Overview

overview

8

Static

static

avira_fr_s...wb.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    209s
  • max time network
    208s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2022, 11:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    avira_fr_sptl1_1224300584-1665401309__adwb.exe

  • Size

    5.7MB

  • MD5

    85ddb6b0301a2bca0eba9d647d5521b3

  • SHA1

    9dcd4ad1617387f20784775b0884da78a0e370f8

  • SHA256

    c11bfd3d7eaf905c5b40e3328149a142b6cfb7d44a93159c3c96ff39d3bdbb34

  • SHA512

    a103a641fdf91a0d84568714ba2ec10508d5dbcd247b6ec9a37122889b471df91cd436bc20b061d52cedac5cf58eb75c3c635626273af77e4a920b970d03cbf3

  • SSDEEP

    49152:S50Bi3BhiwzTqO4XXXpDYALLRENU9Qd+bukvZ9Es21uUHxjCNdJd1cgrgDQMHLZ/:EiwzTfkXWU9w6ZvZ9EzjHEVxl/c

Score
8/10
discoveryevasionpersistencespywarestealer

Malware Config

Signatures

  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Drops file in Drivers directory 18 IoCs
  • Executes dropped EXE 46 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 2 IoCs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 15 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 17 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 56 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\avira_fr_sptl1_1224300584-1665401309__adwb.exe
    "C:\Users\Admin\AppData\Local\Temp\avira_fr_sptl1_1224300584-1665401309__adwb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Users\Admin\AppData\Local\Temp\.CR.16065\Avira.Spotlight.Bootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\.CR.16065\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.16065\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira_fr_sptl1_1224300584-1665401309__adwb.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Users\Admin\AppData\Local\Temp\.CR.16065\ed20f33c-def5-44b5-a713-70e57d9bdf1a\MicrosoftEdgeWebview2Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\.CR.16065\ed20f33c-def5-44b5-a713-70e57d9bdf1a\MicrosoftEdgeWebview2Setup.exe" /silent /install
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3552
        • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
          4⤵
          • Executes dropped EXE
          • Sets file execution options in registry
          • Checks computer location settings
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:2820
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1348
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Registers COM server for autorun
              • Loads dropped DLL
              • Modifies registry class
              PID:5092
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Registers COM server for autorun
              • Loads dropped DLL
              • Modifies registry class
              PID:1560
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.167.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Registers COM server for autorun
              • Loads dropped DLL
              • Modifies registry class
              PID:4508
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjcuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjcuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDU1MUFBQzItQTg2OC00Q0RCLThGNzAtMjYxOENGOTZGQUVFfSIgdXNlcmlkPSJ7OEFBODAwRTgtQTQxQi00RUIyLTgxQzItQTRDM0UyNzkyQUU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEREI1MUM1QS02OThELTRGMkMtQUEzRC1BOEQwNjQxMjVEREJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O200Nks1SzV6MXZ2a05MSHI0YzF4L2hDamU3WlFMZHFLeVo1TndnelYzQTg9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNjcuMjEiIG5leHR2ZXJzaW9uPSIxLjMuMTY3LjIxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NDYyNjg1MTc2IiBpbnN0YWxsX3RpbWVfbXM9IjExNDEiLz48L2FwcD48L3JlcXVlc3Q-
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2140
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{0551AAC2-A868-4CDB-8F70-2618CF96FAEE}" /silent
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4012
      • C:\Users\Admin\AppData\Local\Temp\.CR.16065\326b455d-c0cc-4c25-8c27-d10427d095a9\avira_spotlight_setup_adwb.exe
        "C:\Users\Admin\AppData\Local\Temp\.CR.16065\326b455d-c0cc-4c25-8c27-d10427d095a9\avira_spotlight_setup_adwb.exe" /LOG=C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20221010113023161.log /SP /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /LANGUAGE=fr-fr /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V4
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Users\Admin\AppData\Local\Temp\is-SNE0S.tmp\avira_spotlight_setup_adwb.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-SNE0S.tmp\avira_spotlight_setup_adwb.tmp" /SL5="$B0054,36799154,924160,C:\Users\Admin\AppData\Local\Temp\.CR.16065\326b455d-c0cc-4c25-8c27-d10427d095a9\avira_spotlight_setup_adwb.exe" /LOG=C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20221010113023161.log /SP /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /LANGUAGE=fr-fr /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V4
          4⤵
          • Executes dropped EXE
          • Checks for any installed AV software in registry
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4500
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" create AviraSecurityUpdater DisplayName= "Avira Security Updater" binPath= "C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe" start= delayed-auto
            5⤵
            • Launches sc.exe
            PID:2336
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" description AviraSecurityUpdater "Avira Security Updater"
            5⤵
            • Launches sc.exe
            PID:2808
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Update /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-6REVH.tmp\UpdateFallbackTask.xml"
            5⤵
            • Creates scheduled task(s)
            PID:1572
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Service_SCM_Watchdog /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-6REVH.tmp\WatchdogServiceControlManagerTimeout.xml"
            5⤵
            • Creates scheduled task(s)
            PID:1936
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Systray /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-6REVH.tmp\SystrayAutostart.xml"
            5⤵
            • Creates scheduled task(s)
            PID:736
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Maintenance /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-6REVH.tmp\MaintenanceTask.xml"
            5⤵
            • Creates scheduled task(s)
            PID:1288
      • C:\Users\Admin\AppData\Local\Temp\.CR.16065\c394e907-e4bd-4243-9a77-051d2d71e412\avira_fr_sptl1_1224300584-1665401309__adwb.exe
        "C:\Users\Admin\AppData\Local\Temp\.CR.16065\c394e907-e4bd-4243-9a77-051d2d71e412\avira_fr_sptl1_1224300584-1665401309__adwb.exe" Action=RegisterFallbackUpdater AllowMultipleInstances=true UnpackInCurrentDirectory=true
        3⤵
        • Executes dropped EXE
        PID:2912
        • C:\Users\Admin\AppData\Local\Temp\.CR.16065\c394e907-e4bd-4243-9a77-051d2d71e412\.CR.24092\Avira.Spotlight.Bootstrapper.exe
          "C:\Users\Admin\AppData\Local\Temp\.CR.16065\c394e907-e4bd-4243-9a77-051d2d71e412\.CR.24092\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.16065\c394e907-e4bd-4243-9a77-051d2d71e412\.CR.24092\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira_fr_sptl1_1224300584-1665401309__adwb.exe Action=RegisterFallbackUpdater AllowMultipleInstances=true
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:3576
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_FallbackUpdater /XML "C:\Users\Admin\AppData\Local\Temp\.CR.16065\c394e907-e4bd-4243-9a77-051d2d71e412\.CR.24092\rk4eayxg.5fp"
            5⤵
            • Creates scheduled task(s)
            PID:2528
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Delete /F /TN "Avira_Security_Installation"
          4⤵
            PID:2472
          • C:\Users\Admin\AppData\Local\Temp\.CR.16065\c394e907-e4bd-4243-9a77-051d2d71e412\.CR.24092\Avira.Spotlight.Bootstrapper.ReportingTool.exe
            "C:\Users\Admin\AppData\Local\Temp\.CR.16065\c394e907-e4bd-4243-9a77-051d2d71e412\.CR.24092\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackUnsentEvents
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:5012
        • C:\Users\Admin\AppData\Local\Temp\.CR.16065\816ab6ec-0ab4-4cef-a7a3-cdb9487f2d3f\avira_system_speedup.exe
          "C:\Users\Admin\AppData\Local\Temp\.CR.16065\816ab6ec-0ab4-4cef-a7a3-cdb9487f2d3f\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG=C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20221010113034474.log /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=fr-fr /NOSTART /NORESTART /bundle=sptl1 /download=adwb /Spotlight
          3⤵
          • Executes dropped EXE
          PID:912
          • C:\Users\Admin\AppData\Local\Temp\is-HPDVT.tmp\avira_system_speedup.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-HPDVT.tmp\avira_system_speedup.tmp" /SL5="$D0054,34264624,916480,C:\Users\Admin\AppData\Local\Temp\.CR.16065\816ab6ec-0ab4-4cef-a7a3-cdb9487f2d3f\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG=C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20221010113034474.log /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=fr-fr /NOSTART /NORESTART /bundle=sptl1 /download=adwb /Spotlight
            4⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Checks for any installed AV software in registry
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious use of FindShellTrayWindow
            PID:4520
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Delete /F /TN AviraSystemSpeedupRemoval
              5⤵
                PID:2660
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo
                5⤵
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:972
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo
                5⤵
                • Registers COM server for autorun
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:3780
              • C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe
                "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe" -umh
                5⤵
                • Executes dropped EXE
                • Drops desktop.ini file(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:4180
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\.CR.16065\816ab6ec-0ab4-4cef-a7a3-cdb9487f2d3f\avira_system_speedup.exe" "C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe"
                5⤵
                  PID:4020
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR "\"C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe\" /VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST
                  5⤵
                  • Creates scheduled task(s)
                  PID:3496
                • C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe
                  "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -validatelicense
                  5⤵
                  • Executes dropped EXE
                  • Checks for any installed AV software in registry
                  • Modifies system certificate store
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1708
                • C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe
                  "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -initbootoptimizer
                  5⤵
                  • Executes dropped EXE
                  • Checks for any installed AV software in registry
                  • Modifies system certificate store
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4832
                • C:\Users\Admin\AppData\Local\Temp\is-KVO4U.tmp\Avira_Optimizer_Host.exe
                  "C:\Users\Admin\AppData\Local\Temp\is-KVO4U.tmp\Avira_Optimizer_Host.exe" /VERYSILENT
                  5⤵
                  • Executes dropped EXE
                  PID:464
                  • C:\Users\Admin\AppData\Local\Temp\is-3D7NU.tmp\Avira_Optimizer_Host.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-3D7NU.tmp\Avira_Optimizer_Host.tmp" /SL5="$2022A,1525703,780800,C:\Users\Admin\AppData\Local\Temp\is-KVO4U.tmp\Avira_Optimizer_Host.exe" /VERYSILENT
                    6⤵
                    • Executes dropped EXE
                    • Checks for any installed AV software in registry
                    • Drops file in Program Files directory
                    • Suspicious use of FindShellTrayWindow
                    PID:908
                    • C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe
                      "C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe" /Install /Silent
                      7⤵
                      • Executes dropped EXE
                      • Sets service image path in registry
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4284
                • C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe
                  "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -ameinstalled
                  5⤵
                  • Executes dropped EXE
                  • Checks for any installed AV software in registry
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2528
                • C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe
                  "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -heartbeat
                  5⤵
                  • Executes dropped EXE
                  • Checks for any installed AV software in registry
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3432
            • C:\Users\Admin\AppData\Local\Temp\.CR.16065\02b8004c-b8b4-4e2c-9c93-65e99f1dfc5c\VpnInstaller.exe
              "C:\Users\Admin\AppData\Local\Temp\.CR.16065\02b8004c-b8b4-4e2c-9c93-65e99f1dfc5c\VpnInstaller.exe" /S /LANG=fr-fr /bundle=sptl1
              3⤵
              • Executes dropped EXE
              • Sets service image path in registry
              • Drops file in Program Files directory
              PID:3400
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\system32\sc.exe" failure AviraPhantomVPN reset= 86400 actions= restart/5000/restart/10000//1000
                4⤵
                • Launches sc.exe
                PID:4524
            • C:\Users\Admin\AppData\Local\Temp\.CR.16065\52dceff5-02cc-4055-a072-766402cf65fb\endpoint-protection-installer-x64.exe
              "C:\Users\Admin\AppData\Local\Temp\.CR.16065\52dceff5-02cc-4055-a072-766402cf65fb\endpoint-protection-installer-x64.exe" /SP /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DIR="C:\Program Files\Avira" /AppData="C:\ProgramData\Avira" /License="C:\Users\Admin\AppData\Local\Temp\.CR.16065\EndpointProtectionSDK.lic" /Log="C:\Users\Admin\AppData\Local\Temp\avira_endpoint_protection_sdk_setup_20221010112922.log" /CACApplication="C:\Program Files (x86)\Avira\Security\Avira.Spotlight.UI.AdministrativeRightsProvider.exe" /WscAppName="Avira Security" /UpdateServer="https://download.avira.com/download/" /UiPath="C:\Program Files (x86)\Avira\Security\Avira.Spotlight.UI.Application.exe" /Config="C:\Users\Admin\AppData\Local\Temp\.CR.16065\EndpointProtectionConfiguration.json" /UpdateAfterInstall=off /LogMaxFileSize=10485760
              3⤵
              • Executes dropped EXE
              PID:5024
              • C:\Users\Admin\AppData\Local\Temp\is-1IVI5.tmp\endpoint-protection-installer-x64.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-1IVI5.tmp\endpoint-protection-installer-x64.tmp" /SL5="$30228,239442132,867840,C:\Users\Admin\AppData\Local\Temp\.CR.16065\52dceff5-02cc-4055-a072-766402cf65fb\endpoint-protection-installer-x64.exe" /SP /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DIR="C:\Program Files\Avira" /AppData="C:\ProgramData\Avira" /License="C:\Users\Admin\AppData\Local\Temp\.CR.16065\EndpointProtectionSDK.lic" /Log="C:\Users\Admin\AppData\Local\Temp\avira_endpoint_protection_sdk_setup_20221010112922.log" /CACApplication="C:\Program Files (x86)\Avira\Security\Avira.Spotlight.UI.AdministrativeRightsProvider.exe" /WscAppName="Avira Security" /UpdateServer="https://download.avira.com/download/" /UiPath="C:\Program Files (x86)\Avira\Security\Avira.Spotlight.UI.Application.exe" /Config="C:\Users\Admin\AppData\Local\Temp\.CR.16065\EndpointProtectionConfiguration.json" /UpdateAfterInstall=off /LogMaxFileSize=10485760
                4⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Modifies registry class
                • Suspicious use of FindShellTrayWindow
                PID:2396
                • C:\Windows\system32\fltmc.exe
                  "fltmc.exe" unload rtp_filesystem_filter
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3516
                • C:\Windows\system32\net.exe
                  "net.exe" stop rtp_traverse
                  5⤵
                    PID:4860
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop rtp_traverse
                      6⤵
                        PID:2004
                    • C:\Windows\system32\sc.exe
                      "sc.exe" delete rtp_traverse
                      5⤵
                      • Launches sc.exe
                      PID:4532
                    • C:\Windows\system32\net.exe
                      "net.exe" stop rtp_filesystem_filter
                      5⤵
                        PID:4208
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 stop rtp_filesystem_filter
                          6⤵
                            PID:4428
                        • C:\Windows\system32\sc.exe
                          "sc.exe" delete rtp_filesystem_filter
                          5⤵
                          • Launches sc.exe
                          PID:4336
                        • C:\Windows\system32\net.exe
                          "net.exe" stop rtp_process_monitor
                          5⤵
                            PID:1144
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 stop rtp_process_monitor
                              6⤵
                              • Checks for any installed AV software in registry
                              PID:1708
                          • C:\Windows\system32\sc.exe
                            "sc.exe" delete rtp_process_monitor
                            5⤵
                            • Launches sc.exe
                            PID:4600
                          • C:\Windows\system32\net.exe
                            "net.exe" stop rtp_elam
                            5⤵
                              PID:2184
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 stop rtp_elam
                                6⤵
                                  PID:3120
                              • C:\Windows\system32\sc.exe
                                "sc.exe" delete rtp_elam
                                5⤵
                                • Launches sc.exe
                                PID:4536
                              • C:\Windows\system32\net.exe
                                "net.exe" stop netprotection_network_filter
                                5⤵
                                  PID:4580
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 stop netprotection_network_filter
                                    6⤵
                                      PID:4216
                                  • C:\Windows\system32\sc.exe
                                    "sc.exe" delete netprotection_network_filter
                                    5⤵
                                    • Launches sc.exe
                                    PID:4728
                                  • C:\Windows\system32\net.exe
                                    "net.exe" stop netprotection_network_filter2
                                    5⤵
                                      PID:1428
                                      • C:\Windows\system32\net1.exe
                                        C:\Windows\system32\net1 stop netprotection_network_filter2
                                        6⤵
                                          PID:1576
                                      • C:\Windows\system32\sc.exe
                                        "sc.exe" delete netprotection_network_filter2
                                        5⤵
                                        • Launches sc.exe
                                        PID:1128
                                      • C:\Windows\system32\net.exe
                                        "net.exe" stop EndpointProtectionService
                                        5⤵
                                          PID:2088
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 stop EndpointProtectionService
                                            6⤵
                                              PID:752
                                          • C:\Windows\system32\sc.exe
                                            "sc.exe" delete EndpointProtectionService
                                            5⤵
                                            • Launches sc.exe
                                            PID:3664
                                          • C:\Windows\system32\net.exe
                                            "net.exe" stop EndpointProtectionService2
                                            5⤵
                                              PID:3316
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 stop EndpointProtectionService2
                                                6⤵
                                                  PID:2404
                                              • C:\Windows\system32\sc.exe
                                                "sc.exe" delete EndpointProtectionService2
                                                5⤵
                                                • Launches sc.exe
                                                PID:4284
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:3532
                                              • C:\Windows\system32\net.exe
                                                "net.exe" stop BdSentry
                                                5⤵
                                                  PID:3700
                                                  • C:\Windows\system32\net1.exe
                                                    C:\Windows\system32\net1 stop BdSentry
                                                    6⤵
                                                      PID:876
                                                  • C:\Windows\system32\sc.exe
                                                    "sc.exe" delete BdSentry
                                                    5⤵
                                                    • Launches sc.exe
                                                    PID:928
                                                  • C:\Windows\system32\net.exe
                                                    "net.exe" stop BdNet
                                                    5⤵
                                                      PID:692
                                                      • C:\Windows\system32\net1.exe
                                                        C:\Windows\system32\net1 stop BdNet
                                                        6⤵
                                                          PID:3812
                                                      • C:\Windows\system32\sc.exe
                                                        "sc.exe" delete BdNet
                                                        5⤵
                                                        • Launches sc.exe
                                                        PID:3780
                                                      • C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe
                                                        "endpointprotection.exe" check
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:4524
                                                      • C:\Windows\system32\sc.exe
                                                        "sc.exe" create netprotection_network_filter type= kernel start= system error= normal binPath= System32\drivers\netprotection_network_filter.sys DisplayName= netprotection_network_filter group= PNP_TDI tag= yes
                                                        5⤵
                                                        • Launches sc.exe
                                                        PID:4448
                                                      • C:\Windows\system32\sc.exe
                                                        "sc.exe" create netprotection_network_filter2 type= kernel start= demand error= normal binPath= System32\drivers\netprotection_network_filter2.sys DisplayName= netprotection_network_filter2 group= PNP_TDI tag= yes
                                                        5⤵
                                                        • Launches sc.exe
                                                        PID:4936
                                                      • C:\Program Files\Avira\Endpoint Protection SDK\rtp_setup.exe
                                                        "rtp_setup.exe" install /drivers-path="C:\Program Files\Avira\Endpoint Protection SDK\drivers\x64" /license-path="C:\Program Files\Avira\Endpoint Protection SDK\sdk.lic" /client-path="C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe"
                                                        5⤵
                                                        • Drops file in Drivers directory
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        PID:2608
                                                      • C:\Program Files\Avira\Endpoint Protection SDK\unins000.exe
                                                        "unins000.exe" /VERYSILENT /LOG /Rollback=on
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:2132
                                                        • C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
                                                          "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Program Files\Avira\Endpoint Protection SDK\unins000.exe" /FIRSTPHASEWND=$50182 /VERYSILENT /LOG /Rollback=on
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          PID:5092
                                                          • C:\Program Files\Avira\Endpoint Protection SDK\rtp_setup.exe
                                                            "rtp_setup.exe" uninstall /drivers-path="C:\Program Files\Avira\Endpoint Protection SDK\drivers\x64"
                                                            7⤵
                                                            • Drops file in Drivers directory
                                                            • Executes dropped EXE
                                                            PID:4788
                                                          • C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe
                                                            "endpointprotection.exe" uninstall
                                                            7⤵
                                                            • Executes dropped EXE
                                                            PID:5016
                                                          • C:\Windows\system32\net.exe
                                                            "net.exe" stop netprotection_network_filter
                                                            7⤵
                                                              PID:380
                                                              • C:\Windows\system32\net1.exe
                                                                C:\Windows\system32\net1 stop netprotection_network_filter
                                                                8⤵
                                                                  PID:2172
                                                              • C:\Windows\system32\sc.exe
                                                                "sc.exe" delete netprotection_network_filter
                                                                7⤵
                                                                • Launches sc.exe
                                                                PID:1868
                                                              • C:\Windows\system32\net.exe
                                                                "net.exe" stop netprotection_network_filter2
                                                                7⤵
                                                                  PID:876
                                                                  • C:\Windows\system32\net1.exe
                                                                    C:\Windows\system32\net1 stop netprotection_network_filter2
                                                                    8⤵
                                                                      PID:4860
                                                                  • C:\Windows\system32\sc.exe
                                                                    "sc.exe" delete netprotection_network_filter2
                                                                    7⤵
                                                                    • Launches sc.exe
                                                                    PID:1988
                                                                  • C:\Program Files\Avira\Endpoint Protection SDK\SentryProtection.exe
                                                                    "SentryProtection.exe" -uninstall drivers-path="C:\Program Files\Avira\Endpoint Protection SDK\drivers\sentry"
                                                                    7⤵
                                                                    • Drops file in Drivers directory
                                                                    • Executes dropped EXE
                                                                    PID:1704
                                                                  • C:\Program Files\Avira\Endpoint Protection SDK\firewall.tools.exe
                                                                    "firewall.tools.exe" uninstall --driver-path="C:\Program Files\Avira\Endpoint Protection SDK\drivers\firewall"
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    PID:1292
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          "C:\Windows\system32\schtasks.exe" /Create /Xml "C:\Users\Admin\AppData\Local\Temp\.CR.16072\Avira_Security_Installation.xml" /F /TN "Avira_Security_Installation"
                                                          2⤵
                                                          • Creates scheduled task(s)
                                                          PID:2608
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -pss -s 452 -p 2956 -ip 2956
                                                        1⤵
                                                          PID:540
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -u -p 2956 -s 1624
                                                          1⤵
                                                          • Program crash
                                                          PID:1288
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3952
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjcuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjcuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDU1MUFBQzItQTg2OC00Q0RCLThGNzAtMjYxOENGOTZGQUVFfSIgdXNlcmlkPSJ7OEFBODAwRTgtQTQxQi00RUIyLTgxQzItQTRDM0UyNzkyQUU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEMjZDQjE5My1FODhDLTQzQTktODNDMS0xQTgyRDBEQjE3N0J9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90OzA1UWxTc0tWY0FQaEJ2dEljT2s4T2pNTVdYL1FCVENtTFdUY2RSSnd3aVE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249Ijg5LjAuNDM4OS4xMTQiIG5leHR2ZXJzaW9uPSI4OS4wLjQzODkuMTE0IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDQ4MjY4NDkwMyIvPjwvYXBwPjwvcmVxdWVzdD4
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:3912
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6AEF14C6-3D74-4604-ABC6-CF7E6E82CC96}\MicrosoftEdge_X64_106.0.1370.37.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6AEF14C6-3D74-4604-ABC6-CF7E6E82CC96}\MicrosoftEdge_X64_106.0.1370.37.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3780
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6AEF14C6-3D74-4604-ABC6-CF7E6E82CC96}\EDGEMITMP_1D198.tmp\setup.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6AEF14C6-3D74-4604-ABC6-CF7E6E82CC96}\EDGEMITMP_1D198.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6AEF14C6-3D74-4604-ABC6-CF7E6E82CC96}\MicrosoftEdge_X64_106.0.1370.37.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Adds Run key to start application
                                                              • Drops file in Program Files directory
                                                              PID:5084
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjcuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjcuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDU1MUFBQzItQTg2OC00Q0RCLThGNzAtMjYxOENGOTZGQUVFfSIgdXNlcmlkPSJ7OEFBODAwRTgtQTQxQi00RUIyLTgxQzItQTRDM0UyNzkyQUU5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCMDREOTAxNC00ODg4LTQwOTQtODdEMS03NkQ3OUUwQjA0NjV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEwNi4wLjEzNzAuMzciIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ0OTkyNDY4MzUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NTQ2NDM0NTM4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDY1ODE1NDI2NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYjNiMDk5ZTQtNTMwYy00MTRiLWIzMGMtNjY5MjVjNTRmNWZhP1AxPTE2NjYwMDYxODImYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9Q1NBZ28lMmI0dHlaT1dWTXlBR21yR043aDhDbmNpMFZCcmJJYiUyYklBcEFZcmNGSlFwcng2N2hUSWdXMldIdmlhZHIlMmI0M2thM3ZEYjVqb1l1bDJkc0h2dFElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxMzQxMDE5MjgiIHRvdGFsPSIxMzQxMDE5MjgiIGRvd25sb2FkX3RpbWVfbXM9IjczMjgiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NjU4MTU0MjY2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDY3NjU5MTU4NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjYwOCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDkxNjgxOTY0MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijc5NyIgZG93bmxvYWRfdGltZV9tcz0iMTExMDkiIGRvd25sb2FkZWQ9IjEzNDEwMTkyOCIgdG90YWw9IjEzNDEwMTkyOCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMjQwMjMiLz48L2FwcD48L3JlcXVlc3Q-
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:3316
                                                        • C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe
                                                          "C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Checks for any installed AV software in registry
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:996
                                                        • C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
                                                          "C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Checks processor information in registry
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2212
                                                          • C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe
                                                            "C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe" delete
                                                            2⤵
                                                              PID:3532
                                                          • C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
                                                            "C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe" /migrateSettings
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:380
                                                          • C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe
                                                            "C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 7000
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Checks for any installed AV software in registry
                                                            • Drops file in System32 directory
                                                            • Modifies data under HKEY_USERS
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3528

                                                          Network

                                                                MITRE ATT&CK Enterprise v6

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\EdgeUpdate.dat
                                                                  Filesize

                                                                  12KB

                                                                  MD5

                                                                  369bbc37cff290adb8963dc5e518b9b8

                                                                  SHA1

                                                                  de0ef569f7ef55032e4b18d3a03542cc2bbac191

                                                                  SHA256

                                                                  3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

                                                                  SHA512

                                                                  4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                                                                  Filesize

                                                                  172KB

                                                                  MD5

                                                                  45e07d76113e58ed3eae843d0f391978

                                                                  SHA1

                                                                  db05c7094068f52ee4b551314527c625a21f8059

                                                                  SHA256

                                                                  29209988e4d7f68adb322af1bbc8e506db5f88279bc12786ca82d88fd135a776

                                                                  SHA512

                                                                  1ceb8e654dd9c2d56234ae8182f750644be13aab788fcf0d064f21da0e172e62cd6fa265ffce5b6bdce1b3f6e38707d757ca9d7c5df63f9c870d31426c22bbd4

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\MicrosoftEdgeUpdate.exe
                                                                  Filesize

                                                                  200KB

                                                                  MD5

                                                                  d1c3e60c8afb52d707e1fefda65fdea2

                                                                  SHA1

                                                                  79b739b599f804a822bf2059b84b1a58838f9a20

                                                                  SHA256

                                                                  32cef1f473157936b3adbb35b2566a619d4620af2998e05b01a493edf39d19ec

                                                                  SHA512

                                                                  95d6495a7f86424266105138c963504c33f30848e34d5d02a26fee8f1d6b2418d2f1b25e3261571feeecfa8a489c52412180f84cafc12f71fa0d1029c28afa03

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\MicrosoftEdgeUpdate.exe
                                                                  Filesize

                                                                  200KB

                                                                  MD5

                                                                  d1c3e60c8afb52d707e1fefda65fdea2

                                                                  SHA1

                                                                  79b739b599f804a822bf2059b84b1a58838f9a20

                                                                  SHA256

                                                                  32cef1f473157936b3adbb35b2566a619d4620af2998e05b01a493edf39d19ec

                                                                  SHA512

                                                                  95d6495a7f86424266105138c963504c33f30848e34d5d02a26fee8f1d6b2418d2f1b25e3261571feeecfa8a489c52412180f84cafc12f71fa0d1029c28afa03

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                  Filesize

                                                                  205KB

                                                                  MD5

                                                                  cac6c261275e3dd2e3914cfcc292e8e3

                                                                  SHA1

                                                                  ad1bffd171be87ce367eb7dfa94e7d535b6dc6a6

                                                                  SHA256

                                                                  e309bb6443e9bee17e0f203c2f3089c7ae729cf4429eadc08830961e7281af16

                                                                  SHA512

                                                                  2b0a2c6fa205bfed5bed4979f13122f5e6a31124bb9c024d75211eb696284bfe1946b8b32402f6341805a31170223d31e1532895ef61c670678afbc3e7f8dceb

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\MicrosoftEdgeUpdateCore.exe
                                                                  Filesize

                                                                  247KB

                                                                  MD5

                                                                  3160bc28225ac26f224c9d8c3dd3879d

                                                                  SHA1

                                                                  525c620bef1abd54bad5a7dac99e202dcbdd6c9f

                                                                  SHA256

                                                                  d2a4c7517995d3ddb8ce90ab479ffd779aca192beaf22c7367f2d7572633335c

                                                                  SHA512

                                                                  1336f8cb2baeffc6e91a06ea927fe8ba3998b9b3ad12d7801dbe2c5db59cb180de95c90f92d72cea82fe6ae338f842448c4b00e1d5c7b3de4e0e85308fdad3b8

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\NOTICE.TXT
                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  6dd5bf0743f2366a0bdd37e302783bcd

                                                                  SHA1

                                                                  e5ff6e044c40c02b1fc78304804fe1f993fed2e6

                                                                  SHA256

                                                                  91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

                                                                  SHA512

                                                                  f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdate.dll
                                                                  Filesize

                                                                  2.0MB

                                                                  MD5

                                                                  0b450b4d2fa5d196cfb11aef193df865

                                                                  SHA1

                                                                  749ef041b43c1153a365847724bc47ade84c59aa

                                                                  SHA256

                                                                  78fc4ae5232e4f75c818244b254394a975e16d56021dc7f864955cdbcfb62983

                                                                  SHA512

                                                                  ae9438fda4f19c8fc002a7193eb33321f16ee05b3cb401f63c1dfd7fa48d35bb2cce38ac6b64e1a3b23b9b51bb7cfbd2eff1d8b64629bf145cebcff3e26facbf

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdate.dll
                                                                  Filesize

                                                                  2.0MB

                                                                  MD5

                                                                  0b450b4d2fa5d196cfb11aef193df865

                                                                  SHA1

                                                                  749ef041b43c1153a365847724bc47ade84c59aa

                                                                  SHA256

                                                                  78fc4ae5232e4f75c818244b254394a975e16d56021dc7f864955cdbcfb62983

                                                                  SHA512

                                                                  ae9438fda4f19c8fc002a7193eb33321f16ee05b3cb401f63c1dfd7fa48d35bb2cce38ac6b64e1a3b23b9b51bb7cfbd2eff1d8b64629bf145cebcff3e26facbf

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_af.dll
                                                                  Filesize

                                                                  28KB

                                                                  MD5

                                                                  2eac5bbaddacc9c90a7d52087426319b

                                                                  SHA1

                                                                  62631d1714f9c9b4dac99107362a89b0e709e519

                                                                  SHA256

                                                                  b75bc84efb4e9798a173c3f3e90fc9f4ed56e5e2b6a9bd5e71bdefa598b4fd16

                                                                  SHA512

                                                                  18f5024a7ca1e55fa97b66752b8645f5f7d40d1d6e850d35541de3a0d598cfb7b74386612395aabe856a6f312ed99ebc0e3c1bdca6854386bf30a843240ef137

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_am.dll
                                                                  Filesize

                                                                  24KB

                                                                  MD5

                                                                  1cabac7c2ff12a0e8ec6f42436210c3a

                                                                  SHA1

                                                                  9b0accc8525d591bb5b517a11b9e4e06827892ab

                                                                  SHA256

                                                                  606886aed120ed99a6da0bd96ee462a12939299644b23176348e107b232124fe

                                                                  SHA512

                                                                  2610051f2998b2ab7221d648b596e3defc06d4af6b6992e1ec9f4418f0d41c466cc947b4d36836182f1a656a8fe11cab943ccf0aba3b4eb8ca0e110ecafa5683

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_ar.dll
                                                                  Filesize

                                                                  26KB

                                                                  MD5

                                                                  0a309d8f9fcd6b07a7e80cbf9062d374

                                                                  SHA1

                                                                  a86b8cd6322155a421babf019d33b2853d1ba4cb

                                                                  SHA256

                                                                  9fae19dc5943d22e6ef1ed0ad1fd2a3855e942d139ae8b10aaa422b8ff3d7078

                                                                  SHA512

                                                                  fc3767323ccab953a9a55c19e5272505ff3cf82ac0fd5a2b00ebd7b142856a2e46e534da61ee2c5f8a4f17e04e6a96c24b0eb86ca497f820879808e52b3a79a4

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_as.dll
                                                                  Filesize

                                                                  28KB

                                                                  MD5

                                                                  4359cb661582d525b2b0521de9bf055e

                                                                  SHA1

                                                                  2b4bd6ca59e3bb6484346b108eadfa58f0713a37

                                                                  SHA256

                                                                  d9fd47207f15d21901c7f0bf6180b0326cf6559483d8a746be20b4d2bee6e80a

                                                                  SHA512

                                                                  825816e8dad43e55ffc350917203de5fba686c7b85baf878c7b856494a3d09368a3cadf09db774e150fd96fb80f6fcf1d0e27ec1ed80103ea714a6ee95372471

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_az.dll
                                                                  Filesize

                                                                  29KB

                                                                  MD5

                                                                  a5a0299366c2aab858908e66452005f6

                                                                  SHA1

                                                                  a43f9b06ecc0516742d45b94501c4a2f289ad309

                                                                  SHA256

                                                                  c76de0c42cc0459fce633a5afdc10582348b74517bbab87e58995ce5dde3324a

                                                                  SHA512

                                                                  5c56ac27e62e893e2ab16ba40e35a2a878e20bb218b4c97bebb9d3026d4b185c85337ee7795af24639ba79792bc58c8f6ed16acc1e3cb840b452b16e3cef9756

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_bg.dll
                                                                  Filesize

                                                                  29KB

                                                                  MD5

                                                                  df66726c21287d3194bc2823c8b39051

                                                                  SHA1

                                                                  40d8f982fecbe78d46afaa12bc421474122a9549

                                                                  SHA256

                                                                  f11c8daba1f070cdb7328c57cd22666de7e784c3318322fb34d1a2026944be8d

                                                                  SHA512

                                                                  5ec560d5dbd72a257bfc8372376da8727b30bd5e01afe51f28c4c0a670aae374f915b888343e47e7817b6f3006df0166f29124e41b32ed3a9efc299734a7d5fa

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_bn-IN.dll
                                                                  Filesize

                                                                  29KB

                                                                  MD5

                                                                  c05a32431758b9154329a022507f18b4

                                                                  SHA1

                                                                  f1339d6a92c117adb8ff752d09cfa1b138a7b534

                                                                  SHA256

                                                                  eb61d21fa1408a7300cb20939be53b8fa6050dc1e2bf7bf749e9f69fbefea311

                                                                  SHA512

                                                                  a91f1a29ef6b316c253430b982507075047025a5c08eb297b63544a7839ac45ecc41f5737c80664a8863ebd2daf21e293c3e369613f9f423a98af741c68aef78

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_bn.dll
                                                                  Filesize

                                                                  29KB

                                                                  MD5

                                                                  565534aa402aa4fbf495b19a224114af

                                                                  SHA1

                                                                  e5a96bc68932ab34bb292114ae86e9f46c7e2f28

                                                                  SHA256

                                                                  c1ed73de87987e29610f8bf9781388c7ee497b9e53d52e4f8b396eeb8937cd33

                                                                  SHA512

                                                                  e6e5b7399d401d4f7bbae5fbf2aca62921133603e361ae8aa8430b9b187f2bef855d5ac13467f8a6f4500e7cd97e7e4e700024c54c65560f527e000dd667fbb8

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_bs.dll
                                                                  Filesize

                                                                  28KB

                                                                  MD5

                                                                  cec38b8587697fb3756c87d824a3fa6b

                                                                  SHA1

                                                                  38db26fbe8a91d0ddb2ae357ccfc6b6fe6e92b32

                                                                  SHA256

                                                                  464a7799eb7c05d28f775294953fc64d6f3978ef652bf3f0f4c7c3bd422690e8

                                                                  SHA512

                                                                  e111b175d221a64346c8ef1f4364c94948640afa14395ef50a55e3d3722559c4726bdf60245e77fd4e7ad853c1ce0ee9f1107ffa188fbbfa0e5895b48c9e1a05

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
                                                                  Filesize

                                                                  29KB

                                                                  MD5

                                                                  cdf6f06c7583803765ffb9201bcf8d5e

                                                                  SHA1

                                                                  2af217ece211611ba5c6250c8a6d07359cb0bf32

                                                                  SHA256

                                                                  37e32cda3a4dac0155613350135dbdbfac1c8e5d7a10ef7f5717dcffb8b4f9ca

                                                                  SHA512

                                                                  494ef11db2ab7ff792a24cd89eb53055428a638dd917b6b7f0483bce6d10f57760f6d8786cb4f925bd86db0c656e18a9cf73680bbb6845498f3b82a83014ca51

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_ca.dll
                                                                  Filesize

                                                                  30KB

                                                                  MD5

                                                                  979c55df3e9b16ff0fa594fde20f5c2d

                                                                  SHA1

                                                                  ef9e5da9e37e43e66c80593790582c9c0bfb3b6c

                                                                  SHA256

                                                                  1174b225b078e6f0986de0a59f0818d3a3df623b163b437be5f32182225ce170

                                                                  SHA512

                                                                  709a2efda4ddbd8eb75e91c0ade70563a6dca2d273fa2fd4f3cbd794990498505df0e97b18be28a3ca0de98e3fff5575ed04e540774579e7c86c4d4a9bebff81

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_cs.dll
                                                                  Filesize

                                                                  28KB

                                                                  MD5

                                                                  505cdec7acfeaee40351af218e1eef00

                                                                  SHA1

                                                                  79e5ddb99ab4aa02c43b25a6d57e87c4eca1afb5

                                                                  SHA256

                                                                  385a5cbc42b93b73f19d1d965382b9953c42bd171f077f6872d365f2cab84c40

                                                                  SHA512

                                                                  fb043a69fd04fd0c68747048866697c287014308cfce3b69d6d3a3cf9f56895bd92687df3cce9c6afb81cb076748d1f1645b914145eb438d0d5722791726b89a

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_cy.dll
                                                                  Filesize

                                                                  28KB

                                                                  MD5

                                                                  106e9315d74407a2552a0c9364dfd2f9

                                                                  SHA1

                                                                  88724d934580924d1297819f97d2bd1e7fec6b00

                                                                  SHA256

                                                                  b99d7895c41c4c2918b3f768e4af16172c7f09207cdbd3f2a91770c73637cce9

                                                                  SHA512

                                                                  5267c782a25297239185738f18437e9ccbf3b690d9a421c2f9ea2960f0c9183a486c352c3080433fd6931a44154be322ed21c63d68776eb549913d515a765f85

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_da.dll
                                                                  Filesize

                                                                  28KB

                                                                  MD5

                                                                  020abd9fd7b99a54a210a125c5469bc8

                                                                  SHA1

                                                                  5b7bbc5f0487e5955b8b891b728c89404afcd19d

                                                                  SHA256

                                                                  16fe6a115d5f75503b0c683099c0ba8330a93d2c6f51171ee1ceef9496a8a917

                                                                  SHA512

                                                                  fbe9b6b53c5a28e6ff4f15080fc1789b652808ec196de36f89dba117d5acd48242cd3c27280687c1305f10b92b6637fc79c7716c9f885a15d1c3149ca7661e67

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_de.dll
                                                                  Filesize

                                                                  30KB

                                                                  MD5

                                                                  b714a4ec7603291a98f2c07cf993f611

                                                                  SHA1

                                                                  fb8a9623475ed4ef0fd00b16ba43372c5d842829

                                                                  SHA256

                                                                  2a4eb6299914ccca3945ee44014428dc871f8557ea1dbefc23cc5fb58d90b211

                                                                  SHA512

                                                                  724052a19161224ec553d52a48aefdf4d56a64fd56f87da684e0fa92832fa699101dcfd71f50df4da3f5162fa628957e138e5e2b085d1a022b3c94190957e481

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_el.dll
                                                                  Filesize

                                                                  30KB

                                                                  MD5

                                                                  de30ccdce58d87af22c121229e1d034e

                                                                  SHA1

                                                                  0a1e42dee0cb30e70aeccdbd69f295c1d38a82fc

                                                                  SHA256

                                                                  f2a37ea5b5d3c738dfe71dc638ff21a14fba664980b0086d638b8c7eedbf5cfc

                                                                  SHA512

                                                                  8e10ceb08adbc9d04da644a79c77c56a321c7d1d62b9bfc2b480d5963d73dcd6e997ab602cba04945e769c19689b24043c0682bd6619672a9809757155104b56

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Microsoft\Temp\EUD1F.tmp\msedgeupdateres_en.dll
                                                                  Filesize

                                                                  27KB

                                                                  MD5

                                                                  b38fc02921f9cab6df148550631f5d71

                                                                  SHA1

                                                                  b6465b3c4ad3518ac1e0368fb00123e60b5de8e3

                                                                  SHA256

                                                                  0eafe6e62f849843a0b85f70733e68cb2e31521198508499c39429438f4754d2

                                                                  SHA512

                                                                  905fbf837d237c8317b1904967c5637f330345e6b5898ee02791dd46deaa7897e8ee2dab17183a12f3d02e5ff5616b83ab4141d91e5de2f2497ad3c9303f13b3

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.COMMON.GUARDS.DLL
                                                                  Filesize

                                                                  17KB

                                                                  MD5

                                                                  3b01bd8e5db865776ff79571cdb580a2

                                                                  SHA1

                                                                  2eab636247c2edcfc0000e24c7bf8c8c1e6de6fd

                                                                  SHA256

                                                                  2a4022204e2d7710ffe041b863fed86fc0f00a2a6039b9960c371b21407b6c18

                                                                  SHA512

                                                                  139a95cd640948df703134d8de5541d170e422a643a272685f3ffafbaaf3e7cfb2396c554398a725eb4635e3e5f2ab2f675e7118eb8271b6cb9de9ede3741dc6

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.COMMON.GUARDS.DLL
                                                                  Filesize

                                                                  17KB

                                                                  MD5

                                                                  3b01bd8e5db865776ff79571cdb580a2

                                                                  SHA1

                                                                  2eab636247c2edcfc0000e24c7bf8c8c1e6de6fd

                                                                  SHA256

                                                                  2a4022204e2d7710ffe041b863fed86fc0f00a2a6039b9960c371b21407b6c18

                                                                  SHA512

                                                                  139a95cd640948df703134d8de5541d170e422a643a272685f3ffafbaaf3e7cfb2396c554398a725eb4635e3e5f2ab2f675e7118eb8271b6cb9de9ede3741dc6

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.COMMON.MIXPANEL.DLL
                                                                  Filesize

                                                                  64KB

                                                                  MD5

                                                                  49e0e8f437c146e630e8d7c878f874a7

                                                                  SHA1

                                                                  736cf402467778122c51d63103f913ea511f1927

                                                                  SHA256

                                                                  9ef6813ded99f6d6f264bac6131de6a84d641ecd5bd6741c875754169cff3e96

                                                                  SHA512

                                                                  ccc9e64760f69f8648d080a9ed3f34dcb1b76846825f2b85f56bb308d120125ec4b2af50c8835a071fa26c1eff6b7d1f65d0005433079e4172eb398eae0c5f5f

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.COMMON.MIXPANEL.DLL
                                                                  Filesize

                                                                  64KB

                                                                  MD5

                                                                  49e0e8f437c146e630e8d7c878f874a7

                                                                  SHA1

                                                                  736cf402467778122c51d63103f913ea511f1927

                                                                  SHA256

                                                                  9ef6813ded99f6d6f264bac6131de6a84d641ecd5bd6741c875754169cff3e96

                                                                  SHA512

                                                                  ccc9e64760f69f8648d080a9ed3f34dcb1b76846825f2b85f56bb308d120125ec4b2af50c8835a071fa26c1eff6b7d1f65d0005433079e4172eb398eae0c5f5f

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.FILEDOWNLOADER.DLL
                                                                  Filesize

                                                                  48KB

                                                                  MD5

                                                                  21c33c040d27ce5f18f3bde3e4aa931f

                                                                  SHA1

                                                                  ba037b37142ec45145b37b07b85ef8877a3ee4fa

                                                                  SHA256

                                                                  ca3be70bbb91acbb866d326ca29768c5c8422c06842da2029cb58d6c1a28a144

                                                                  SHA512

                                                                  7cce6860aafe3a25ac1051695c0a7e31ed239c3a2b028a7faddc21f791f8e5c912b175ceaeabf8f018f5835178d56ad07ad48255dcbe0899cdedeb98d5880032

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.FILEDOWNLOADER.DLL
                                                                  Filesize

                                                                  48KB

                                                                  MD5

                                                                  21c33c040d27ce5f18f3bde3e4aa931f

                                                                  SHA1

                                                                  ba037b37142ec45145b37b07b85ef8877a3ee4fa

                                                                  SHA256

                                                                  ca3be70bbb91acbb866d326ca29768c5c8422c06842da2029cb58d6c1a28a144

                                                                  SHA512

                                                                  7cce6860aafe3a25ac1051695c0a7e31ed239c3a2b028a7faddc21f791f8e5c912b175ceaeabf8f018f5835178d56ad07ad48255dcbe0899cdedeb98d5880032

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.SPOTLIGHT.BOOTSTRAPPER.CORE.DLL
                                                                  Filesize

                                                                  362KB

                                                                  MD5

                                                                  77059ad7cd80d2f5126ae7190752acac

                                                                  SHA1

                                                                  0b8124ada148c3473c1e7bd86d82d7fa7cb7809e

                                                                  SHA256

                                                                  229aa8d3833d5d44392f774e4d00b399d3b88a6e165913cda0784d06a82fdcd5

                                                                  SHA512

                                                                  1414fc9878c94c6b986f4cce249833133420832e9c62c066fb56de45b76c20968c40f287720a2df83eb6d19116ee9bd997de92588902d5e87024f1d870922a40

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.SPOTLIGHT.BOOTSTRAPPER.CORE.DLL
                                                                  Filesize

                                                                  362KB

                                                                  MD5

                                                                  77059ad7cd80d2f5126ae7190752acac

                                                                  SHA1

                                                                  0b8124ada148c3473c1e7bd86d82d7fa7cb7809e

                                                                  SHA256

                                                                  229aa8d3833d5d44392f774e4d00b399d3b88a6e165913cda0784d06a82fdcd5

                                                                  SHA512

                                                                  1414fc9878c94c6b986f4cce249833133420832e9c62c066fb56de45b76c20968c40f287720a2df83eb6d19116ee9bd997de92588902d5e87024f1d870922a40

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.SPOTLIGHT.BOOTSTRAPPER.ENGINE.DLL
                                                                  Filesize

                                                                  345KB

                                                                  MD5

                                                                  3b2a564303c77fd8b4a6ee1e99d2d540

                                                                  SHA1

                                                                  f8311b77e7ce5385b69e2e4841b130ab8b65fdcf

                                                                  SHA256

                                                                  571f6098818e39b9276474549e3b8d91e0a4b70a21d7fca1fc1007f76f855401

                                                                  SHA512

                                                                  6062f9433273000b3186c90873d4f8c5b8cf7b9e883d29e359a957cef1aaa3d41814ad4002f3091f33f2408edebf71f895c858400391518ed341e0c35b2d7c53

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.SPOTLIGHT.BOOTSTRAPPER.ENGINE.DLL
                                                                  Filesize

                                                                  345KB

                                                                  MD5

                                                                  3b2a564303c77fd8b4a6ee1e99d2d540

                                                                  SHA1

                                                                  f8311b77e7ce5385b69e2e4841b130ab8b65fdcf

                                                                  SHA256

                                                                  571f6098818e39b9276474549e3b8d91e0a4b70a21d7fca1fc1007f76f855401

                                                                  SHA512

                                                                  6062f9433273000b3186c90873d4f8c5b8cf7b9e883d29e359a957cef1aaa3d41814ad4002f3091f33f2408edebf71f895c858400391518ed341e0c35b2d7c53

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
                                                                  Filesize

                                                                  1.5MB

                                                                  MD5

                                                                  ca52e4a0309eb40c2dcd4244a9b2aeaa

                                                                  SHA1

                                                                  b859913460456af225e02aeb062d07c90e0f1708

                                                                  SHA256

                                                                  e19bf508ad716254f506fa6a65256bcea1312174de344a5d5be5434fe6d2afa7

                                                                  SHA512

                                                                  c5185d2b78ca54ce1aa0b69c9095d2b0990edf48cf3f5cd8e785a26e0fade1974df992d7969e23596158dcb44f3ddbbf6b6153169f0c71d47ee0b29991d2be71

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.SPOTLIGHT.BOOTSTRAPPER.LOGGING.DLL
                                                                  Filesize

                                                                  166KB

                                                                  MD5

                                                                  51de5cd119bc830206de93ee96444a88

                                                                  SHA1

                                                                  0b590ade2e7cda07140f2b0f6aa05a9627922b31

                                                                  SHA256

                                                                  4f4b0f11acf7edb61f6f8ed26d03a9691e2e51c9aa3b53438ef30689abc2c1be

                                                                  SHA512

                                                                  3bc36446e1bd8e337dd65d73167079d9d8931fcc86337c67af0cfbdd061884219a9a13e719a4cec1684321080081b76ccb64c55a676192ebbe66d11b93c22cff

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.SPOTLIGHT.BOOTSTRAPPER.LOGGING.DLL
                                                                  Filesize

                                                                  166KB

                                                                  MD5

                                                                  51de5cd119bc830206de93ee96444a88

                                                                  SHA1

                                                                  0b590ade2e7cda07140f2b0f6aa05a9627922b31

                                                                  SHA256

                                                                  4f4b0f11acf7edb61f6f8ed26d03a9691e2e51c9aa3b53438ef30689abc2c1be

                                                                  SHA512

                                                                  3bc36446e1bd8e337dd65d73167079d9d8931fcc86337c67af0cfbdd061884219a9a13e719a4cec1684321080081b76ccb64c55a676192ebbe66d11b93c22cff

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.SPOTLIGHT.BOOTSTRAPPER.REACTIVE.DLL
                                                                  Filesize

                                                                  205KB

                                                                  MD5

                                                                  225311ccba1fa5842ce1353875ccc572

                                                                  SHA1

                                                                  989723cc8e2b0317fbff4401f877320790513df2

                                                                  SHA256

                                                                  7a5470a20a27d9df5589d24c30eb41621dd2ff96bf13bba67d64be6514f3f1ac

                                                                  SHA512

                                                                  8613f6e725fc6b425fa2cd3dbcb0699e13ba2ebabab91d8d4df40235819fa0fd3c93ca81c267c62c3595b85b7e7b780aee1aec761a44561cf081a1ee9736126c

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\AVIRA.SPOTLIGHT.BOOTSTRAPPER.REACTIVE.DLL
                                                                  Filesize

                                                                  205KB

                                                                  MD5

                                                                  225311ccba1fa5842ce1353875ccc572

                                                                  SHA1

                                                                  989723cc8e2b0317fbff4401f877320790513df2

                                                                  SHA256

                                                                  7a5470a20a27d9df5589d24c30eb41621dd2ff96bf13bba67d64be6514f3f1ac

                                                                  SHA512

                                                                  8613f6e725fc6b425fa2cd3dbcb0699e13ba2ebabab91d8d4df40235819fa0fd3c93ca81c267c62c3595b85b7e7b780aee1aec761a44561cf081a1ee9736126c

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\DRYIOC.DLL
                                                                  Filesize

                                                                  438KB

                                                                  MD5

                                                                  2178d7eca6ab43ced708ca20a6722a68

                                                                  SHA1

                                                                  937536b753b5a4404ed312d0e9a778c67433e771

                                                                  SHA256

                                                                  78939516bcac09c1f71e7e33d9a5df07ca6ec4fdd390bc164d20edf01371d5af

                                                                  SHA512

                                                                  8f19cac88cb3b1e34cc4b2d5a1429caaf1a9538a23f368cc718d2ef7762bcda3abfbfe4c012c659525fab2fdbb09cb0757ea7557bf3e36fb6bd8f8ec4923bf98

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\DRYIOC.DLL
                                                                  Filesize

                                                                  438KB

                                                                  MD5

                                                                  2178d7eca6ab43ced708ca20a6722a68

                                                                  SHA1

                                                                  937536b753b5a4404ed312d0e9a778c67433e771

                                                                  SHA256

                                                                  78939516bcac09c1f71e7e33d9a5df07ca6ec4fdd390bc164d20edf01371d5af

                                                                  SHA512

                                                                  8f19cac88cb3b1e34cc4b2d5a1429caaf1a9538a23f368cc718d2ef7762bcda3abfbfe4c012c659525fab2fdbb09cb0757ea7557bf3e36fb6bd8f8ec4923bf98

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\DRYIOC.MEFATTRIBUTEDMODEL.DLL
                                                                  Filesize

                                                                  69KB

                                                                  MD5

                                                                  3aa463876fbdc1d6eea8a195c33ca8d4

                                                                  SHA1

                                                                  041df6a3d73ed18c7357e6e6087de0f6b08e7d3d

                                                                  SHA256

                                                                  52c2b170499fc6264c4757f3fe8c8ab056aa64caca818fd6b0ec7f55aa611e1b

                                                                  SHA512

                                                                  66897b16866b3ba8cb3fcfd5c2f3f41b88b6cddc21ed44ba0a1cb8ee928ccb3e84d14cec868ba683a3295d8fb41668bb6cd1d3e2d3d86cc7d3f83c0c552c5721

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\DRYIOC.MEFATTRIBUTEDMODEL.DLL
                                                                  Filesize

                                                                  69KB

                                                                  MD5

                                                                  3aa463876fbdc1d6eea8a195c33ca8d4

                                                                  SHA1

                                                                  041df6a3d73ed18c7357e6e6087de0f6b08e7d3d

                                                                  SHA256

                                                                  52c2b170499fc6264c4757f3fe8c8ab056aa64caca818fd6b0ec7f55aa611e1b

                                                                  SHA512

                                                                  66897b16866b3ba8cb3fcfd5c2f3f41b88b6cddc21ed44ba0a1cb8ee928ccb3e84d14cec868ba683a3295d8fb41668bb6cd1d3e2d3d86cc7d3f83c0c552c5721

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\DRYIOCATTRIBUTES.DLL
                                                                  Filesize

                                                                  32KB

                                                                  MD5

                                                                  76629f898346e0e1462655bfe6a28821

                                                                  SHA1

                                                                  a5591a4fb8d153256ce0ef02e0225df04c7b289a

                                                                  SHA256

                                                                  125f3cb6d9cd6c0fa087d6a8343e983d340d5dada2dbfe05e6bf2288f12a8f12

                                                                  SHA512

                                                                  238577f9560018eafb2735e51120d4ac04ddd4e51b9e64471af9da563e58cc3c012ea72f57f0f1fd5bbc668cfb2b256b171c7a965a7968da5603def94d2a3998

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\DRYIOCATTRIBUTES.DLL
                                                                  Filesize

                                                                  32KB

                                                                  MD5

                                                                  76629f898346e0e1462655bfe6a28821

                                                                  SHA1

                                                                  a5591a4fb8d153256ce0ef02e0225df04c7b289a

                                                                  SHA256

                                                                  125f3cb6d9cd6c0fa087d6a8343e983d340d5dada2dbfe05e6bf2288f12a8f12

                                                                  SHA512

                                                                  238577f9560018eafb2735e51120d4ac04ddd4e51b9e64471af9da563e58cc3c012ea72f57f0f1fd5bbc668cfb2b256b171c7a965a7968da5603def94d2a3998

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\EN-US\AVIRA.SPOTLIGHT.BOOTSTRAPPER.RESOURCES.DLL
                                                                  Filesize

                                                                  33KB

                                                                  MD5

                                                                  befd3d540eb998f3b522074a361ed9b0

                                                                  SHA1

                                                                  6c4b5654b322a786e0b2f5cb71a4b6063f16ca79

                                                                  SHA256

                                                                  e78e3e9b41983f65c4f60ba9dfaec1ddcc17b9fb7a14e105f738c8d22dcd3b2c

                                                                  SHA512

                                                                  a387f7dcdecfc3ec254bfa180480a74306787671c080c8b7cee079baa199e7630741d694c56a236701272d5e14dcd1dfcbaea535e669262366a7f8fd812e9b3d

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\EN-US\AVIRA.SPOTLIGHT.BOOTSTRAPPER.RESOURCES.DLL
                                                                  Filesize

                                                                  33KB

                                                                  MD5

                                                                  befd3d540eb998f3b522074a361ed9b0

                                                                  SHA1

                                                                  6c4b5654b322a786e0b2f5cb71a4b6063f16ca79

                                                                  SHA256

                                                                  e78e3e9b41983f65c4f60ba9dfaec1ddcc17b9fb7a14e105f738c8d22dcd3b2c

                                                                  SHA512

                                                                  a387f7dcdecfc3ec254bfa180480a74306787671c080c8b7cee079baa199e7630741d694c56a236701272d5e14dcd1dfcbaea535e669262366a7f8fd812e9b3d

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\FR-FR\AVIRA.SPOTLIGHT.BOOTSTRAPPER.RESOURCES.DLL
                                                                  Filesize

                                                                  26KB

                                                                  MD5

                                                                  75026ba5797590d534fdcc8c8bba10f7

                                                                  SHA1

                                                                  fbbe359336c8d4a78b8392644c688f8b5ec7d0d4

                                                                  SHA256

                                                                  14af68fe1032037b62633b363ae7bc1b7c1dfce49a82da5229153796e7e02dea

                                                                  SHA512

                                                                  cdf2f84a103f09d83c748547ab23d74b9348899bd58e0252a834d31fad490f5bf7bfef72cb43fcae8566bc2f5a427e4c20a2edfc183a94add7f42c7370e12ef0

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\FR-FR\AVIRA.SPOTLIGHT.BOOTSTRAPPER.RESOURCES.DLL
                                                                  Filesize

                                                                  26KB

                                                                  MD5

                                                                  75026ba5797590d534fdcc8c8bba10f7

                                                                  SHA1

                                                                  fbbe359336c8d4a78b8392644c688f8b5ec7d0d4

                                                                  SHA256

                                                                  14af68fe1032037b62633b363ae7bc1b7c1dfce49a82da5229153796e7e02dea

                                                                  SHA512

                                                                  cdf2f84a103f09d83c748547ab23d74b9348899bd58e0252a834d31fad490f5bf7bfef72cb43fcae8566bc2f5a427e4c20a2edfc183a94add7f42c7370e12ef0

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\MICROSOFT.WINDOWS.SHELL.DLL
                                                                  Filesize

                                                                  160KB

                                                                  MD5

                                                                  e30f3664d10ed36454e2e60b9a7b7517

                                                                  SHA1

                                                                  a9887ab8ed02bfa3540354004dd859ff35d71a0f

                                                                  SHA256

                                                                  32217df3aebb45f4db96b5c50b4005c6498670b0d1267161c748ab5d69f355e9

                                                                  SHA512

                                                                  b76a049e544eaf974dc20f6a69e3e6c6c0c57a6da50b86ce24899459fd5768ecc41dbf866a34fa190e5608bef85edf29c3334e44cdbedd79c3c719631ea55bda

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\MICROSOFT.WINDOWS.SHELL.DLL
                                                                  Filesize

                                                                  160KB

                                                                  MD5

                                                                  e30f3664d10ed36454e2e60b9a7b7517

                                                                  SHA1

                                                                  a9887ab8ed02bfa3540354004dd859ff35d71a0f

                                                                  SHA256

                                                                  32217df3aebb45f4db96b5c50b4005c6498670b0d1267161c748ab5d69f355e9

                                                                  SHA512

                                                                  b76a049e544eaf974dc20f6a69e3e6c6c0c57a6da50b86ce24899459fd5768ecc41dbf866a34fa190e5608bef85edf29c3334e44cdbedd79c3c719631ea55bda

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\PRODUCTLABEL.COMMON.DLL
                                                                  Filesize

                                                                  181KB

                                                                  MD5

                                                                  b28dd515c279756dafa231c563f4b2fb

                                                                  SHA1

                                                                  59529e1afafb0edac6c75e99b050c249ea8e6c3e

                                                                  SHA256

                                                                  72b0d3316204164ea6ee60e0af5a9ae4c6f0522df8647bcd0067dc82c60fed45

                                                                  SHA512

                                                                  09f77e931d7eb2c883efc4a4b5352d7dd1d6e3b95363c05049fe07c4e3153b01b64d3ff4893545b5897f1a337431350501cfea990362c1d88657cfbbfe710b62

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\PRODUCTLABEL.COMMON.DLL
                                                                  Filesize

                                                                  181KB

                                                                  MD5

                                                                  b28dd515c279756dafa231c563f4b2fb

                                                                  SHA1

                                                                  59529e1afafb0edac6c75e99b050c249ea8e6c3e

                                                                  SHA256

                                                                  72b0d3316204164ea6ee60e0af5a9ae4c6f0522df8647bcd0067dc82c60fed45

                                                                  SHA512

                                                                  09f77e931d7eb2c883efc4a4b5352d7dd1d6e3b95363c05049fe07c4e3153b01b64d3ff4893545b5897f1a337431350501cfea990362c1d88657cfbbfe710b62

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\PRODUCTLABEL.COMMON.DLL
                                                                  Filesize

                                                                  181KB

                                                                  MD5

                                                                  b28dd515c279756dafa231c563f4b2fb

                                                                  SHA1

                                                                  59529e1afafb0edac6c75e99b050c249ea8e6c3e

                                                                  SHA256

                                                                  72b0d3316204164ea6ee60e0af5a9ae4c6f0522df8647bcd0067dc82c60fed45

                                                                  SHA512

                                                                  09f77e931d7eb2c883efc4a4b5352d7dd1d6e3b95363c05049fe07c4e3153b01b64d3ff4893545b5897f1a337431350501cfea990362c1d88657cfbbfe710b62

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\PRODUCTLABEL.COMMON.DLL
                                                                  Filesize

                                                                  181KB

                                                                  MD5

                                                                  b28dd515c279756dafa231c563f4b2fb

                                                                  SHA1

                                                                  59529e1afafb0edac6c75e99b050c249ea8e6c3e

                                                                  SHA256

                                                                  72b0d3316204164ea6ee60e0af5a9ae4c6f0522df8647bcd0067dc82c60fed45

                                                                  SHA512

                                                                  09f77e931d7eb2c883efc4a4b5352d7dd1d6e3b95363c05049fe07c4e3153b01b64d3ff4893545b5897f1a337431350501cfea990362c1d88657cfbbfe710b62

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\PRODUCTLABEL.DLL
                                                                  Filesize

                                                                  247KB

                                                                  MD5

                                                                  03686671b9a9c4a1e36e2a4bef4f0bc4

                                                                  SHA1

                                                                  65985b29c6ce04ca1684a2758f9d19eb7a40b48c

                                                                  SHA256

                                                                  73c49d192c1b64f6aa80bb65403227dfc69d02d6f8d542998892370d0307e9d7

                                                                  SHA512

                                                                  7b0cb6482ccf9dafdb1d849d91ee6d37bcae9661146030ee8a862018ea24e22955dafefdd22b06aa7d13009ead94100e6b32c7bfc3df383c6e8e148ed064f7bd

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\PRODUCTLABEL.DLL
                                                                  Filesize

                                                                  247KB

                                                                  MD5

                                                                  03686671b9a9c4a1e36e2a4bef4f0bc4

                                                                  SHA1

                                                                  65985b29c6ce04ca1684a2758f9d19eb7a40b48c

                                                                  SHA256

                                                                  73c49d192c1b64f6aa80bb65403227dfc69d02d6f8d542998892370d0307e9d7

                                                                  SHA512

                                                                  7b0cb6482ccf9dafdb1d849d91ee6d37bcae9661146030ee8a862018ea24e22955dafefdd22b06aa7d13009ead94100e6b32c7bfc3df383c6e8e148ed064f7bd

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\PRODUCTLABEL.DLL
                                                                  Filesize

                                                                  247KB

                                                                  MD5

                                                                  03686671b9a9c4a1e36e2a4bef4f0bc4

                                                                  SHA1

                                                                  65985b29c6ce04ca1684a2758f9d19eb7a40b48c

                                                                  SHA256

                                                                  73c49d192c1b64f6aa80bb65403227dfc69d02d6f8d542998892370d0307e9d7

                                                                  SHA512

                                                                  7b0cb6482ccf9dafdb1d849d91ee6d37bcae9661146030ee8a862018ea24e22955dafefdd22b06aa7d13009ead94100e6b32c7bfc3df383c6e8e148ed064f7bd

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\PRODUCTLABEL.DLL
                                                                  Filesize

                                                                  247KB

                                                                  MD5

                                                                  03686671b9a9c4a1e36e2a4bef4f0bc4

                                                                  SHA1

                                                                  65985b29c6ce04ca1684a2758f9d19eb7a40b48c

                                                                  SHA256

                                                                  73c49d192c1b64f6aa80bb65403227dfc69d02d6f8d542998892370d0307e9d7

                                                                  SHA512

                                                                  7b0cb6482ccf9dafdb1d849d91ee6d37bcae9661146030ee8a862018ea24e22955dafefdd22b06aa7d13009ead94100e6b32c7bfc3df383c6e8e148ed064f7bd

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\ed20f33c-def5-44b5-a713-70e57d9bdf1a\MicrosoftEdgeWebview2Setup.exe
                                                                  Filesize

                                                                  1.5MB

                                                                  MD5

                                                                  cf7f5cdb6443fef5c5e14351dfa52a61

                                                                  SHA1

                                                                  50b9178f04c1102938afa4badb5f03cfc0f8a9b9

                                                                  SHA256

                                                                  69a70d81c56c0fedf43d7a07ee0f8ad006383ec06733748ac83b0401bf937ddb

                                                                  SHA512

                                                                  0cdba91499cc421da6d330954a9e3211765ebc2c48034a93b5b084e5b2c7de93ca96af025f2e5e91054d113e4c7f8c0bec3a8c94269565ce7181ea165a57c3cc

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16065\ed20f33c-def5-44b5-a713-70e57d9bdf1a\MicrosoftEdgeWebview2Setup.exe
                                                                  Filesize

                                                                  1.5MB

                                                                  MD5

                                                                  cf7f5cdb6443fef5c5e14351dfa52a61

                                                                  SHA1

                                                                  50b9178f04c1102938afa4badb5f03cfc0f8a9b9

                                                                  SHA256

                                                                  69a70d81c56c0fedf43d7a07ee0f8ad006383ec06733748ac83b0401bf937ddb

                                                                  SHA512

                                                                  0cdba91499cc421da6d330954a9e3211765ebc2c48034a93b5b084e5b2c7de93ca96af025f2e5e91054d113e4c7f8c0bec3a8c94269565ce7181ea165a57c3cc

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\.CR.16072\Avira_Security_Installation.xml
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  89d377234e7ec82778659eb37c4e1f14

                                                                  SHA1

                                                                  302644d1756ccb15af13caa34372e451e2af9b16

                                                                  SHA256

                                                                  658f6ee60ef6ecf47245cddfc98cc4f33f60d977a76051cf63fec35a1f005df2

                                                                  SHA512

                                                                  d1bfdd86191d208bd66fb2d265518b8c93ae06c06c1d41bcf7eed3eae9345ff0bd65b5832642da156a7226c3181ba792a2f007373e023cad3f37589c5ee7caba

                                                                  Download Submit

                                                                • memory/464-292-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                  Filesize

                                                                  816KB

                                                                  Download

                                                                • memory/464-285-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                  Filesize

                                                                  816KB

                                                                  Download

                                                                • memory/912-260-0x0000000000400000-0x00000000004ED000-memory.dmp

                                                                  Filesize

                                                                  948KB

                                                                  Download

                                                                • memory/912-257-0x0000000000400000-0x00000000004ED000-memory.dmp

                                                                  Filesize

                                                                  948KB

                                                                  Download

                                                                • memory/972-268-0x0000000005720000-0x000000000576A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/972-267-0x00000000055A0000-0x0000000005614000-memory.dmp

                                                                  Filesize

                                                                  464KB

                                                                  Download

                                                                • memory/972-265-0x0000000000B60000-0x0000000000B72000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/972-266-0x0000000005490000-0x00000000054B8000-memory.dmp

                                                                  Filesize

                                                                  160KB

                                                                  Download

                                                                • memory/1152-182-0x0000000005A60000-0x0000000005A68000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/1152-184-0x0000000005BC0000-0x0000000005BFC000-memory.dmp

                                                                  Filesize

                                                                  240KB

                                                                  Download

                                                                • memory/1152-139-0x0000000005110000-0x0000000005180000-memory.dmp

                                                                  Filesize

                                                                  448KB

                                                                  Download

                                                                • memory/1152-159-0x0000000005660000-0x00000000056A2000-memory.dmp

                                                                  Filesize

                                                                  264KB

                                                                  Download

                                                                • memory/1152-195-0x000000000AD10000-0x000000000AD20000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/1152-192-0x000000000AD20000-0x000000000AD86000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/1152-191-0x000000000A3D0000-0x000000000A462000-memory.dmp

                                                                  Filesize

                                                                  584KB

                                                                  Download

                                                                • memory/1152-190-0x000000000A170000-0x000000000A17E000-memory.dmp

                                                                  Filesize

                                                                  56KB

                                                                  Download

                                                                • memory/1152-189-0x000000000A190000-0x000000000A1C8000-memory.dmp

                                                                  Filesize

                                                                  224KB

                                                                  Download

                                                                • memory/1152-136-0x00000000005F0000-0x0000000000776000-memory.dmp

                                                                  Filesize

                                                                  1.5MB

                                                                  Download

                                                                • memory/1152-165-0x00000000056E0000-0x000000000570C000-memory.dmp

                                                                  Filesize

                                                                  176KB

                                                                  Download

                                                                • memory/1152-188-0x0000000006C90000-0x0000000006C98000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/1152-174-0x0000000005750000-0x0000000005764000-memory.dmp

                                                                  Filesize

                                                                  80KB

                                                                  Download

                                                                • memory/1152-187-0x0000000005B40000-0x0000000005B4A000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/1152-142-0x00000000054C0000-0x00000000054EC000-memory.dmp

                                                                  Filesize

                                                                  176KB

                                                                  Download

                                                                • memory/1152-183-0x0000000005B70000-0x0000000005BC0000-memory.dmp

                                                                  Filesize

                                                                  320KB

                                                                  Download

                                                                • memory/1152-154-0x00000000055E0000-0x0000000005610000-memory.dmp

                                                                  Filesize

                                                                  192KB

                                                                  Download

                                                                • memory/1152-171-0x00000000057E0000-0x0000000005816000-memory.dmp

                                                                  Filesize

                                                                  216KB

                                                                  Download

                                                                • memory/1152-179-0x0000000005840000-0x000000000584A000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/1152-176-0x0000000005880000-0x0000000005892000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/1152-175-0x0000000005850000-0x0000000005872000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/1152-168-0x0000000005780000-0x00000000057DA000-memory.dmp

                                                                  Filesize

                                                                  360KB

                                                                  Download

                                                                • memory/1152-151-0x0000000005500000-0x000000000550C000-memory.dmp

                                                                  Filesize

                                                                  48KB

                                                                  Download

                                                                • memory/1152-148-0x0000000005510000-0x0000000005526000-memory.dmp

                                                                  Filesize

                                                                  88KB

                                                                  Download

                                                                • memory/1152-162-0x0000000005CD0000-0x0000000006274000-memory.dmp

                                                                  Filesize

                                                                  5.6MB

                                                                  Download

                                                                • memory/1152-145-0x0000000005550000-0x00000000055AE000-memory.dmp

                                                                  Filesize

                                                                  376KB

                                                                  Download

                                                                • memory/1708-306-0x0000000006CD0000-0x0000000006CE0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/1708-282-0x0000000000340000-0x000000000039A000-memory.dmp

                                                                  Filesize

                                                                  360KB

                                                                  Download

                                                                • memory/1708-296-0x0000000005140000-0x000000000514E000-memory.dmp

                                                                  Filesize

                                                                  56KB

                                                                  Download

                                                                • memory/1708-298-0x0000000005180000-0x000000000518C000-memory.dmp

                                                                  Filesize

                                                                  48KB

                                                                  Download

                                                                • memory/1708-289-0x00000000050C0000-0x00000000050D8000-memory.dmp

                                                                  Filesize

                                                                  96KB

                                                                  Download

                                                                • memory/1708-288-0x0000000005090000-0x00000000050BA000-memory.dmp

                                                                  Filesize

                                                                  168KB

                                                                  Download

                                                                • memory/1708-303-0x0000000006CA0000-0x0000000006CAA000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/1708-304-0x0000000006D80000-0x0000000006DD4000-memory.dmp

                                                                  Filesize

                                                                  336KB

                                                                  Download

                                                                • memory/1708-291-0x0000000005110000-0x000000000513A000-memory.dmp

                                                                  Filesize

                                                                  168KB

                                                                  Download

                                                                • memory/1708-305-0x0000000006DE0000-0x0000000006E0E000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/1708-307-0x0000000006E50000-0x0000000006E86000-memory.dmp

                                                                  Filesize

                                                                  216KB

                                                                  Download

                                                                • memory/1708-308-0x0000000006D30000-0x0000000006D38000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2528-315-0x0000000005120000-0x00000000055C6000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/3400-316-0x0000000003200000-0x0000000003259000-memory.dmp

                                                                  Filesize

                                                                  356KB

                                                                  Download

                                                                • memory/3400-335-0x00000000021F1000-0x00000000021F7000-memory.dmp

                                                                  Filesize

                                                                  24KB

                                                                  Download

                                                                • memory/3400-334-0x00000000021F0000-0x00000000021FB000-memory.dmp

                                                                  Filesize

                                                                  44KB

                                                                  Download

                                                                • memory/3576-251-0x0000000006D20000-0x0000000006D3A000-memory.dmp

                                                                  Filesize

                                                                  104KB

                                                                  Download

                                                                • memory/3660-238-0x0000000000400000-0x00000000004EF000-memory.dmp

                                                                  Filesize

                                                                  956KB

                                                                  Download

                                                                • memory/3660-241-0x0000000000400000-0x00000000004EF000-memory.dmp

                                                                  Filesize

                                                                  956KB

                                                                  Download

                                                                • memory/3660-248-0x0000000000400000-0x00000000004EF000-memory.dmp

                                                                  Filesize

                                                                  956KB

                                                                  Download

                                                                • memory/3780-271-0x000001F79B440000-0x000001F79B468000-memory.dmp

                                                                  Filesize

                                                                  160KB

                                                                  Download

                                                                • memory/3780-274-0x00007FF8F7E60000-0x00007FF8F8921000-memory.dmp

                                                                  Filesize

                                                                  10.8MB

                                                                  Download

                                                                • memory/3780-273-0x000001F7B76C0000-0x000001F7B770A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/3780-272-0x000001F7B6AB0000-0x000001F7B6B24000-memory.dmp

                                                                  Filesize

                                                                  464KB

                                                                  Download

                                                                • memory/3780-270-0x000001F79B090000-0x000001F79B0A0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/4180-279-0x00000000019E0000-0x00000000019F2000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/4180-277-0x0000000000FD0000-0x0000000001024000-memory.dmp

                                                                  Filesize

                                                                  336KB

                                                                  Download

                                                                • memory/4180-280-0x00000000059B0000-0x0000000005A00000-memory.dmp

                                                                  Filesize

                                                                  320KB

                                                                  Download

                                                                • memory/4520-261-0x0000000004110000-0x00000000045B6000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/4520-262-0x0000000007790000-0x00000000078B2000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/4832-300-0x0000000006B00000-0x0000000006B3C000-memory.dmp

                                                                  Filesize

                                                                  240KB

                                                                  Download

                                                                • memory/4832-295-0x0000000005410000-0x000000000541A000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/4832-385-0x00000000074D0000-0x0000000007976000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/4832-287-0x0000000005200000-0x0000000005222000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/4832-301-0x0000000006F50000-0x0000000006F5C000-memory.dmp

                                                                  Filesize

                                                                  48KB

                                                                  Download

                                                                • memory/4832-297-0x0000000005480000-0x000000000548E000-memory.dmp

                                                                  Filesize

                                                                  56KB

                                                                  Download

                                                                • memory/4832-299-0x0000000005610000-0x0000000005674000-memory.dmp

                                                                  Filesize

                                                                  400KB

                                                                  Download

                                                                • memory/4832-290-0x0000000005380000-0x0000000005388000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/4832-293-0x0000000005500000-0x0000000005598000-memory.dmp

                                                                  Filesize

                                                                  608KB

                                                                  Download

                                                                • memory/5012-255-0x00000000006B0000-0x00000000006DE000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/5024-338-0x0000000000400000-0x00000000004E1000-memory.dmp

                                                                  Filesize

                                                                  900KB

                                                                  Download