Resubmissions
26/05/2024, 01:38
240526-b2c1xsah521025/05/2024, 09:47
240525-lsdafach9x1025/05/2024, 09:43
240525-lqck5adc971Analysis
- max time kernel
1044s - max time network
874s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
25/05/2024, 09:47
General
- Target http://goo.gle
- Sample240525-lsdafach9x
Malware Config
Extracted
-
C:\Users\Admin\Downloads\@[email protected]
-
wannacry
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
-
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Wannacry
WannaCry is a ransomware cryptoworm.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Downloads MZ/PE file
- Drops file in Drivers directory 60 IoCs
- Sets service image path in registry 2 TTPs 15 IoCs
- Drops startup file 2 IoCs
- Executes dropped EXE 36 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 13 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks for any installed AV software in registry 1 TTPs 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 17 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 3 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 8 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 13 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 35 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://goo.gle1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffff2c9ab58,0x7ffff2c9ab68,0x7ffff2c9ab782⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3976 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3216 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4640 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1556 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4672 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4080 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5048 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4852 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4856 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5000 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5684 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5216 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5664 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5100 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw.42aaff2b4717b308\avast_free_antivirus_setup_online_x64.exe"C:\Windows\Temp\asw.42aaff2b4717b308\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_012_999_a8e_m:dlid_FAV-PPC /ga_clientid:ed2c5185-16f1-435e-a25f-1af5809b3260 /edat_dir:C:\Windows\Temp\asw.42aaff2b4717b3083⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw.1f8ba340a1b4f632\instup.exe"C:\Windows\Temp\asw.1f8ba340a1b4f632\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.1f8ba340a1b4f632 /edition:1 /prod:ais /stub_context:da7252d7-f298-43bb-9abc-979eae9f9d14:9946736 /guid:6aa12bb9-dd23-4b16-979a-d508564eb5b9 /ga_clientid:ed2c5185-16f1-435e-a25f-1af5809b3260 /cookie:mmm_ava_012_999_a8e_m:dlid_FAV-PPC /ga_clientid:ed2c5185-16f1-435e-a25f-1af5809b3260 /edat_dir:C:\Windows\Temp\asw.42aaff2b4717b3084⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\instup.exe"C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.1f8ba340a1b4f632 /edition:1 /prod:ais /stub_context:da7252d7-f298-43bb-9abc-979eae9f9d14:9946736 /guid:6aa12bb9-dd23-4b16-979a-d508564eb5b9 /ga_clientid:ed2c5185-16f1-435e-a25f-1af5809b3260 /cookie:mmm_ava_012_999_a8e_m:dlid_FAV-PPC /edat_dir:C:\Windows\Temp\asw.42aaff2b4717b308 /online_installer5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe"C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe" -checkGToolbar -elevated6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe"C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe" /check_secure_browser6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe"C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe" -checkChrome -elevated6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe"C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC7⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe"C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC7⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe"C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\aswOfferTool.exe" -checkChrome -elevated6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\sbr.exe"C:\Windows\Temp\asw.1f8ba340a1b4f632\New_180417e0\sbr.exe" 860 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRdr2.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswVmm.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRvrt.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /elaminst C:\Windows\system32\drivers\aswElam.sys6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\AvEmUpdate.exe"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer /reg6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\AvEmUpdate.exe"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer16⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\x86\RegSvr.exe"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\aswAMSI.dll"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\RegSvr.exe"C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\aswAMSI.dll"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\x86\RegSvr.exe"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\asOutExt.dll"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\RegSvr.exe"C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\asOutExt.dll"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" /install6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /catinstall:"C:\Program Files\Avast Software\Avast\setup\crts.cat" /basename:pkg_{af98c830-4f53-4176-a7b0-ec21fc603adc}.cat /crtid:D9D1E63123760F5EE0F69B6613E0933E9CBCAB116⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe"C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe" /skip_uptime /skip_remediations6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\defs\24052399\engsup.exe"C:\Program Files\Avast Software\Avast\defs\24052399\engsup.exe" /prepare_definitions_folder6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\wsc_proxy.exe"C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /svc /register /ppl_svc6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
C:\Program Files\Avast Software\Avast\avDump.exe"C:\Program Files\Avast Software\Avast\avDump.exe" --pid 11560 --exception_ptr 00000003A1EFE8D0 --thread_id 11564 --dump_level 0 --handle_data 1 --dump_file "C:\ProgramData\Avast Software\Avast\log\unp311087444055664381x-manual.mdmp" --comment "Cause: VectoredExceptionHandler Exception: sd is not loaded" --min_interval 607⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Avast Software\Avast\defs\24052399\engsup.exe"C:\Program Files\Avast Software\Avast\defs\24052399\engsup.exe" /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie /get_latest_trpar6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=2360 --field-trial-handle=1896,i,13150096940060440406,383184807998595818,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\system32\UserAccountControlSettings.exe"C:\Windows\system32\UserAccountControlSettings.exe"1⤵
-
C:\Windows\system32\UserAccountControlSettings.exe"C:\Windows\system32\UserAccountControlSettings.exe" /applySettings1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffff26d46f8,0x7ffff26d4708,0x7ffff26d47182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5332 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3576 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6076 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6540 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6692 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15957325696373953632,17599813726879628885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1152 /prefetch:12⤵
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\WannaCry.EXE"C:\Users\Admin\Downloads\WannaCry.EXE"1⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Users\Admin\Downloads\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 255421716630680.bat2⤵
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
- Loads dropped DLL
- Checks processor information in registry
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exe
-
C:\Users\Admin\Downloads\@[email protected]
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Checks processor information in registry
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
5Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
asw057b3c2fbe21e36b.tmp
asw0bdac1f66ea5622c.tmp
asw17132cd5aefdb68e.tmp
asw39ca57c755584adb.tmp
asw8c26993a46b75a72.tmp
aswb1324c0042209131.tmp
aswbd6bda24fe6b3eff.tmp
asw89856662ffbe91a0.tmp
aswa131a4f2ab2e299b.tmp
aswa70f8cee7979f857.tmp
asw0f6dd8fcd7fa8df3.tmp
asw101c20515ae2a390.tmp
asw115771ccbff5f60e.tmp
asw19fbb97d85bd983f.tmp
asw2e9f867503f57d78.tmp
asw31e8c3fe4f538bec.tmp
asw32a51efdc415a20f.tmp
asw38417fbff2e30655.tmp
asw3d23ac14ec0437c8.tmp
asw3f531de2077cf8ce.tmp
asw4ace171bc0a0a1c6.tmp
asw4b7bff6c34ab6b9b.tmp
asw4dcafcce79d4845a.tmp
asw559c2da54fb1fba9.tmp
asw57947c35f4834d8c.tmp
asw595bea43c1e54882.tmp
asw5d40b24273a19bd6.tmp
asw61d94ecb4c086051.tmp
asw67896bd436906abe.tmp
asw76e876d5aeee30c2.tmp
asw78ce6edc1c829c87.tmp
asw81442bea328c8a6e.tmp
asw83ae0675b2b26435.tmp
asw902f74e57a4ecbd9.tmp
asw9095ce569ca57f19.tmp
asw986075566bd3d43f.tmp
aswa277bc3610e67510.tmp
aswa3082dc591625a5a.tmp
aswaae5d656ee135a6c.tmp
aswafe780c1f4c014e8.tmp
aswb2fe545ac267205e.tmp
aswc8f4d7dd0081adbf.tmp
aswcf12586015befd95.tmp
aswd39b1f26b488cc4e.tmp
aswe307578238514f73.tmp
aswf86de1599c157aa8.tmp
aswf9aaecaaf3d2d8bb.tmp
aswfbfa6c522f3fa629.tmp
asw1877f9da6ac2daf3.tmp
asw373228b68d2b2ba4.tmp
asw47a0efdbd0d9d178.tmp
asw7cc25b8684ed18a6.tmp
asw91968efbda97db78.tmp
asw91b59b40bddea1db.tmp
aswb77d12fbbd80e602.tmp
aswb84126cdd88e3319.tmp
aswc1b3b75a95946603.tmp
aswde618acf0b8dde1c.tmp
aswfe4f919117b432ac.tmp
ashServ.dll
asw01b69202db0fa323.tmp
asw01f49eec83daf23c.tmp
asw034f85f62fe05508.tmp
asw05c7c345df316b05.tmp
asw0aed35536247692d.tmp
asw0b3dc1f7a7f2220e.tmp
asw1042d344518df8d6.tmp
asw1529c7be7bc0634c.tmp
asw1d0e229decc6656a.tmp
asw1f7df88fa386deb8.tmp
asw27c58827d7e406e5.tmp
asw29c8604c81f3830b.tmp
asw2a6a0569d9dc2521.tmp
asw2c5f5ecb0ad457b6.tmp
asw2e07d5e5658621f2.tmp
asw2f951f13f745f8cd.tmp
asw33b3b8c50c803a20.tmp
asw3ccb843e1f9e059d.tmp
asw40835d987e211295.tmp
asw41672dc0dbe269fd.tmp
asw42713862d5a9406a.tmp
asw429ebc94df584158.tmp
asw42fb836e94507a8e.tmp
asw43095a78f6d20c06.tmp
asw46067ce6cb0b74cc.tmp
asw473a119f05c979e1.tmp
asw478b9fb6deb1335d.tmp
asw4f2e65071e908e31.tmp
asw509b44ef8d921455.tmp
asw51fc708592fa0488.tmp
asw52bc0934f16b6e00.tmp
asw549b16bcde4ab3b7.tmp
asw5633208c5c433b8e.tmp
asw590cd6c4ea476560.tmp
asw593d2731d3aacbac.tmp
asw5e4f584dcdbca7e6.tmp
asw639f23d8c204cac3.tmp
asw63d78e9d0c7a7072.tmp
asw63dd6a40531ccdec.tmp
asw64621423935243e7.tmp
asw65821f7846cc8319.tmp
asw6f5869104bde908c.tmp
asw6fe55c7b42c228ef.tmp
asw70e88ac31a62f02a.tmp
asw74848eefc0cc965b.tmp
asw74c56676e173385e.tmp
asw752f7bab0dc5fd28.tmp
asw77b6917047cec4d2.tmp
asw79bed6f4cc6542d1.tmp
asw7b2bae4d4138044a.tmp
asw7c3689da48b9a46e.tmp
asw7f90670803f97c1e.tmp
asw8140f419671d0458.tmp
asw8197bb7beeed6c6b.tmp
asw8305b92833d8eb81.tmp
asw84c5327162641430.tmp
asw86786203ea0c49ac.tmp
asw8832520566f175eb.tmp
asw8da07ba46810e3a8.tmp
asw8dad5e7ed1196ebf.tmp
asw92d173916b1dcb02.tmp
asw95405666969adca0.tmp
asw95592db38a1bec11.tmp
asw974f53aedb891ddd.tmp
asw99efa385e3b7bfed.tmp
asw9a2c760abd16b5b0.tmp
asw9a99c2b7b4f4c81a.tmp
asw9afc2d74385b23e4.tmp
asw9b7854498d1de420.tmp
asw9c1932f6f874b992.tmp
asw9f9c1538dd04f063.tmp
asw9fe2d3d4c47d8fa0.tmp
aswa19f4177e9411b7e.tmp
aswa270bd5ee3248435.tmp
aswa480640cbc3c9d47.tmp
aswa9d5f506cf999fd7.tmp
aswaece4ef92fba4f20.tmp
aswb65ed71b477b67da.tmp
aswb7599baa88deebe8.tmp
aswb8115b3cf1d161d7.tmp
aswb9074088c164a7b2.tmp
aswbbf9b2e02a505c8e.tmp
aswbca9844f289908d7.tmp
aswbff91a1a96e39233.tmp
aswc2aec1e10553ec4f.tmp
aswc6f260ea0eb8a17e.tmp
aswc7277d1766741e19.tmp
aswca30b7649f170546.tmp
aswcb58bf86b2ff1831.tmp
aswcbcc7219232e7bcb.tmp
aswcbf8b210f9b14171.tmp
aswd1d33187e33574ef.tmp
aswd4575a196b89fed1.tmp
aswd85df2cd70fe80fb.tmp
aswda2197e83d964a09.tmp
aswde336714f0c735f9.tmp
aswe172694d2fdb5c19.tmp
aswe34bbdb28d5d2e47.tmp
aswe6b88546c538af4b.tmp
aswec251c67d8ecf8b0.tmp
aswed615acd4bcf8902.tmp
aswf42a999d11a132da.tmp
aswf7195343803d48f7.tmp
aswf873b35f39dec77b.tmp
aswf968e77da3f53a7a.tmp
aswf9918aad893f3e8e.tmp
asw07a3d510de5bdf64.tmp
asw0e35b70c7d81dccf.tmp
asw10356d93c9a9c615.tmp
asw1102921b03952f9c.tmp
asw14abf1ee71fb6898.tmp
asw155715983a75f840.tmp
asw19de758cfd959878.tmp
asw21a6ccd20b3fd316.tmp
asw2a046b918d904644.tmp
asw33ac7f9e6981b997.tmp
asw33b5519dfc29e92e.tmp
asw34cfb0f60ee9cb51.tmp
asw455e6686800048da.tmp
asw456267b82d39e615.tmp
asw45e0d98b99a3348e.tmp
asw45f8862c470c7323.tmp
asw513b8b029652e78f.tmp
asw558250f861b43bb9.tmp
asw5ab65bb369edf58e.tmp
asw5ce257fa88bc03ba.tmp
asw5d742dc8aec2ef2c.tmp
asw5e918388d76c5e96.tmp
asw608fce60d1efcbc6.tmp
asw6cba0f2f604e8ca7.tmp
asw7638f190daba296f.tmp
asw768f022ac034362b.tmp
asw76ad16de61b6adf5.tmp
asw89138e75acd81b5f.tmp
asw8a35b943f285aaac.tmp
asw8c4755dde6ae1238.tmp
asw8d306b26f8812f6f.tmp
asw980456b6947db679.tmp
asw9b3256c2b2b2358b.tmp
asw9ddb3ce6c405e430.tmp
aswa23a8f55468d65c2.tmp
aswa43e6513f8ba86b2.tmp
aswad28cc77812e2224.tmp
aswb5e668fdef26a388.tmp
aswb77a1fb6ab8abf0f.tmp
aswb7bffdb02219337a.tmp
aswba36c86d50238328.tmp
aswbaf99ce2ebfd33da.tmp
aswbe085f08e2c48067.tmp
aswc294952756dbf667.tmp
aswcd996418a9794a8b.tmp
aswd1c80fee736406b8.tmp
aswd76060540bdbb5b6.tmp
aswdb007cf2eb332b12.tmp
aswe98f415e2b77e997.tmp
asweed77de186bf9d8a.tmp
aswf4f7e47e9d3c0806.tmp
aswf6b05a0c9b92a5d9.tmp
aswf8e83a91c573e425.tmp
aswfe6b671affa6f456.tmp
asw071d0fa0c5765c4c.tmp
asw0d473d2368143a86.tmp
asw0e658c9aae686ec6.tmp
asw1414834b599e70b0.tmp
asw179d984ace7d86af.tmp
asw1d217630ac1baacb.tmp
asw1f791a97c57caa7c.tmp
asw202d0368d88b0706.tmp
asw24b3a8e8056dfa41.tmp
asw26400a4b2ffe0fa7.tmp
asw274f110df22dfc76.tmp
asw27a7a906ea354c4c.tmp
asw2a2047459df5d111.tmp
asw2c8e763b1bc7002f.tmp
asw3171f7c3d80ca1eb.tmp
asw324083233d47e3f8.tmp
asw342840c7cb565e3a.tmp
asw344336fb0545d3ff.tmp
asw345325cdc97a23d5.tmp
asw3ab42e02b6be931e.tmp
asw3b6b8bf37302c710.tmp
asw3e2e4f5c271a8079.tmp
asw3e8418b38e3c93ec.tmp
asw45ede83020ff6441.tmp
asw46d3cf5a19e1820f.tmp
asw46e7c1dffda66f4c.tmp
asw4773b19fd980ad51.tmp
asw4bef27a69330a90c.tmp
asw4fed37fafd59b582.tmp
asw546aa5868f475a27.tmp
asw54b612e013579be1.tmp
asw5d7b7b523955fd3f.tmp
asw5f51a1b37c44dba8.tmp
asw67999df524360602.tmp
asw685c58d9b923f34d.tmp
asw69fcf74d7b113ea7.tmp
asw6a899f4eb280dca6.tmp
asw72011186030f2713.tmp
asw72855973e92dca26.tmp
asw7928b5bf7f241183.tmp
asw7afeb899a6698795.tmp
asw7e3104e9d904e615.tmp
asw8054c3801c9ee2a1.tmp
asw816c01693d38a87d.tmp
asw81db96197bee63d8.tmp
asw84973a757395e0b9.tmp
asw8963e6a6ce0abcad.tmp
asw8f80dbb34ec2de07.tmp
asw8f89bf9ab563edb2.tmp
asw90de4f72006f5ea6.tmp
asw9328c320bf0b6c59.tmp
asw973441a6fbfeef49.tmp
asw9871bec2a0ab2d46.tmp
asw98bb8473ff8541c0.tmp
asw9a9086c3a282382c.tmp
asw9b2358f5d8c9c01e.tmp
asw9b48e0ec2b992cbe.tmp
asw9b70eb84b09440bf.tmp
asw9bf4a4e6803b72d1.tmp
aswa1c6a7a4690567ff.tmp
aswa690b40831be3dc2.tmp
aswa81965bf29ba8824.tmp
aswacdcb5879ba32e82.tmp
aswad04c5cddecd4766.tmp
aswaeb9aefe83b9d4ee.tmp
aswaee4c46f784bccf3.tmp
aswb0ef295dfe6eac08.tmp
aswb785fc7d571d0f1e.tmp
aswc2beb111b75e5e7d.tmp
aswc33e90ec76454eb1.tmp
aswc3c58b5ae0cc2b90.tmp
aswc5c08ee270211f49.tmp
aswcd8dea1c60e0f0b0.tmp
aswd0bf1c99f31d0efa.tmp
aswd7acf0a491d916fa.tmp
aswdd1d64105c9fe4fd.tmp
aswde7091e50ea3a54b.tmp
aswe09df73765c24f0d.tmp
aswe707cad3a8d2151d.tmp
aswea500a915dd0b2c0.tmp
aswf4733b2f08466377.tmp
aswf709d3743ff3a472.tmp
aswff3e90bd6591a0b1.tmp
update.xml
update.xml
697bc878-e8eb-4256-a3d0-56dbcd2e9d46.cab
754bc98f-d420-4ebb-8c06-d663a8010b12.xml
81f5fda4-b642-4823-b559-a347dc751ba5.cab
update.xml
349E83474FF4B04F62E95F31D61DCF55.rmt
update.xml
avast5.ini.171663061076504
9920770f-f2c0-49fb-85d1-93e45771967f.ini
asw0617bd3de3593f49.tmp
asw21d74fe0137fe7fb.tmp
asw3183dda4498d1ac7.tmp
asw3f02c5bd6304cabb.tmp
asw4634b281a7b0425b.tmp
asw487be7f3133212fb.tmp
asw4974d61c7b8ef33e.tmp
asw53cd3c33338fa8b2.tmp
asw638cc6ca9d2cf9f8.tmp
asw79d49d67cee7c152.tmp
asw9266a8d14063cdef.tmp
asw9df505fd2ae8f201.tmp
aswa2c6d6ed58a75e3b.tmp
aswa8d28105fb5494fa.tmp
aswedacd50d45afd99c.tmp
aswee2f15f920f83c24.tmp
Stats.ini
Stats.ini
Stats.ini
Stats.ini
Stats.ini
Stats.ini
ais_cmp_bpc-7e7.vpx
ais_cmp_cleanup_x64-839.vpx
ais_cmp_gamingmode-91c.vpx
ais_cmp_idp_x64-91b.vpx
ais_cmp_rescuedisk_x64-8d0.vpx
ais_cmp_swhealth_x64-8d0.vpx
ais_core-985.vpx
ais_dll_eng-887.vpx
ais_dll_eng_x64-8d0.vpx
ais_gen_crt_x64-834.vpx
ais_gen_crt_x86-833.vpx
ais_gen_openssl_x64-7ed.vpx
ais_gen_protobuf_x64-7d3.vpx
ais_gen_streamfilter_x64-94f.vpx
ais_gen_tools-972.vpx
ais_gen_tools_x64-972.vpx
ais_res-985.vpx
ais_shl_mai_x64-8d0.vpx
ais_x64-985.vpx
asweaa7f73086da6314.tmp
aswed1ab339a33a5218.tmp
dea6545a-eb7c-4744-9cd4-c8c5ecf103ec.ini
e62a2ad8-327b-4913-80c5-665ca4c54fa1.cab
f416d28f-cbf6-458c-9615-b0c93560715c.cab
jrog2-7d.vpx
setup.ini
vps_binaries-7d.vpx
vps_binaries_64-7d.vpx
vps_defs_common-7d.vpx
vps_tools_64-7d.vpx
asw0427b1b0c1847d73.tmp
asw0f54e75172bb74fd.tmp
asw16e843426c1ba2c7.tmp
asw2aa9ce125c8d3984.tmp
asw2f2abd77173ba023.tmp
asw402acf595ebc2c83.tmp
asw4e4e7cb0f465f8bf.tmp
asw6c15c1814e6f3674.tmp
asw6e9a744704c00e61.tmp
asw7c7736e002391233.tmp
asw821d594e8110c80f.tmp
asw84cff536de89647c.tmp
asw8ff74e42c5e0e782.tmp
aswa279138a5af0c316.tmp
aswaae892057d193221.tmp
aswcdd9a124ce8f59fd.tmp
aswd5ad7d8cf56dfcd6.tmp
aswdb3f84067277b1a8.tmp
aswe6a70e6f045329fe.tmp
aswf04caa18a93e516b.tmp
aswf2cad01e2b0bd81c.tmp
aswf61dcff2e16cc20e.tmp
aswf638f0b6672854d0.tmp
asw0175a24eb2a43da7.tmp
asw06d9224049f35939.tmp
asw0948dadf6d005b3a.tmp
asw0f8b76f8f49d3673.tmp
asw1351720a8dd11af1.tmp
asw149e9f87cc19f77e.tmp
asw18ef0883bca7ec44.tmp
asw1912f071b087cdd1.tmp
asw1fbcd06f3ca53613.tmp
asw212060c433275975.tmp
asw2212e4d95183561a.tmp
asw27562362d70393df.tmp
asw318cbc5463e83f13.tmp
asw3aa308148ddc13e2.tmp
asw3ddbe0ff87d4d24b.tmp
asw40266057189cfbdd.tmp
asw40f23bc3a8d44e98.tmp
asw57d855cd3121d756.tmp
asw59bb2753f0c57d10.tmp
asw5e0335626c84afad.tmp
asw685c0ff7f353e202.tmp
asw6be1d947771e37f1.tmp
asw72d741ec18f9c554.tmp
asw72f3572ef0a94e97.tmp
asw7a78d41aad50e436.tmp
asw7b0fce213adaf0f0.tmp
asw8251bc96f2576cda.tmp
asw8ddeacb053ccab2a.tmp
asw9428b348b90c6f58.tmp
asw9752ad92af1d2211.tmp
asw9be8919b6be5f0dc.tmp
asw9dd268c1e7ab6748.tmp
asw9f9c4e5d07ab4e36.tmp
aswa768211eed34545c.tmp
aswa7f086f28d6226f2.tmp
aswabc622d51c34326c.tmp
aswb04c4e812a4c791c.tmp
aswb242027dd4b0e922.tmp
aswb79e620db08f5e22.tmp
aswbaf632776527ee43.tmp
aswbd7f01a4ccbc7215.tmp
aswc5c56c8d32041480.tmp
aswd1ca39134ab29b22.tmp
aswd7a51d9aab7191e2.tmp
aswd85ccf69e07fed56.tmp
aswdd2cb2c632b4f3d2.tmp
aswe71cfb53e8074b4f.tmp
aswe7229a8da27fc54c.tmp
aswefa381d9ee847da4.tmp
aswf45aa3017a20d32e.tmp
aswf831793ef7092f12.tmp
aswf9bddd4186c6f30f.tmp
aswfda6735cfa33036c.tmp
aswfe8dadbe8b5e94b2.tmp
asw07dc49bd52d97e03.tmp
asw19bb993e9ecd2985.tmp
asw32865f02bb981576.tmp
asw606241dc4dee99ce.tmp
asw7d5ea88e274969b8.tmp
aswa129dfcc9e078cee.tmp
aswadbae67f130302d8.tmp
aswd438cf4e199580cd.tmp
asweed2f3be2b76b8da.tmp
asw36bd596d6efabb44.tmp
asw6f9c1bb54a5fb316.tmp
SecurityProductInformation.ini
asw4053938cb8e6e705.tmp
asw591f2096c07098b8.tmp
asw641815d7395d3ff5.tmp
aswe755781dd0aa8f88.tmp
asw30afd5c3cad09003.tmp
asw6d66d170597e086f.tmp
aswd1ed22b86efafd20.tmp
aswf1bd98ae93c950de.tmp
AvEmUpdate.log
AvEmUpdate.log
AvEmUpdate.log
Setup.log
Setup.log
Setup.log
event_manager.log
f_000010
f_000011
f_000012
the-real-index
data_1
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
c00e3d5d-1e70-442f-9810-a505362837c5.tmp
Preferences
Preferences
Preferences
Preferences
Preferences
Local State
Local State
Module Info Cache
Module Info Cache~RFe5850ea.TMP
settings.dat
settings.dat
f_00001c
the-real-index
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
TransportSecurity
TransportSecurity
TransportSecurity~RFe5a4121.TMP
CURRENT
CURRENT
Local State
Local State
Local State
app2e215faddcfd19.tmp
app35343ef0e5692687.tmp
cached-microdescs.new
tor.exe
avast_free_antivirus_setup_online.exe
m_finnish.wnry
gcapi.dll
HTMLayout.dll
Instup.dll
Instup.exe
avbugreport_x64_ais-a39.vpx
avdump_x64_ais-a39.vpx
config.def
config.def
config.def
config.ini
offertool_x64_ais-a39.vpx
part-jrog2-7d.vpx
part-prg_ais-180417e0.vpx
part-setup_ais-180417e0.vpx
part-vps_windows-24052399.vpx
prod-pgm.vpx
prod-vps.vpx
prod-vps.vpx
sbr_x64_ais-a39.vpx
servers.def
servers.def.vpx
setup.def
uat64.dll
uat64.vpx
avast_free_antivirus_setup_online_x64.exe
ecoo.edat
memory/6928-10451-0x0000019167AE0000-0x0000019167AE1000-memory.dmp
memory/6928-10439-0x0000019167AE0000-0x0000019167AE1000-memory.dmp
memory/6928-10454-0x0000019167AE0000-0x0000019167AE1000-memory.dmp
memory/6928-10453-0x0000019167AE0000-0x0000019167AE1000-memory.dmp
memory/6928-10452-0x0000019167AE0000-0x0000019167AE1000-memory.dmp
memory/6928-10456-0x0000019167AE0000-0x0000019167AE1000-memory.dmp
memory/6928-10450-0x0000019167AE0000-0x0000019167AE1000-memory.dmp
memory/6928-10441-0x0000019167AE0000-0x0000019167AE1000-memory.dmp
memory/6928-10455-0x0000019167AE0000-0x0000019167AE1000-memory.dmp
memory/6928-10440-0x0000019167AE0000-0x0000019167AE1000-memory.dmp
memory/9204-10500-0x0000000073AB0000-0x0000000073B32000-memory.dmp
memory/9204-10518-0x00000000007E0000-0x0000000000ADE000-memory.dmp
memory/9204-10516-0x0000000073A80000-0x0000000073AA2000-memory.dmp
memory/9204-10517-0x0000000073860000-0x0000000073A7C000-memory.dmp
memory/9204-10515-0x0000000073AB0000-0x0000000073B32000-memory.dmp
memory/9204-10514-0x0000000073B40000-0x0000000073BB7000-memory.dmp
memory/9204-10513-0x0000000073BC0000-0x0000000073BDC000-memory.dmp
memory/9204-10511-0x00000000007E0000-0x0000000000ADE000-memory.dmp
memory/9204-10512-0x0000000073BE0000-0x0000000073C62000-memory.dmp
memory/9204-10499-0x0000000073860000-0x0000000073A7C000-memory.dmp
memory/9204-10502-0x00000000007E0000-0x0000000000ADE000-memory.dmp
memory/9204-10501-0x0000000073A80000-0x0000000073AA2000-memory.dmp
memory/9204-10498-0x0000000073BE0000-0x0000000073C62000-memory.dmp
memory/9204-10658-0x00000000007E0000-0x0000000000ADE000-memory.dmp
memory/9204-10664-0x0000000073860000-0x0000000073A7C000-memory.dmp
memory/9204-10665-0x00000000007E0000-0x0000000000ADE000-memory.dmp
memory/9204-10673-0x00000000007E0000-0x0000000000ADE000-memory.dmp
memory/9204-10683-0x00000000007E0000-0x0000000000ADE000-memory.dmp
memory/15788-9051-0x0000000010000000-0x0000000010010000-memory.dmp