize
960KB

MD5
691bd3b3d8694505cf0d4eb024da25f0

SHA1
1f469a963aaed14ccb995984b961b7b7edc70f7c

SHA256
8f2f0bbcd1834365840e6924ee3283137695a037a308dca4fcc434b71411d009

SHA512
12fd12eaa771286c379a7fb346dd03d37af60a687e63faf202364410a40cc080c897f17c49b23b8ebafdd6a27e03a7c0d69e188e63a324374293b5893a1a47ab

Download Submit
C:\Program Files\McAfee\Temp2890373203\downloadscan.cab

Filesize
768KB

MD5
3a69be952e7f621f8e6da7fe737326b2

SHA1
966d79dde24cc50b06aa88fabc376143017585f4

SHA256
3fee23818b9cb1d86c15ab5d18ad77a2a29958e3aa906610bcb3bb192dc95269

SHA512
4fcc11058f92f2a137d9c7c32e692418803fece4d9f00cb78358208edd1aa0ce1a0fafa94544a75746d9cfd4d6ea94c8506b6e728f78bb94be6b063078c0b4d4

Download Submit
C:\Program Files\McAfee\Temp2890373203\eventmanager.cab

Filesize
832KB

MD5
fdc318e9a7ec5cc833b646fbcefca7e0

SHA1
495939cfb3d8d14a5ff6963fd98f22dc801728d3

SHA256
5b7ed099044154c05b58e50894522f142db53f12e4fc63b16180ab37631aaaf1

SHA512
c7b36035acbae8201068522e24e4c97ab45116ff2362b92d094e23b61b6020b213569e4b3d049bd5fed9e37f26b2d12fb0645db64ac116e1e3c31a39bb05eafa

Download Submit
C:\Program Files\McAfee\Temp2890373203\installer.exe

Filesize
1.4MB

MD5
ae9b007ac3aab83e59383d0939dadaf3

SHA1
348927a10b411870be4242be9bee8d67833524b6

SHA256
3efef32f9e8aabaa5a391b1d8bef6efbfc5ab8e46792e8dec867454bb9b5a2f4

SHA512
ed60852fa437241914315e2d3166df0a757b10a2de1a8240f4d023cba2cdd152399b2363fbe2e30fa77d536912ec71f9965574075f9b28e41eb6254290327680

Download Submit
C:\Program Files\McAfee\Temp2890373203\installer.exe

Filesize
1.5MB

MD5
dffd9a4a5c824b7597ddc109ef6a6cab

SHA1
e4808bce521e37ba0329cd3bbd325edf9ca8a49f

SHA256
b88489cdbfa27baa9b08c1c6d6a2932ed007de0bcf9ec58d9d6110ae4b3b8d43

SHA512
a280255bad7b2c1131803ae2212f4c3e6eaed01c87b23bea60216b1038473930881f458d8721d38ec945a957068c046039122fe5db287c100dae249d5698455c

Download Submit
C:\Program Files\McAfee\Temp2890373203\l10n.cab

Filesize
274KB

MD5
d2d49a3e1e9a75f4908d8bafeec64a8a

SHA1
7b73095c122d816f07d7372920025ee07a34452f

SHA256
ae57687e54b8f26ac9a233cb382a96a2f11b6ea3722feceab3fe6ef73e1a9cc7

SHA512
6bb7d5db7ae08d1bad860a2467da10d92794f73594ee20e044747f4129f4b2f89dcca1cd52662d5ad88c7279798b457585605c03dc7b9f1817fedf072dec5e8b

Download Submit
C:\Program Files\McAfee\Temp2890373203\logicmodule.cab

Filesize
628KB

MD5
c0aa1ca97c283a8bf943b81aee8f7cb2

SHA1
83b61ee63b73f6ba11edbee81d61c4e7f8993800

SHA256
bc3a2ae0c5aa7a14fa22590ff90fffb6aaea75ba4d352129a9a48d186173d3cb

SHA512
92c8f42b139f66c6dca8607d9ea05aed0de85f9d32c8184554f9e830dcd1ea0bbedc9dd7e434bcf413d9763e73d193aea40ff217ea80b8237e1ba3c8f9659cae

Download Submit
C:\Program Files\McAfee\Temp2890373203\logicscripts.cab

Filesize
57KB

MD5
f2158db4bebd54b26773c843729007a7

SHA1
94e4f3e571f9d65a9a273147752a6767477284bd

SHA256
2e8f526789472335dd0c9d847965c104153260aab2f42d4848648babd02a2b30

SHA512
7de44a11aa0cf50b497b189aa5ee30b0a204d6f47f1d584a8d265b227d64bb3c3f66bdd47f5ef60395ece010dbbb9b0d7af56bd27ff7c8b6b3a64f0758e4cd09

Download Submit
C:\Program Files\McAfee\Temp2890373203\lookupmanager.cab

Filesize
640KB

MD5
a3f2b87a6448ce1820c7f02047dfacfe

SHA1
34f5a8b1fa37a96a38f6b0c6b411c5cf26eb773b

SHA256
5f867b720118e7e53188610392515e4c63325d73a5fc5422d14ed07ba6f4ad40

SHA512
58aed40a166ed59af64901544adb33d0a7564563deb420c1724d3775286fda5120a20eb249d5903d3a0def9f63efef3f568ce0039cfe614c82738860255d6650

Download Submit
C:\Program Files\McAfee\Temp2890373203\mfw-mwb.cab

Filesize
30KB

MD5
de22a82e15c63e0dd5d76f3784baf2e5

SHA1
6388f8ced47ff3f0fde51523e489c7c7d685367c

SHA256
127b786e92568718d16aac814f0472356e5a49ff44d6803cd79f8ac0bd91154e

SHA512
69227b9b6a77c4182756496faea49b7ca01865277896e77a58841f60ddbf716c3880ad797b2947a8e92fc8f0bf57e95da0cddba8065b322ab95b0081676ea184

Download Submit
C:\Program Files\McAfee\Temp2890373203\mfw-nps.cab

Filesize
33KB

MD5
d9ca680b1fcd3930a7e88164d29835ad

SHA1
46e5f1906e3535936326529c81bad3ca77eba700

SHA256
b32933bd6e5b2f0d2928e92546195120375bbc8da68533e577adf6c54ea4ec0a

SHA512
45614f889ec7b1c30f5186bf61d4d82705f9175604cd82972a29b612f6fa4eb230179506adfc14bcfd5097890c9ebb37db54a96f80e781e742fe35e8c68b17eb

Download Submit
C:\Program Files\McAfee\Temp2890373203\mfw-webadvisor.cab

Filesize
526KB

MD5
eafd09a23aad00ca3249dbeac5e4b856

SHA1
6d728e4d37391ccdb1f3f9b86e71872c73915b41

SHA256
78f54becab421537b68427b54e4a5fdcc395ddcc997beff17f4340ea5cb802e8

SHA512
15c2953f2a78d59013ae5e89dd16085370c8885786a8643ee18b0ec5b38f615f43116ff4acccb3ccd698255719265cb47e18e1af8b8b35b47490ff2f1dfa73fa

Download Submit
C:\Program Files\McAfee\Temp2890373203\mfw.cab

Filesize
310KB

MD5
4b0034ee6db1f4a2a76524f1cc7cc9f4

SHA1
44bc148e2dd5221e1b781bdb56a625588fce9f64

SHA256
36671f49627d8cf811064c59cbf37e43e409b6d8631898614470037edb53c431

SHA512
a90abd80a517bfde5cb365904ee85baf0f3f32558701e4548f2aeb44783f088bd3b969de2068a6b618bdaf501f5f38ec9440f31144d96dcb1b766d19a0579738

Download Submit
C:\Program Files\McAfee\Temp2890373203\resourcedll.cab

Filesize
50KB

MD5
332e2fb2256710f1847bbc4c42cc16c9

SHA1
22f9b2715821a12824e7b1d29344323c212a1527

SHA256
a05f3231e81d726f99fe7ca68810e73ea47ce84fcd7fa42c1a7f2742c1ff3f86

SHA512
c4901db8021c3911e5caca3dc75c8533c61dc1091303473992671c763f12406749551daccfc67931991dbb72d6c279f84cce0ea564157dc01c2159d6527a15c1

Download Submit
C:\Program Files\McAfee\Temp2890373203\servicehost.cab

Filesize
301KB

MD5
9610fb7d9dfa780c7fdf8ef0858d7046

SHA1
460277fad45e3dc76f9991e696a835ee92167900

SHA256
61981b8e0a10d9a3eb697fa4c8b61c0f6b23fe0d22345327b49459b4e4a95c4b

SHA512
866f303d3eace8fc926e4d70d7dee1544e9c034456cc89b2d216baea25db02076bcc884849ab5b25d641ab91b4307a5f90f36cbe816b87ef677acdb290196daf

Download Submit
C:\Program Files\McAfee\Temp2890373203\settingmanager.cab

Filesize
704KB

MD5
ab0ebb8d6c5752975d21b21e4bde0213

SHA1
ee5df21631e1d1d6f9d58d3c310545a820ab81be

SHA256
e7f7a2658f411236dd023fbd2a5e6dbfedfad2a66a41f56158491fccf992ed7d

SHA512
c761aa26da5ee3bfb8a4692cedc533276373fd9f2e3bc4f24b8fa592b89e2e94f97da49d73524968c2dc2fd42fb4dc2fddb67e588232fb99ed71ab539a4cc613

Download Submit
C:\Program Files\McAfee\Temp2890373203\taskmanager.cab

Filesize
605KB

MD5
9fc1665fd67768563b071cb059ee013a

SHA1
43a2cfa61493561956ce13868c4ae7b0029f506d

SHA256
8f446b2c3412622ea8f5b922b154cae4978f8f97e381490b1187a8c253b57dbb

SHA512
333e4198a42f3e4e20145b9e011eb3ff7446d7a35519a0a9bf67b4609354ef14d320f8cf202742f81750b8cecf183d8c7aab6ef3296ae55f21c00b5d6cd1a18c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-A0QT2.tmp\utorrent_installer(2).tmp

Filesize
3.0MB

MD5
27174a5611d8827d1736d9ac8382d19f

SHA1
f000848acdd1c152d32a44c928deace522983886

SHA256
36a40fb99c1b026e59c6ba286a02548c64ec7a7e280b19d3169af9aa3c59b994

SHA512
4b6180facd75a9f10e2122ed1ca513979752f953cb92f8436877aff341b40575125db43293259a291406d95f408fbebbd89081fc07f2a5779ec02e5ead23406d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\AVG_BRW.png

Filesize
29KB

MD5
0b4fa89d69051df475b75ca654752ef6

SHA1
81bf857a2af9e3c3e4632cbb88cd71e40a831a73

SHA256
60a9085cea2e072d4b65748cc71f616d3137c1f0b7eed4f77e1b6c9e3aa78b7e

SHA512
8106a4974f3453a1e894fec8939038a9692fd87096f716e5aa5895aa14ee1c187a9a9760c0d4aec7c1e0cc7614b4a2dbf9b6c297cc0f7a38ba47837bede3b296

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\Logo.png

Filesize
7KB

MD5
5424804c80db74e1304535141a5392c6

SHA1
6d749f3b59672b0c243690811ec3240ff2eced8e

SHA256
9b7e2ea77e518b50e5dd78e0faec509e791949a7c7f360a967c9ee204a8f1412

SHA512
6c7364b9693ce9cbbdbca60ecef3911dfe3d2d836252d7650d34506d2aa41fc5892028ba93f2619caf7edb06576fddae7e5f91f5844b5c3a47f54ca39f84cc6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\RAV_Cross.png

Filesize
74KB

MD5
cd09f361286d1ad2622ba8a57b7613bd

SHA1
4cd3e5d4063b3517a950b9d030841f51f3c5f1b1

SHA256
b92a31d4853d1b2c4e5b9d9624f40b439856d0c6a517e100978cbde8d3c47dc8

SHA512
f73d60c92644e0478107e0402d1c7b4dfa1674f69b41856f74f937a7b57ceaa2b3be9242f2b59f1fcf71063aac6cbe16c594618d1a8cdd181510de3240f31dff

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\WebAdvisor.png

Filesize
47KB

MD5
4cfff8dc30d353cd3d215fd3a5dbac24

SHA1
0f4f73f0dddc75f3506e026ef53c45c6fafbc87e

SHA256
0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856

SHA512
9d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component0.exe

Filesize
44KB

MD5
22804af3d28d68aae796be2b17841ad0

SHA1
217374cb7f10de8e2cc6f6fe761e2ccf3ae17ddc

SHA256
4d79b0dfcb6afbcecc1d7b3a4c3b47dddcf0fa5f45219a2eca766cf29de1d275

SHA512
a311419096e1d87259de18d6c4bc96cded77cbd514f3d967e2233f4e30a095e806426fbf487346abaec1e62122d02a499754252774c1e71114b43926ce28b373

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component1.zip

Filesize
515KB

MD5
f68008b70822bd28c82d13a289deb418

SHA1
06abbe109ba6dfd4153d76cd65bfffae129c41d8

SHA256
cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589

SHA512
fa482942e32e14011ae3c6762c638ccb0a0e8ec0055d2327c3acc381dddf1400de79e4e9321a39a418800d072e59c36b94b13b7eb62751d3aec990fb38ce9253

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component1_extract\installer.exe

Filesize
3.5MB

MD5
1a0b1e1083a6221a547f7497003850f1

SHA1
088be68b10494734b1fa12534e7cb33d5dc0e324

SHA256
02b7df082e39e6a037683909e4612b69008e0cf22640e4eb0bfefed7d07bb461

SHA512
41f08b0e4486bd9e7b9044bc3a0059ceba5b38dfe4fd5cafa62ebe0c69becfd37eff56e9a778316acb67c7b8758b8c3b8c142b09dfe56776ec5cff5112736f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component1_extract\installer.exe

Filesize
2.4MB

MD5
ea40970bcbe9e680866e1beac41d733c

SHA1
e93cc02d3a1902787be967f782be878484948060

SHA256
2d2e992e56350753d7152e2ea6fbba235343b9623f698add7d708cd45d544ec9

SHA512
3740eb64d6f9d9fbc68be7ecc1ea3d85797f4fd6e513eba7f97fe0d38b97c991f00bd706dfbd197a9a25e28c70c1045a42913e7322e89d6461131e7f2e2e3e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component1_extract\saBSI.exe

Filesize
1.1MB

MD5
143255618462a577de27286a272584e1

SHA1
efc032a6822bc57bcd0c9662a6a062be45f11acb

SHA256
f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4

SHA512
c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component2.zip

Filesize
5.7MB

MD5
6406abc4ee622f73e9e6cb618190af02

SHA1
2aa23362907ba1c48eca7f1a372c2933edbb7fa1

SHA256
fd83d239b00a44698959145449ebfcb8c52687327deac04455e77a710a3dfe1b

SHA512
dd8e43f8a8f6c6e491179240bdfefdf30002f3f2900b1a319b4251dfa9ca7b7f87ddf170ba868ab520f94de9cc7d1854e3bcfd439cad1e8b4223c7ee06d649f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\component2_extract\avg_secure_browser_setup.exe

Filesize
5.8MB

MD5
591059d6711881a4b12ad5f74d5781bf

SHA1
33362f43eaf8ad42fd6041d9b08091877fd2efba

SHA256
99e8de20a35a362c2a61c0b9e48fe8eb8fc1df452134e7b6390211ab19121a65

SHA512
6280064a79ca36df725483e3269bc1e729e67716255f18af542531d7824a5d76b38a7dcefca048022c861ffcbd0563028d39310f987076f6a5da6c7898c1984c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HE5OU.tmp\uTorrent.exe

Filesize
3.7MB

MD5
d5bda33383b3ace63aa7df579ccef364

SHA1
804c1a7738d16240c6a3333ee10127a1182679a9

SHA256
44e91f68e2440fcc567530b72bbe0d04c8fc40bdd055d5973bdef62bbb21b857

SHA512
5a8ccc4e288fb493749af784fccea8b87ffe46af1799e1fd409076930f0d76356297922b5044fe15e582218f96b307979a3ea843be0b846a82b4f4bca5be2350

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh54CE.tmp\INetC.dll

Filesize
24KB

MD5
640bff73a5f8e37b202d911e4749b2e9

SHA1
9588dd7561ab7de3bca392b084bec91f3521c879

SHA256
c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

SHA512
39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh54CE.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh54CE.tmp\bt_datachannel.dll

Filesize
4.1MB

MD5
dfca05beb0d6a31913c04b1314ca8b4a

SHA1
5fbbccf13325828016446f63d21250c723578841

SHA256
d4c4e05fade7e76f4a2d0c9c58a6b9b82b761d9951ffddd838c381549368e153

SHA512
858d4fb9d073c51c0ab7a0b896c30e35376678cc12aec189085638376d3cc74c1821495692eac378e4509ef5dcab0e8b950ad5bfab66d2c62ab31bc0a75118cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh54CE.tmp\nsisFirewall.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh54CE.tmp\utorrent.exe

Filesize
2.2MB

MD5
3cdd9138411fe937bb972005782cd7db

SHA1
5d899bd8dd1e5e8ce4191071c8a83234ebfe8869

SHA256
59dc2da6612f57422ad2aaec7acd13da79c441855befb575ac38024b9dd1106f

SHA512
9d7e5845893acfd6773e6098e739035a9c960af0d3dc629b2530d1666474474df2e1cdceb08e3f0293ac57a36dd3cac1278d5c8509d8e486e140999260276fcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspB4D1.tmp\Microsoft.Win32.TaskScheduler.dll

Filesize
341KB

MD5
a09decc59b2c2f715563bb035ee4241e

SHA1
c84f5e2e0f71feef437cf173afeb13fe525a0fea

SHA256
6b8f51508240af3b07a8d0b2dc873cedc3d5d9cb25e57ea1d55626742d1f9149

SHA512
1992c8e1f7e37a58bbf486f76d1320da8e1757d6296c8a7631f35ba2e376de215c65000612364c91508aa3ddf72841f6b823fa60a2b29415a07c74c2e830212b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspB4D1.tmp\RAVEndPointProtection-installer.exe

Filesize
539KB

MD5
41a3c2a1777527a41ddd747072ee3efd

SHA1
44b70207d0883ec1848c3c65c57d8c14fd70e2c3

SHA256
8592bae7b6806e5b30a80892004a7b79f645a16c0f1b85b4b8df809bdb6cf365

SHA512
14df28cc7769cf78b24ab331bd63da896131a2f0fbb29b10199016aef935d376493e937874eb94faf52b06a98e1678a5cf2c2d0d442c31297a9c0996205ed869

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspB4D1.tmp\rsAtom.dll

Filesize
156KB

MD5
9deba7281d8eceefd760874434bd4e91

SHA1
553e6c86efdda04beacee98bcee48a0b0dba6e75

SHA256
02a42d2403f0a61c3a52138c407b41883fa27d9128ecc885cf1d35e4edd6d6b9

SHA512
7a82fbac4ade3a9a29cb877cc716bc8f51b821b533f31f5e0979f0e9aca365b0353e93cc5352a21fbd29df8fc0f9a2025351453032942d580b532ab16acaa306

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspB4D1.tmp\rsJSON.dll

Filesize
218KB

MD5
f8978087767d0006680c2ec43bda6f34

SHA1
755f1357795cb833f0f271c7c87109e719aa4f32

SHA256
221bb12d3f9b2aa40ee21d2d141a8d12e893a8eabc97a04d159aa46aecfa5d3e

SHA512
54f48c6f94659c88d947a366691fbaef3258ed9d63858e64ae007c6f8782f90ede5c9ab423328062c746bc4ba1e8d30887c97015a5e3e52a432a9caa02bb6955

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspB4D1.tmp\rsLogger.dll

Filesize
177KB

MD5
83ad54079827e94479963ba4465a85d7

SHA1
d33efd0f5e59d1ef30c59d74772b4c43162dc6b7

SHA256
ec0a8c14a12fdf8d637408f55e6346da1c64efdd00cc8921f423b1a2c63d3312

SHA512
c294fb8ac2a90c6125f8674ca06593b73b884523737692af3ccaa920851fc283a43c9e2dc928884f97b08fc8974919ec603d1afb5c178acd0c2ebd6746a737e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspB4D1.tmp\rsStubLib.dll

Filesize
248KB

MD5
a16602aad0a611d228af718448ed7cbd

SHA1
ddd9b80306860ae0b126d3e834828091c3720ac5

SHA256
a1f4ba5bb347045d36dcaac3a917236b924c0341c7278f261109bf137dcef95a

SHA512
305a3790a231b4c93b8b4e189e18cb6a06d20b424fd6237d32183c91e2a5c1e863096f4d1b30b73ff15c4c60af269c4faaadaf42687101b1b219795abc70f511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspB4D1.tmp\rsSyncSvc.exe

Filesize
797KB

MD5
ded746a9d2d7b7afcb3abe1a24dd3163

SHA1
a074c9e981491ff566cd45b912e743bd1266c4ae

SHA256
c113072678d5fa03b02d750a5911848ab0e247c4b28cf7b152a858c4b24901b3

SHA512
2c273bf79988df13f9da4019f8071cf3b4480ecd814d3df44b83958f52f49bb668dd2f568293c29ef3545018fea15c9d5902ef88e0ecfebaf60458333fcaa91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspB4D1.tmp\uninstall.ico

Filesize
170KB

MD5
af1c23b1e641e56b3de26f5f643eb7d9

SHA1
6c23deb9b7b0c930533fdbeea0863173d99cf323

SHA256
0d3a05e1b06403f2130a6e827b1982d2af0495cdd42deb180ca0ce4f20db5058

SHA512
0c503ec7e83a5bfd59ec8ccc80f6c54412263afd24835b8b4272a79c440a0c106875b5c3b9a521a937f0615eb4f112d1d6826948ad5fb6fd173c5c51cb7168f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\AVGBrowserUpdateSetup.exe

Filesize
1.1MB

MD5
b66d283d76ddfdb8d2ff71bcacd0625e

SHA1
abede59f8d500010e44143747ce63e41adf540c0

SHA256
8f8e26137910dc063773b97f76f8a3b23194ca8035695a58d98cf29b4b315a73

SHA512
6a20ee22664f98e965a1aa76ef9e9f2358e6d710eff4b6ced25fb8daa246d2b755fe54923f828890b242e7cd716f8d78caf572964c685f433ee05306e18dc268

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\AVGBrowserUpdateSetup.exe

Filesize
576KB

MD5
96612028b4ce340db159f324879adf8b

SHA1
2e78436a29a4c3a503eccbad3e94666e452e92d8

SHA256
57794b3b1b25dcb87de97668a9a889537214e22cb3548f6009e4318aebb047da

SHA512
04b420959a6e6f794c4fd84c0431c476cea1990a954f8460eaaf04e3c1eebaaca6964a41372a19fcf3d79dfb348cb393c48be001cfa5b8d26649b26bfe98f1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\CR.History.tmp

Filesize
192KB

MD5
8ccb6c13863fb6e99ed9a29a95f273fe

SHA1
b809aadcbd64fc29edb0cf27fb223784563a911f

SHA256
6b5e07d7137e1d3bee13888a7e8c81fae36ef046c9c7ba074e5fef67e6a594b4

SHA512
635bd5e4a1f9c0bf4dd331912f47d65de52496ae4e8fd8de84fac2008064c5c07b60fc33dd318cdf091ad9de2d14a0ff326a95d14f8084f0e5abbcaa98c7f0bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\CR.History.tmp

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\FF.places.tmp

Filesize
5.0MB

MD5
b8787406d75f708bea34db2858975817

SHA1
c0dae8260114f0bb658430f8b80e7cdf64ac48a1

SHA256
fea0554d9d780ef4835220bbbf16cc2fc932d5fba36798dc513c20af588b903d

SHA512
1d689111a9c091f65acc635661a826b21380cd4c3b6966458d75988d8274eb60edeafe45ef39b193050d808629129c0be675e1bca13e695baa40b565b24b95f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\JsisPlugins.dll

Filesize
2.1MB

MD5
bd94620c8a3496f0922d7a443c750047

SHA1
23c4cb2b4d5f5256e76e54969e7e352263abf057

SHA256
c0af9e25c35650f43de4e8a57bb89d43099beead4ca6af6be846319ff84d7644

SHA512
954006d27ed365fdf54327d64f05b950c2f0881e395257b87ba8e4cc608ec4771deb490d57dc988571a2e66f730e04e8fe16f356a06070abda1de9f3b0c3da68

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\Midex.dll

Filesize
126KB

MD5
581c4a0b8de60868b89074fe94eb27b9

SHA1
70b8bdfddb08164f9d52033305d535b7db2599f6

SHA256
b13c23af49da0a21959e564cbca8e6b94c181c5eeb95150b29c94ff6afb8f9dd

SHA512
94290e72871c622fc32e9661719066bafb9b393e10ed397cae8a6f0c8be6ed0df88e5414f39bc528bf9a81980bdcb621745b6c712f4878f0447595cec59ee33d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\StdUtils.dll

Filesize
195KB

MD5
7602b88d488e54b717a7086605cd6d8d

SHA1
c01200d911e744bdffa7f31b3c23068971494485

SHA256
2640e4f09aa4c117036bfddd12dc02834e66400392761386bd1fe172a6ddfa11

SHA512
a11b68bdaecc1fe3d04246cfd62dd1bb4ef5f360125b40dadf8d475e603e14f24cf35335e01e985f0e7adcf785fdf6c57c7856722bc8dcb4dd2a1f817b1dde3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\jsis.dll

Filesize
127KB

MD5
4b27df9758c01833e92c51c24ce9e1d5

SHA1
c3e227564de6808e542d2a91bbc70653cf88d040

SHA256
d37408f77b7a4e7c60800b6d60c47305b487e8e21c82a416784864bd9f26e7bb

SHA512
666f1b99d65169ec5b8bc41cdbbc5fe06bcb9872b7d628cb5ece051630a38678291ddc84862101c727f386c75b750c067177e6e67c1f69ab9f5c2e24367659f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\nsJSON.dll

Filesize
36KB

MD5
ddb56a646aea54615b29ce7df8cd31b8

SHA1
0ea1a1528faafd930ddceb226d9deaf4fa53c8b2

SHA256
07e602c54086a8fa111f83a38c2f3ee239f49328990212c2b3a295fade2b5069

SHA512
5d5d6ee7ac7454a72059be736ec8da82572f56e86454c5cbfe26e7956752b6df845a6b0fada76d92473033ca68cd9f87c8e60ac664320b015bb352915abe33c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB27F.tmp\thirdparty.dll

Filesize
93KB

MD5
070335e8e52a288bdb45db1c840d446b

SHA1
9db1be3d0ab572c5e969fea8d38a217b4d23cab2

SHA256
c8cf0cf1c2b8b14cbedfe621d81a79c80d70f587d698ad6dfb54bbe8e346fbbc

SHA512
6f49b82c5dbb84070794bae21b86e39d47f1a133b25e09f6a237689fd58b7338ae95440ae52c83fda92466d723385a1ceaf335284d4506757a508abff9d4b44c

Download Submit
C:\Users\Admin\AppData\Local\Temp\xeysgzac.exe

Filesize
1.9MB

MD5
d4263cb2c55fe27633425e7169ef3f88

SHA1
a2c968ea0656a63ec3025eeac12f582b2821ffc1

SHA256
0c9afd307ecdb75bd6139a89ad963c71a27dd4e1cf9fd4a96e538b31c4713f88

SHA512
40b91796a0dd96403db79e63e2527290133f55542ff06ca7b5d6375467fed6a3eafd0a00d87e0babbcfe8993edd87b1c140dafc017e47b271ba25b453206668b

Download Submit
memory/372-0-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/372-10-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/372-6-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/372-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/404-54-0x0000000004AE0000-0x0000000004AEF000-memory.dmp

Filesize
60KB

Download
memory/404-47-0x0000000004AE0000-0x0000000004AEF000-memory.dmp

Filesize
60KB

Download
memory/404-7-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/404-11-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/404-166-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/404-18-0x0000000004AE0000-0x0000000004AEF000-memory.dmp

Filesize
60KB

Download
memory/404-25-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/404-347-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/404-81-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/404-26-0x0000000004AE0000-0x0000000004AEF000-memory.dmp

Filesize
60KB

Download
memory/404-56-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/404-53-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/404-33-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/404-35-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/404-46-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/1032-136-0x0000000000400000-0x00000000009C2000-memory.dmp

Filesize
5.8MB

Download
memory/1032-110-0x0000000000400000-0x00000000009C2000-memory.dmp

Filesize
5.8MB

Download
memory/1876-569-0x00007FF802660000-0x00007FF802670000-memory.dmp

Filesize
64KB

Download
memory/2272-337-0x00000135F5E10000-0x00000135F5E3A000-memory.dmp

Filesize
168KB

Download
memory/2272-335-0x00000135F5CA0000-0x00000135F5CDA000-memory.dmp

Filesize
232KB

Download
memory/2272-379-0x00000135F5EA0000-0x00000135F5EF8000-memory.dmp

Filesize
352KB

Download
memory/2272-333-0x00000135DD4C0000-0x00000135DD4F0000-memory.dmp

Filesize
192KB

Download
memory/2272-331-0x00000135DD480000-0x00000135DD4C0000-memory.dmp

Filesize
256KB

Download
memory/2272-310-0x00000135DB700000-0x00000135DB788000-memory.dmp

Filesize
544KB

Download
memory/4412-168-0x000001A9B5570000-0x000001A9B5A98000-memory.dmp

Filesize
5.2MB

Download
memory/4412-162-0x000001A99A940000-0x000001A99A948000-memory.dmp

Filesize
32KB

Download