Overview

overview

8

Static

static

1

bitdefende...ee.exe

windows10-2004-x64

8

bitdefende...ee.exe

windows11-ltsc_2024-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    179s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/08/2026, 10:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bitdefender_avfree.exe
  • Size 21.4MB
  • Sample260801-l7cbpasdlb
  • SHA256 ac42a826e1c44aaf9510a089b66b1149d75401ab710780b1e17b873f5cfa6e86
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 6 IoCs
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Uses Session Manager for persistence 2 TTPs 1 IoCs

    Creates Session Manager registry key to run executable early in system boot.

    persistence
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Downloads MZ/PE file 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 52 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 20 IoCs
  • Executes dropped EXE 19 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 44 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\bitdefender_avfree.exe
    "C:\Users\Admin\AppData\Local\Temp\bitdefender_avfree.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5516
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\agent_launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\agent_launcher.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\bddeploy.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\bddeploy.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\setuppackage.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\setuppackage.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5436
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\installer.exe"
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5056
          • C:\Program Files\Bitdefender Agent\ProductAgentService.exe
            "C:\Program Files\Bitdefender Agent\ProductAgentService.exe" install
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:5844
          • C:\Program Files\Bitdefender Agent\ProductAgentService.exe
            "C:\Program Files\Bitdefender Agent\ProductAgentService.exe" enable
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:5300
          • C:\Program Files\Bitdefender Agent\ProductAgentService.exe
            "C:\Program Files\Bitdefender Agent\ProductAgentService.exe" start "C:\Users\Admin\AppData\Local\Temp\bitdefender_avfree.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:580
  • C:\Program Files\Bitdefender Agent\redline\bdredline.exe
    "C:\Program Files\Bitdefender Agent\redline\bdredline.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2900
  • C:\Program Files\Bitdefender Agent\ProductAgentService.exe
    "C:\Program Files\Bitdefender Agent\ProductAgentService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:1260
  • C:\Program Files\Bitdefender Agent\ProductAgentService.exe
    "C:\Program Files\Bitdefender Agent\ProductAgentService.exe"
    1⤵
    • Downloads MZ/PE file
    • Drops file in System32 directory
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Program Files\Bitdefender Agent\27.1.1.44\DiscoverySrv.exe
      "C:\Program Files\Bitdefender Agent\27.1.1.44\DiscoverySrv.exe" install
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Program Files\Bitdefender Agent\27.1.1.44\DiscoveryComp.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2300
    • C:\Program Files\Bitdefender Agent\27.1.1.44\DiscoverySrv.exe
      "C:\Program Files\Bitdefender Agent\27.1.1.44\DiscoverySrv.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:3076
    • C:\Program Files\Bitdefender Agent\27.1.1.44\ProductAgentUI.exe
      "C:\Program Files\Bitdefender Agent\27.1.1.44\ProductAgentUI.exe" show=progress event_retry=Global\7295237F-E98C-4C46-A4A4-07F0D66278C2 app_name="Bitdefender Security"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:1556
    • C:\Windows\TEMP\bd_93BF.tmp\cnb93D0.tmp
      "C:\Windows\TEMP\bd_93BF.tmp\cnb93D0.tmp" /source:web /attach
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\installer.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\installer.exe" /kitArchive
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4904
        • C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031\Installer.exe
          "C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031\Installer.exe" /attach /source:web /setup-folder:"CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031" /step=new_install
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Uses Session Manager for persistence
          • Checks BIOS information in registry
          • Downloads MZ/PE file
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: LoadsDriver
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Program Files\Bitdefender Agent\ProductAgentUI.exe
            "C:\Program Files\Bitdefender Agent\ProductAgentUI.exe" attach=590318
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5700
          • C:\Windows\system32\fltmc.exe
            "C:\Windows\system32\fltmc.exe" load vlflt
            5⤵
            • Suspicious behavior: LoadsDriver
            • Suspicious use of AdjustPrivilegeToken
            PID:316
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" control bdauxsrv 128
            5⤵
            • Launches sc.exe
            PID:4608
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" control bdappsrv 128
            5⤵
            • Launches sc.exe
            PID:2856
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" control bdsafepaysrv 128
            5⤵
            • Launches sc.exe
            PID:2728
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" control vsserv 128
            5⤵
            • Launches sc.exe
            PID:5252
          • C:\Windows\system32\fltmc.exe
            "C:\Windows\system32\fltmc.exe" unload vlflt
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1948
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" control bdprotsrv 128
            5⤵
            • Launches sc.exe
            PID:3284
    • C:\Program Files\Bitdefender Agent\27.1.1.44\WatchDog.exe
      "C:\Program Files\Bitdefender Agent\27.1.1.44\WatchDog.exe" install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:5472
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
    1⤵
    • Drops file in Windows directory
    PID:8
  • C:\Program Files\Bitdefender Agent\27.1.1.44\WatchDog.exe
    "C:\Program Files\Bitdefender Agent\27.1.1.44\WatchDog.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4900
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3824
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bf02e741-f4b8-5641-bee9-515482eb6d61}\vlflt.inf" "9" "4bedf8503" "0000000000000134" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2212
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\vlflt.inf_amd64_03b279d289cd7405\vlflt.inf" "0" "4bedf8503" "0000000000000160" "WinSta0\Default"
      2⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:6036
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3fd50ac0-8fa4-ac46-a75e-574548a3e3fb}\trufos.inf" "9" "4eee6bb87" "0000000000000170" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2604
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\trufos.inf_amd64_b8194ec5fe856c53\trufos.inf" "0" "4eee6bb87" "0000000000000178" "WinSta0\Default"
      2⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:580
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\vlflt.inf_amd64_03b279d289cd7405\vlflt.inf" "0" "40095b623" "000000000000015C" "WinSta0\Default"
      2⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4776
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\trufos.inf_amd64_b8194ec5fe856c53\trufos.inf" "0" "4eabf84f7" "0000000000000160" "WinSta0\Default"
      2⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4628

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ProductAgent.dll
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\ProductAgent.dll
        • Size 4.7MB
        • SHA256 562e581e0380824240bf5b0f0f1445aadc4894efe8e30306211d2467ccb899aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProductAgentService.exe
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\ProductAgentService.exe
        • Size 756KB
        • SHA256 3e0495b338de1387f66eb2fa219a48d25456dcff20ca8962c33b9f118a7396b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WebView2Loader.dll
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\WebView2Loader.dll
        • Size 113KB
        • SHA256 256510c2872a3a96a8e0a7db0db6c6e7b31ebed34cd6b7c430712ca640c73842
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bdnc.dll
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\bdnc.dll
        • Size 3.3MB
        • SHA256 ea0fbb5be93857dd09c11b6b8385caa7e29c3492b94144c155254334bf454269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bdnc.ini
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\bdnc.ini
        • Size 155B
        • SHA256 2c6224951714e685114b51c4e598c2bad8c7bc16975f7401ac51e101afcab837
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bdch.json
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\crash_handler\bdch.json
        • Size 1KB
        • SHA256 5a80279bd1471f0f4b545f0fb8da5dc4e97c0dd0af63f37fa2c58e85a744796c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bdch_bdec.ini
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\crash_handler\bdch_bdec.ini
        • Size 129B
        • SHA256 e8d31c1de790f738ef75daa0402584560a0672402d0d3ded0899d2dbc95fb911
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bdec.dll
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\crash_handler\bdec.dll
        • Size 773KB
        • SHA256 d548ea8af9fc88a950359fa3e0899885444474a2e8738091c71f8e356dcee020
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bdnc.dll
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\crash_handler\bdnc.dll
        • Size 458KB
        • SHA256 3419fc134ec5c29f0017aca2ebcf8412841c01cb6d491a45e13cfeea8ed55c97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bdreinit.exe
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\crash_handler\bdreinit.exe
        • Size 1.6MB
        • SHA256 949d5451a722fdce5d71d0a3f22fa5724e96d99804ff71804cc9eba413d87915
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bdnc.ini.md5
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\installer\bdnc\bdnc.ini.md5
        • Size 32B
        • SHA256 ee6c0b2ec77f92eb98d898f53ac772e12292fa597b47d9539120051645fef8ec
        • MD5 SHA1 SHA512
        Submit Download

        iservconfig.dll
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\iservconfig.dll
        • Size 776KB
        • SHA256 2148c05fe948c49c1c5a894f4b2882d65fef3b36824dc767b61277a922fd4a28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.dll
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\log.dll
        • Size 313KB
        • SHA256 41c0b9094b9ab0cca15eb0faf457fa5a107a5043a691774721e389b831c21cd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LoggerConfig.xml
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\settings\LoggerConfig.xml
        • Size 78B
        • SHA256 54e2f0d07609a40a45bb12d3a271eec1fb9021f62b756a4bdbdc42191fd79dcd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ProductAgent.json
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\settings\ProductAgent.json
        • Size 1KB
        • SHA256 0b1b9ff3b536c0377c96faa71bba817923dfe8e9987bfc87cb2a9d1c2c590524
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bdnc.client_id
        • Path C:\Program Files\Bitdefender Agent\27.1.1.44\x64\bdnc.client_id
        • Size 36B
        • SHA256 e6e827f81840ce8975cd5e30467ddc1661c3f407cd9d342d00800f32c01dcc26
        • MD5 SHA1 SHA512
        Submit Download

        ProductAgentUI.exe
        • Path C:\Program Files\Bitdefender Agent\ProductAgentUI.exe
        • Size 2.2MB
        • SHA256 132b5593235b9e8b244baa741984be1bdb857dd743caab41ce5cd9b422f9b87e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bdch.dll
        • Path C:\Program Files\Bitdefender Agent\redline\bdch.dll
        • Size 2.3MB
        • SHA256 4c58d7cd5a20ac50d5e75cc3cb21060d91ca1c617a47b5f740e7377c975f4fb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bdredline.bdch.json
        • Path C:\Program Files\Bitdefender Agent\redline\bdredline.bdch.json
        • Size 942B
        • SHA256 93dd9eae0ab100fe2a979cd99fe67ae0016d77ed0d10e70b681beb0b8f600f64
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bdredline.conf
        • Path C:\Program Files\Bitdefender Agent\redline\bdredline.conf
        • Size 358B
        • SHA256 8ee5c38703a82ad615abe3adc6d3b47d05032e374ef38084f2b323a7b4f823e0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        version.json
        • Path C:\Program Files\Bitdefender Agent\version.json
        • Size 42B
        • SHA256 99e77a4abd2ce49b0f042dd957664b676794d472b42cb87e3c9e98b428367ca4
        • MD5 SHA1 SHA512
        Submit Download

        bdnc.client_id
        • Path C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031\bdnc\bdnc.client_id
        • Size 36B
        • SHA256 39abf4235c359f170f64854c07737c8d1471380d1ba3b83daabca67be2057335
        • MD5 SHA1 SHA512
        Submit Download

        bdnc.ini
        • Path C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031\bdnc\bdnc.ini
        • Size 160B
        • SHA256 9b3e432ed1477510de657499b270f38aa1e8b5c56a4f861390756f3d2c9824c7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bdnc.uuid
        • Path C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031\bdnc\bdnc.uuid
        • Size 36B
        • SHA256 ad0e743505d057e4ebc2fbb321db74e2e1ef9c5edcf46447bf94183c37358629
        • MD5 SHA1 SHA512
        Submit Download

        install_vars.json.bkp
        • Path C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031\cstsdk_install\install_vars.json.bkp
        • Size 2KB
        • SHA256 4d7207dfb6632f27d40ec5a078a938fc0444eaf5089a9e90503f7ef3e7bdfce4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031\msvcp140.dll
        • Size 571KB
        • SHA256 10ddff48d704c6007e4c2d53fb4856b5e5e79479503366236246a323aaa76e9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_atomic_wait.dll
        • Path C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031\msvcp140_atomic_wait.dll
        • Size 40KB
        • SHA256 10e99480809ea56d13a477927ef7a36e866310117dfcfef5d73382f125349181
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setupdata.dll
        • Path C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031\temp\setupdata.dll
        • Size 69KB
        • SHA256 fe3245003ba8e790d85763208702f764cc6a1e1d05f08659e0a86535040b6296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031\vcruntime140.dll
        • Size 91KB
        • SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-3410C93C-C100-431B-ADEC-3763F9E2D031\vcruntime140_1.dll
        • Size 35KB
        • SHA256 f8bc270449ca6bb6345e88be3632d465c0a7595197c7954357dc5066ed50ae44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        agent_launcher.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\agent_launcher.exe
        • Size 249KB
        • SHA256 61b0e5273be62a81c9aec4d403a0788a7829509b8df6396be7112bd1d5ab2adb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bdch.json
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bdch.json
        • Size 981B
        • SHA256 b2905275ee54c2f4895b2699003987dd99fbc54ced522e925d7d073027922cc9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bddeploy.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bddeploy.exe
        • Size 406KB
        • SHA256 50495a3e2248ded184c6bb0ff1b52e690f00892b439328247aca61daf2465b34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        deploy.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\deploy.dll
        • Size 20KB
        • SHA256 2f3969b8b0039f42ac91f91994e64daf7726dfc739bf68ae72bfbaed38310061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        installer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\installer.exe
        • Size 974KB
        • SHA256 bb77ed4b259d53e519bc0846acd2b87f4e8737b37ebbde5e6e73ef7e6237497e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        additional.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\additional.dll
        • Size 1.6MB
        • SHA256 4ec3729fdc2797ea4cbcbb4a460599cd871a6fdaf56ace6e5f515afb63545fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        agentpackage.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\agentpackage.exe
        • Size 15.4MB
        • SHA256 f47e9fcedc0cfb326cf43f9109d89180e15b9a23107257d016d324ba4b5b1c5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        agentpackage.exe.md5
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\agentpackage.exe.md5
        • Size 32B
        • SHA256 f83d8fcd5770ba80899cbe974a02e746228e5bfb3073260677ba4d9632f693b3
        • MD5 SHA1 SHA512
        Submit Download

        bdnc.json
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\bdnc.json
        • Size 154B
        • SHA256 fbd4d9075feb0e2678a9c9df0dc2860c4468968c176876cb0271ca8676347aa6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bdredline.bdch.json
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\bdredline.bdch.json
        • Size 730B
        • SHA256 a773cf585925921309cc117e59ee87c56ae7e9f7e7532b4fb153e4ac72dac76e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bdredline.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\bdredline.exe
        • Size 2.3MB
        • SHA256 984450bb47640fb149144504c506cee19ddaf0d213a1ceacd9fefe0efbb27f3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        params.json
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\data\params.json
        • Size 86B
        • SHA256 c9128459dbcebc819dde6ea43d243420497fcf5a10b403cf708299a50e5d35f1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\installer.exe
        • Size 823KB
        • SHA256 b784f0250d34d3d58c3fae273b7f96412f5f040c4c16d0b83851caba0a80b4c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.txtui
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\lang\en-US.txtui
        • Size 10KB
        • SHA256 1868b43eab031374a3a65d6b82d853cd2371ed9ad6e043cdb53780baf3cc80b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\lang\ltr\resources.dll
        • Size 113KB
        • SHA256 8cdd37e3b3128e16b34a381cac4a32bcacc3069255492176d831ac03cc479cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        productagentdp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\productagentdp.dll
        • Size 598KB
        • SHA256 b6cf961c66b2e56ef8c88b3d9c36de783d541e5b7e317e6a98f81a2fe7918ca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sciter.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\sciter.dll
        • Size 4.6MB
        • SHA256 0992022d9a7fd8d3847b994aa7ce2bf337bffd3b90ca39e5c2256df0869cba23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setuppackage.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\setuppackage.exe
        • Size 6.2MB
        • SHA256 1f0ecaf0d54586b07c61d8b7dcf1558d89faf188dbdd98273ad450e63852d398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setuppackage.exe.md5
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\setuppackage.exe.md5
        • Size 32B
        • SHA256 544b6c1daacff6cc7ed638eb46023e6b3e0337a0dd06bf73d5dcb7213cdfc7fa
        • MD5 SHA1 SHA512
        Submit Download

        unrar.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\unrar.dll
        • Size 278KB
        • SHA256 473a7195b6edec4ef2afffbe3565b8c6e169998253495f9730861a5345b7fa2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        params.json
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\temp\params.json
        • Size 44B
        • SHA256 2cf4b595962f9944268ca2d603a21e18dc3c4b6f6cb77c25292db6dd3eec61de
        • MD5 SHA1 SHA512
        Submit Download

        SET7A74.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{3fd50ac0-8fa4-ac46-a75e-574548a3e3fb}\SET7A74.tmp
        • Size 10KB
        • SHA256 f21bbb1b69a4dd8c1cdc8246ffa2d546f44fa113a6649b2351452cdf0ef99000
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SET7A75.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{3fd50ac0-8fa4-ac46-a75e-574548a3e3fb}\SET7A75.tmp
        • Size 4KB
        • SHA256 c41866dfc216b61144478d8c39b88070b572504cd5e9ca2cc2c22162187ee223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SET7A76.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{3fd50ac0-8fa4-ac46-a75e-574548a3e3fb}\SET7A76.tmp
        • Size 621KB
        • SHA256 658a19506057b1281013e41babc10d5ac8bd33646ce042f59b54512a48048e4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SET7735.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{bf02e741-f4b8-5641-bee9-515482eb6d61}\SET7735.tmp
        • Size 10KB
        • SHA256 0619f1fbd1eee7f2531dbf20783894c60a21eca4b016909a5d68fc646db87a9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SET7736.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{bf02e741-f4b8-5641-bee9-515482eb6d61}\SET7736.tmp
        • Size 3KB
        • SHA256 6f792ff3e0eab443ed6e4c15a67d6cfa1a5d3e555b329c07ad7b39a3ee789c36
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SET7737.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{bf02e741-f4b8-5641-bee9-515482eb6d61}\SET7737.tmp
        • Size 1.4MB
        • SHA256 bde372760ce17347365ce53db8aa83769f66376ce7c9e00045024c828fc8e525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1556-626-0x000000006F210000-0x000000006F220000-memory.dmp
        Download

        memory/2188-598-0x000000006F210000-0x000000006F220000-memory.dmp
        Download

        memory/5472-881-0x000000006F210000-0x000000006F220000-memory.dmp
        Download

        memory/5700-1074-0x000000006F210000-0x000000006F220000-memory.dmp
        Download