Analysis
- max time kernel
93s - max time network
133s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 23:21
General
- Target Shiro no Yakata_RD4-bj2.exe
- Size 13.8MB
- Sample260604-3cdppsgw9z
- SHA256 888bfc44c03e97875fd1e88f56c8c052c94af130803a096114a76e480313f0dc
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 12 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shiro no Yakata_RD4-bj2.exe"C:\Users\Admin\AppData\Local\Temp\Shiro no Yakata_RD4-bj2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-88THC.tmp\Shiro no Yakata_RD4-bj2.tmp"C:\Users\Admin\AppData\Local\Temp\is-88THC.tmp\Shiro no Yakata_RD4-bj2.tmp" /SL5="$5027E,13603942,780800,C:\Users\Admin\AppData\Local\Temp\Shiro no Yakata_RD4-bj2.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0B036.tmp\prod0_extract\avast_secure_browser_setup.exe"C:\Users\Admin\AppData\Local\Temp\is-0B036.tmp\prod0_extract\avast_secure_browser_setup.exe" /s /run_source=avast_ads_is /is_pixel_psh=agiSfNdDBzxfgDC8KxEwjdL5K8aHdj82LDdt5gGXVidtMi2Srtvovqf0SNqS7fQaWqVceABwrR369yJIVr3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsvA014.tmp\AvastBrowserInstaller.exe"C:\Users\Admin\AppData\Local\Temp\nsvA014.tmp\AvastBrowserInstaller.exe" "C:\Users\Admin\AppData\Local\Temp\is-0B036.tmp\prod0_extract\avast_secure_browser_setup.exe" /s /run_source=avast_ads_is /is_pixel_psh=agiSfNdDBzxfgDC8KxEwjdL5K8aHdj82LDdt5gGXVidtMi2Srtvovqf0SNqS7fQaWqVceABwrR369yJIVr4⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\nsvA014.tmp\AvastBrowserUpdateSetup.exeAvastBrowserUpdateSetup.exe /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en&brand=6233&installargs= --no-create-user-shortcuts --force-default-win10 --auto-import-data%3Dmsedge --import-cookies --import-notifications --import-session"5⤵
-
C:\Program Files (x86)\GUMB273.tmp\AvastBrowserUpdate.exe"C:\Program Files (x86)\GUMB273.tmp\AvastBrowserUpdate.exe" /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en&brand=6233&installargs= --no-create-user-shortcuts --force-default-win10 --auto-import-data%3Dmsedge --import-cookies --import-notifications --import-session"6⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regsvc7⤵
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regserver7⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"8⤵
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"8⤵
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"8⤵
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezZEMzdDNzYwLThGRUQtNDhBNS1BNEE0LUNFQzA5NUIyRDhERH0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTk5NS42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTk5NS42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezBERjNENTE5LTM4QjgtNDk3Ny05OTA0LTdEQjVENUQ5MUIxRX0iIHVzZXJpZD0iZTc5NjY4MmZlMDYxNGU4ZThlMDIwNzQ3ODFlODAxZDYiIG1hY2hpbmVpZD0iNDg4RENBNEMxNUY5QTFEMzMwQUQzMTJCMzkxQTgwNEVCRTUxQTYwMjIwMDYwQjYzMjQxQTJDRkNENDI2QzI2MCIgbWFjaGluZWlkX2RhdGU9IjIwMjYwNjA0IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0iezM5NDE2OTdFLTBFRjctNEQ2Ny04ODdBLTgxNjIyM0UzMDRDRX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NkQzN0M3NjAtOEZFRC00OEE1LUE0QTQtQ0VDMDk1QjJEOEREfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS44LjE5OTUuNiIgbGFuZz0iZW4iIGJyYW5kPSI2MjMzIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxNDA2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg7⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /handoff "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en&brand=6233&installargs= --no-create-user-shortcuts --force-default-win10 --auto-import-data%3Dmsedge --import-cookies --import-notifications --import-session" /installsource otherinstallcmd /sessionid "{0DF3D519-38B8-4977-9904-7DB5D5D91B1E}" /silent7⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-0B036.tmp\prod1_extract\cookie_mmm_irs_ppi_008_585.exe"C:\Users\Admin\AppData\Local\Temp\is-0B036.tmp\prod1_extract\cookie_mmm_irs_ppi_008_585.exe" /silent /ws /psh:agiSfNdDBzxfgDC8KxEwjdL5K8aHepsccma9zfnfD4DOLwcIEf3XIjBWDhQumrpXUfQrTOiSdIcqnFXs9X /cookie:mmm_irs_ppi_008_585_a3⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\Temp\asw-cfe77483-83a4-4c69-b77d-da0e8a016417\common\icarus.exeC:\Windows\Temp\asw-cfe77483-83a4-4c69-b77d-da0e8a016417\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-cfe77483-83a4-4c69-b77d-da0e8a016417\icarus-info.xml /install /silent /ws /psh:agiSfNdDBzxfgDC8KxEwjdL5K8aHepsccma9zfnfD4DOLwcIEf3XIjBWDhQumrpXUfQrTOiSdIcqnFXs9X /cookie:mmm_irs_ppi_008_585_a4⤵
-
C:\Windows\Temp\asw-cfe77483-83a4-4c69-b77d-da0e8a016417\avast-suite\icarus.exeC:\Windows\Temp\asw-cfe77483-83a4-4c69-b77d-da0e8a016417\avast-suite\icarus.exe /silent /ws /psh:agiSfNdDBzxfgDC8KxEwjdL5K8aHepsccma9zfnfD4DOLwcIEf3XIjBWDhQumrpXUfQrTOiSdIcqnFXs9X /cookie:mmm_irs_ppi_008_585_a /er_master:master_ep_5da85e0b-631d-422f-a83c-5040a2548291 /er_slave:avast-suite_slave_ep_c29ea3f8-2b7a-4c40-808f-35ac05451d21 /slave:avast-suite5⤵
-
-
C:\Windows\Temp\asw-cfe77483-83a4-4c69-b77d-da0e8a016417\avast-av-vps\icarus.exeC:\Windows\Temp\asw-cfe77483-83a4-4c69-b77d-da0e8a016417\avast-av-vps\icarus.exe /silent /ws /psh:agiSfNdDBzxfgDC8KxEwjdL5K8aHepsccma9zfnfD4DOLwcIEf3XIjBWDhQumrpXUfQrTOiSdIcqnFXs9X /cookie:mmm_irs_ppi_008_585_a /er_master:master_ep_5da85e0b-631d-422f-a83c-5040a2548291 /er_slave:avast-av-vps_slave_ep_e3971329-f5ff-42ed-8656-b1c72fecd55d /slave:avast-av-vps5⤵
-
C:\Program Files\Avast Software\Suite\defs\26060418\engsup.exe"C:\Program Files\Avast Software\Suite\defs\26060418\engsup.exe" /prepare_definitions_folder6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-0B036.tmp\prod2_extract\WZSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-0B036.tmp\prod2_extract\WZSetup.exe" /S /tpchannelid=1571 /distid=App1233⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe"C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" install4⤵
-
-
C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe"C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" start silent4⤵
-
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /svc1⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{0FFF582F-A413-47D1-B399-0F42CA96ADF4}\AvastBrowserInstaller.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{0FFF582F-A413-47D1-B399-0F42CA96ADF4}\AvastBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --auto-pin-to-taskbar-on-run --import-session --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --force-default-win10 --auto-import-data=msedge --import-cookies --import-notifications --import-session --system-level2⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{0FFF582F-A413-47D1-B399-0F42CA96ADF4}\CR_66A00.tmp\setup.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{0FFF582F-A413-47D1-B399-0F42CA96ADF4}\CR_66A00.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{0FFF582F-A413-47D1-B399-0F42CA96ADF4}\CR_66A00.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --auto-pin-to-taskbar-on-run --import-session --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --force-default-win10 --auto-import-data=msedge --import-cookies --import-notifications --import-session --system-level3⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{0FFF582F-A413-47D1-B399-0F42CA96ADF4}\CR_66A00.tmp\setup.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{0FFF582F-A413-47D1-B399-0F42CA96ADF4}\CR_66A00.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=147.0.34598.118 --attachment=C:\Windows\SystemTemp\AvastBrowser_installer.log --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff714026758,0x7ff714026764,0x7ff7140267704⤵
-
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"1⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /medsvc1⤵
-
C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe"C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe"1⤵
-
C:\Program Files (x86)\WeatherZero\WeatherZero.exe"C:\Program Files (x86)\WeatherZero\WeatherZero.exe" /q=366C3726D315F3C37BA02FCBCD7C5DEC2⤵
-
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
@PaxHeader
AvastBrowserCrashHandler.exe
AvastBrowserCrashHandler64.exe
AvastBrowserUpdate.exe
AvastBrowserUpdateComRegisterShell64.exe
AvastBrowserUpdateCore.exe
goopdate.dll
goopdateres_am.dll
goopdateres_ar.dll
goopdateres_bg.dll
goopdateres_bn.dll
goopdateres_ca.dll
goopdateres_cs.dll
goopdateres_da.dll
goopdateres_de.dll
goopdateres_el.dll
goopdateres_en-GB.dll
goopdateres_en.dll
goopdateres_es-419.dll
goopdateres_es.dll
goopdateres_et.dll
goopdateres_fa.dll
goopdateres_fi.dll
goopdateres_fil.dll
goopdateres_fr.dll
goopdateres_gu.dll
goopdateres_hi.dll
goopdateres_hr.dll
goopdateres_hu.dll
goopdateres_id.dll
goopdateres_is.dll
goopdateres_it.dll
ArPot.dll
ArPotEx32.dll
ArPotEx64.dll
BCUEngine.dll
PushPin.dll
Sf2.dll
algo64.dll
aswAR.dll
aswArray.dll
aswBoot64.dll
aswCleanerDLL.dll
aswCmnBS.dll
aswCmnIS64.dll
aswCmnOS.dll
aswEngin.dll
aswFiDb.dll
aswFrrr.dll
aswHds.dll
aswJsFlt.dll
aswJsFlt64.dll
aswOnnxr.dll
aswQcr.dll
aswRawFS264.dll
aswRep.dll
aswScan.dll
certs.map
db_agdx.dat
db_ap2.dat
db_array.dat
db_as.dat
db_bank.dat
db_cf.dat
db_cmd.nmp
db_cmd.sig
db_conb.dat
db_dex.nmp
db_dex.sig
db_dh.dat
db_dns.nmp
db_dns.sig
db_dsign.dat
db_dyna.nmp
db_dyna.sig
db_el.dat
db_elf.nmp
db_elf.sig
db_elfa.nmp
db_elfa.sig
db_evoapk.dat
db_evope.dat
db_ext.dat
db_fn.nmp
db_fn.sig
db_frrr.dat
db_java.nmp
db_java.sig
db_js.nmp
db_js.sig
db_med.nmp
db_med.sig
db_mu.dat
db_mx4.nmp
db_mx4.sig
db_mx95.nmp
db_mx95.sig
db_o7.nmp
db_o7.sig
db_ob2.dat
db_pay.dat
db_pdf.mml
db_pe.nmp
db_pe.sig
db_pe3.dat
db_pph.dat
db_qcr.dat
db_sf.dat
db_sn.nmp
db_sn.sig
db_snh.dat
db_sp.dat
db_str.nmp
db_str.sig
db_swf.nmp
db_swf.sig
db_symtrnl.dat
db_tlsh.dat
db_tx.dat
db_w6.nmp
db_w6.sig
db_wat.nmp
db_wat.sig
db_wh2.dat
db_xtn.map
def.ini
engsup.exe
exts.dll
fwAux.dll
gvma64.dat
idp.dat
list_d.txt
list_i.txt
onnxruntime.dll
protobuf.dll
swhealthex2.dll
uiext.dll
AvBugReport.exe
AvDump.exe
AvEmUpdate.exe
aswbidsdriver.sys
background.png
SetupInf.exe
TuneupSvc.exe
afwCoreClient.dll
aswSqLt.dll
aswhook.dll
autoreactivator.exe
brandcfg.js
asw4163041a6c660db7.tmp
brandingdata.js
brandcfg.js
asw27b4ef198d128482.tmp
brandingdata.js
brandcfg.js
aswf1cbe08bebf289e0.tmp
brandingdata.js
event_manager_er.dll
gf2hlp.exe
i-s-715.svg.ipending.5731360f
i-l-029.svg
i-s-117.svg
i-s-715.svg.ipending.5731360f
mainVars_light.json
hns_tools.dll
jsbridge.dll
libcrypto-3-x64.dll
libssl-3-x64.dll
libwaapi.dll
libwaheap.dll
libwalocal.dll
libwaresource.dll
libwautils.dll
libwavmodapi.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_threads.dll
pdfix.exe
protobuf.dll
config.def
su_adapter.dll
su_common.dll
su_controller.dll
su_worker.exe
wa_3rd_party_host_32.exe
wa_3rd_party_host_64.exe
AvDump.exe
aswhook.dll
dnd_helper.dll
API-MS-Win-core-xstate-l2-1-0.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-fibers-l1-1-1.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll.ipending.5731360f
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-sysinfo-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
local.crt.manifest
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_threads.dll
product-info.xml
macaddr.db.ipending.5731360f
networks.xml.ipending.5731360f
dnddetection.dat.ver
dndrules.dat
TUBrowserCleanupTC.tudb
config.def
usercfg.ini
sfx.log
icarus.ini
icarus.ini
icarus.ini
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Avast_BRW.png
Avast_One.png
WeatherZero.png
botva2.dll
finish.png
prod0.zip
avast_secure_browser_setup.exe
prod1.zip
cookie_mmm_irs_ppi_008_585.exe
prod2.zip
WZSetup.exe
zbShieldUtils.dll
Shiro no Yakata_RD4-bj2.tmp
AvastBrowserInstaller.exe
AvastBrowserUpdateSetup.exe
INetC.dll
WeatherZeroNSISPlugin.dll
icarus_rvrt.exe
bug_report.exe
dump_process.exe
icarus_ui.exe
setupui.cont
icarus.exe
icarus_mod.dll
product-def.xml
product-info.xml
epps.edat
giet.edat
icarus-info.xml
memory/3080-3706-0x000000001A3E0000-0x000000001A400000-memory.dmp
memory/3080-3707-0x000000001A820000-0x000000001ABF4000-memory.dmp
memory/3080-3708-0x000000001AF30000-0x000000001B066000-memory.dmp
memory/3308-204-0x0000000006C20000-0x0000000006C2F000-memory.dmp
memory/3308-51-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/3308-52-0x0000000006C20000-0x0000000006C2F000-memory.dmp
memory/3308-38-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/3308-39-0x0000000006C20000-0x0000000006C2F000-memory.dmp
memory/3308-31-0x0000000006C20000-0x0000000006C2F000-memory.dmp
memory/3308-16-0x0000000002460000-0x0000000002461000-memory.dmp
memory/3308-15-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/3308-203-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/3308-5-0x0000000002460000-0x0000000002461000-memory.dmp
memory/3576-0-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/3576-14-0x0000000000400000-0x00000000004CC000-memory.dmp