953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

Analysis

max time kernel
152s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe
Size

96KB
MD5

bc9da4452d562769d5ba2a1296edb350
SHA1

4cbf990b4ac00878c6001b21ea18f220ce421bfd
SHA256

953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0
SHA512

68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703
SSDEEP

3072:s4ns04C+GPL2P5mpBWrmBEy9oUzxF6mlvY34Us8:sHOD2UGeEyZzxF6mig

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 42 IoCs

pid	Process
520	avgvagui.exe
1736	avgvagui.exe
1072	avgvema.exe
1984	avgvema.exe
1528	avgvup.exe
1588	avgvup.exe
1560	avgvschd.exe
1496	avgvschd.exe
1124	avgvema.exe
1612	avgvema.exe
1592	avgvrak.exe
592	avgvrak.exe
1812	avgvrak.exe
1980	avgvrak.exe
912	avgvamsv.exe
892	avgvamsv.exe
1296	avgvagui.exe
940	avgvagui.exe
936	asvsv.exe
956	asvsv.exe
1548	avgvupsv.exe
1812	avgvupsv.exe
964	avgvagui.exe
768	avgvagui.exe
616	asvupsa.exe
928	asvupsa.exe
1716	avgvagui.exe
900	avgvagui.exe
268	asvupsa.exe
968	asvupsa.exe
1540	avgvrak.exe
1544	avgvrak.exe
936	asdvsp.exe
2028	asdvsp.exe
1220	avgvamsv.exe
1776	avgvamsv.exe
1772	avgvwdsr.exe
1092	avgvwdsr.exe
1576	avgvnt.exe
1140	avgvnt.exe
1176	avgvamsv.exe
1668	avgvamsv.exe

Sets file execution options in registry 2 TTPs 42 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvagui.exe"	avgvamsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvupsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	asvupsa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvamsv.exe"	asdvsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvrak.exe"	asvupsa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvagui.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvema.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvschd.exe"	avgvup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvema.exe"	avgvschd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	asvsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvagui.exe"	avgvupsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvagui.exe"	asvupsa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvwdsr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvagui.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "asvupsa.exe"	avgvagui.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	asvupsa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvrak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	asdvsp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvamsv.exe"	avgvnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvagui.exe"	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvrak.exe"	avgvema.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvrak.exe"	avgvrak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvema.exe"	avgvagui.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvup.exe"	avgvema.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvamsv.exe"	avgvrak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvamsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvagui.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvamsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvema.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvnt.exe"	avgvwdsr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvschd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvrak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvupsv.exe"	asvsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "asdvsp.exe"	avgvrak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvrak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "asvsv.exe"	avgvagui.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvagui.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "asvupsa.exe"	avgvagui.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvwdsr.exe"	avgvamsv.exe

Deletes itself 1 IoCs

pid	Process
1012	cmd.exe

Loads dropped DLL 64 IoCs

pid	Process
1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe
520	avgvagui.exe
520	avgvagui.exe
520	avgvagui.exe
520	avgvagui.exe
1736	avgvagui.exe
1736	avgvagui.exe
1736	avgvagui.exe
1736	avgvagui.exe
1072	avgvema.exe
1072	avgvema.exe
1072	avgvema.exe
1072	avgvema.exe
1984	avgvema.exe
1984	avgvema.exe
1984	avgvema.exe
1984	avgvema.exe
1528	avgvup.exe
1528	avgvup.exe
1528	avgvup.exe
1528	avgvup.exe
1588	avgvup.exe
1588	avgvup.exe
1588	avgvup.exe
1588	avgvup.exe
1560	avgvschd.exe
1560	avgvschd.exe
1560	avgvschd.exe
1560	avgvschd.exe
1496	avgvschd.exe
1496	avgvschd.exe
1496	avgvschd.exe
1496	avgvschd.exe
1124	avgvema.exe
1124	avgvema.exe
1124	avgvema.exe
1124	avgvema.exe
1612	avgvema.exe
1612	avgvema.exe
1612	avgvema.exe
1612	avgvema.exe
1592	avgvrak.exe
1592	avgvrak.exe
1592	avgvrak.exe
1592	avgvrak.exe
592	avgvrak.exe
592	avgvrak.exe
592	avgvrak.exe
592	avgvrak.exe
1812	avgvrak.exe
1812	avgvrak.exe
1812	avgvrak.exe
1812	avgvrak.exe
1980	avgvrak.exe
1980	avgvrak.exe
1980	avgvrak.exe
1980	avgvrak.exe
912	avgvamsv.exe
912	avgvamsv.exe
912	avgvamsv.exe
912	avgvamsv.exe
892	avgvamsv.exe
892	avgvamsv.exe
892	avgvamsv.exe

Adds Run key to start application 2 TTPs 42 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvagui.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	asvupsa.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvagui.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	asvupsa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvrak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvamsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvagui.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvagui.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvrak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvamsv.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	asdvsp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	asvsv.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvwdsr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvrak.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvamsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvrak.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	asvsv.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvagui.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvema.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvrak.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvema.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvschd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvagui.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvupsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvupsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	asvupsa.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvamsv.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvagui.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvema.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvagui.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	asvupsa.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvrak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	asdvsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvwdsr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvema.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvschd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avgvnt.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\avgvamsv.exe	avgvrak.exe
File opened for modification	C:\Windows\SysWOW64\avgvagui.exe	avgvamsv.exe
File created	C:\Windows\SysWOW64\avgvupsv.exe	asvsv.exe
File opened for modification	C:\Windows\SysWOW64\avgvagui.exe	avgvupsv.exe
File opened for modification	C:\Windows\SysWOW64\asdvsp.exe	avgvrak.exe
File opened for modification	C:\Windows\SysWOW64\avgvschd.exe	avgvup.exe
File created	C:\Windows\SysWOW64\avgvema.exe	avgvschd.exe
File created	C:\Windows\SysWOW64\avgvagui.exe	asvupsa.exe
File opened for modification	C:\Windows\SysWOW64\avgvamsv.exe	asdvsp.exe
File opened for modification	C:\Windows\SysWOW64\avgvwdsr.exe	avgvamsv.exe
File opened for modification	C:\Windows\SysWOW64\avgvup.exe	avgvema.exe
File created	C:\Windows\SysWOW64\avgvrak.exe	avgvrak.exe
File opened for modification	C:\Windows\SysWOW64\asvupsa.exe	avgvagui.exe
File created	C:\Windows\SysWOW64\avgvrak.exe	asvupsa.exe
File opened for modification	C:\Windows\SysWOW64\avgvrak.exe	asvupsa.exe
File opened for modification	C:\Windows\SysWOW64\avgvrak.exe	avgvrak.exe
File opened for modification	C:\Windows\SysWOW64\asvupsa.exe	avgvagui.exe
File created	C:\Windows\SysWOW64\avgvagui.exe	avgvamsv.exe
File created	C:\Windows\SysWOW64\asvupsa.exe	avgvagui.exe
File opened for modification	C:\Windows\SysWOW64\avgvagui.exe	asvupsa.exe
File created	C:\Windows\SysWOW64\avgvschd.exe	avgvup.exe
File created	C:\Windows\SysWOW64\avgvrak.exe	avgvema.exe
File opened for modification	C:\Windows\SysWOW64\avgvrak.exe	avgvema.exe
File created	C:\Windows\SysWOW64\avgvwdsr.exe	avgvamsv.exe
File created	C:\Windows\SysWOW64\avgvagui.exe	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe
File opened for modification	C:\Windows\SysWOW64\avgvagui.exe	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe
File opened for modification	C:\Windows\SysWOW64\avgvamsv.exe	avgvrak.exe
File created	C:\Windows\SysWOW64\avgvamsv.exe	avgvnt.exe
File created	C:\Windows\SysWOW64\asvsv.exe	avgvagui.exe
File created	C:\Windows\SysWOW64\avgvagui.exe	avgvupsv.exe
File created	C:\Windows\SysWOW64\asvupsa.exe	avgvagui.exe
File opened for modification	C:\Windows\SysWOW64\avgvnt.exe	avgvwdsr.exe
File created	C:\Windows\SysWOW64\avgvup.exe	avgvema.exe
File opened for modification	C:\Windows\SysWOW64\avgvema.exe	avgvschd.exe
File opened for modification	C:\Windows\SysWOW64\asvsv.exe	avgvagui.exe
File opened for modification	C:\Windows\SysWOW64\avgvupsv.exe	asvsv.exe
File created	C:\Windows\SysWOW64\asdvsp.exe	avgvrak.exe
File created	C:\Windows\SysWOW64\avgvamsv.exe	asdvsp.exe
File created	C:\Windows\SysWOW64\avgvnt.exe	avgvwdsr.exe
File opened for modification	C:\Windows\SysWOW64\avgvamsv.exe	avgvnt.exe
File created	C:\Windows\SysWOW64\avgvema.exe	avgvagui.exe
File opened for modification	C:\Windows\SysWOW64\avgvema.exe	avgvagui.exe

Suspicious use of SetThreadContext 22 IoCs

description	pid	Process	procid_target
PID 1216 set thread context of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 520 set thread context of 1736	520	avgvagui.exe	30
PID 1072 set thread context of 1984	1072	avgvema.exe	34
PID 1528 set thread context of 1588	1528	avgvup.exe	36
PID 1560 set thread context of 1496	1560	avgvschd.exe	42
PID 1124 set thread context of 1612	1124	avgvema.exe	46
PID 1592 set thread context of 592	1592	avgvrak.exe	50
PID 1812 set thread context of 1980	1812	avgvrak.exe	54
PID 912 set thread context of 892	912	avgvamsv.exe	58
PID 1296 set thread context of 940	1296	avgvagui.exe	62
PID 936 set thread context of 956	936	asvsv.exe	66
PID 1548 set thread context of 1812	1548	avgvupsv.exe	70
PID 964 set thread context of 768	964	avgvagui.exe	72
PID 616 set thread context of 928	616	asvupsa.exe	77
PID 1716 set thread context of 900	1716	avgvagui.exe	82
PID 268 set thread context of 968	268	asvupsa.exe	85
PID 1540 set thread context of 1544	1540	avgvrak.exe	90
PID 936 set thread context of 2028	936	asdvsp.exe	94
PID 1220 set thread context of 1776	1220	avgvamsv.exe	97
PID 1772 set thread context of 1092	1772	avgvwdsr.exe	102
PID 1576 set thread context of 1140	1576	avgvnt.exe	106
PID 1176 set thread context of 1668	1176	avgvamsv.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe
Token: SeIncBasePriorityPrivilege	1736	avgvagui.exe
Token: SeIncBasePriorityPrivilege	1984	avgvema.exe
Token: SeIncBasePriorityPrivilege	1588	avgvup.exe
Token: SeIncBasePriorityPrivilege	1496	avgvschd.exe
Token: SeIncBasePriorityPrivilege	1612	avgvema.exe
Token: SeIncBasePriorityPrivilege	592	avgvrak.exe
Token: SeIncBasePriorityPrivilege	1980	avgvrak.exe
Token: SeIncBasePriorityPrivilege	892	avgvamsv.exe
Token: SeIncBasePriorityPrivilege	940	avgvagui.exe
Token: SeIncBasePriorityPrivilege	956	asvsv.exe
Token: SeIncBasePriorityPrivilege	1812	avgvupsv.exe
Token: SeIncBasePriorityPrivilege	768	avgvagui.exe
Token: SeIncBasePriorityPrivilege	928	asvupsa.exe
Token: SeIncBasePriorityPrivilege	900	avgvagui.exe
Token: SeIncBasePriorityPrivilege	968	asvupsa.exe
Token: SeIncBasePriorityPrivilege	1544	avgvrak.exe
Token: SeIncBasePriorityPrivilege	2028	asdvsp.exe
Token: SeIncBasePriorityPrivilege	1776	avgvamsv.exe
Token: SeIncBasePriorityPrivilege	1092	avgvwdsr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1216 wrote to memory of 1344	1216	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	28
PID 1344 wrote to memory of 520	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	29
PID 1344 wrote to memory of 520	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	29
PID 1344 wrote to memory of 520	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	29
PID 1344 wrote to memory of 520	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	29
PID 1344 wrote to memory of 520	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	29
PID 1344 wrote to memory of 520	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	29
PID 1344 wrote to memory of 520	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	29
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 520 wrote to memory of 1736	520	avgvagui.exe	30
PID 1344 wrote to memory of 1012	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	31
PID 1344 wrote to memory of 1012	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	31
PID 1344 wrote to memory of 1012	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	31
PID 1344 wrote to memory of 1012	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	31
PID 1344 wrote to memory of 1012	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	31
PID 1344 wrote to memory of 1012	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	31
PID 1344 wrote to memory of 1012	1344	953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe	31
PID 1736 wrote to memory of 1072	1736	avgvagui.exe	33
PID 1736 wrote to memory of 1072	1736	avgvagui.exe	33
PID 1736 wrote to memory of 1072	1736	avgvagui.exe	33
PID 1736 wrote to memory of 1072	1736	avgvagui.exe	33
PID 1736 wrote to memory of 1072	1736	avgvagui.exe	33
PID 1736 wrote to memory of 1072	1736	avgvagui.exe	33
PID 1736 wrote to memory of 1072	1736	avgvagui.exe	33
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1072 wrote to memory of 1984	1072	avgvema.exe	34
PID 1984 wrote to memory of 1528	1984	avgvema.exe	35
PID 1984 wrote to memory of 1528	1984	avgvema.exe	35
PID 1984 wrote to memory of 1528	1984	avgvema.exe	35
PID 1984 wrote to memory of 1528	1984	avgvema.exe	35
PID 1984 wrote to memory of 1528	1984	avgvema.exe	35
PID 1984 wrote to memory of 1528	1984	avgvema.exe	35
PID 1984 wrote to memory of 1528	1984	avgvema.exe	35

C:\Users\Admin\AppData\Local\Temp\953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe
"C:\Users\Admin\AppData\Local\Temp\953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe
  "C:\Users\Admin\AppData\Local\Temp\953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0.exe"
  2⤵
  - Sets file execution options in registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\avgvagui.exe
    "C:\Windows\system32\avgvagui.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\Windows\SysWOW64\avgvagui.exe
      4⤵
      Executes dropped EXE
      Sets file execution options in registry
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\Windows\SysWOW64\avgvema.exe
        
        "C:\Windows\system32\avgvema.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1072
      - C:\Windows\SysWOW64\avgvema.exe
        
        6⤵
        Executes dropped EXE
        Sets file execution options in registry
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\avgvup.exe
        
        "C:\Windows\system32\avgvup.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1528
        
        C:\Windows\SysWOW64\avgvup.exe
        
        8⤵
        Executes dropped EXE
        Sets file execution options in registry
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
        
        C:\Windows\SysWOW64\avgvschd.exe
        
        "C:\Windows\system32\avgvschd.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1560
        
        C:\Windows\SysWOW64\avgvschd.exe
        
        10⤵
        Executes dropped EXE
        Sets file execution options in registry
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
        
        C:\Windows\SysWOW64\avgvema.exe
        
        "C:\Windows\system32\avgvema.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1124
        
        C:\Windows\SysWOW64\avgvema.exe
        
        12⤵
        Executes dropped EXE
        Sets file execution options in registry
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1612
        
        C:\Windows\SysWOW64\avgvrak.exe
        
        "C:\Windows\system32\avgvrak.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1592
        
        C:\Windows\SysWOW64\avgvrak.exe
        
        14⤵
        Executes dropped EXE
        Sets file execution options in registry
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
        
        C:\Windows\SysWOW64\avgvrak.exe
        
        "C:\Windows\system32\avgvrak.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1812
        
        C:\Windows\SysWOW64\avgvrak.exe
        
        16⤵
        Executes dropped EXE
        Sets file execution options in registry
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
        
        C:\Windows\SysWOW64\avgvamsv.exe
        
        "C:\Windows\system32\avgvamsv.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:912
        
        C:\Windows\SysWOW64\avgvamsv.exe
        
        18⤵
        Executes dropped EXE
        Sets file execution options in registry
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
        
        C:\Windows\SysWOW64\avgvagui.exe
        
        "C:\Windows\system32\avgvagui.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1296
        
        C:\Windows\SysWOW64\avgvagui.exe
        
        20⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:940
        
        C:\Windows\SysWOW64\asvsv.exe
        
        "C:\Windows\system32\asvsv.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:936
        
        C:\Windows\SysWOW64\asvsv.exe
        
        22⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:956
        
        C:\Windows\SysWOW64\avgvupsv.exe
        
        "C:\Windows\system32\avgvupsv.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1548
        
        C:\Windows\SysWOW64\avgvupsv.exe
        
        24⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
        
        C:\Windows\SysWOW64\avgvagui.exe
        
        "C:\Windows\system32\avgvagui.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:964
        
        C:\Windows\SysWOW64\avgvagui.exe
        
        26⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:768
        
        C:\Windows\SysWOW64\asvupsa.exe
        
        "C:\Windows\system32\asvupsa.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:616
        
        C:\Windows\SysWOW64\asvupsa.exe
        
        28⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:928
        
        C:\Windows\SysWOW64\avgvagui.exe
        
        "C:\Windows\system32\avgvagui.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1716
        
        C:\Windows\SysWOW64\avgvagui.exe
        
        30⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
        
        C:\Windows\SysWOW64\asvupsa.exe
        
        "C:\Windows\system32\asvupsa.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:268
        
        C:\Windows\SysWOW64\asvupsa.exe
        
        32⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
        
        C:\Windows\SysWOW64\avgvrak.exe
        
        "C:\Windows\system32\avgvrak.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1540
        
        C:\Windows\SysWOW64\avgvrak.exe
        
        34⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
        
        C:\Windows\SysWOW64\asdvsp.exe
        
        "C:\Windows\system32\asdvsp.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:936
        
        C:\Windows\SysWOW64\asdvsp.exe
        
        36⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
        
        C:\Windows\SysWOW64\avgvamsv.exe
        
        "C:\Windows\system32\avgvamsv.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1220
        
        C:\Windows\SysWOW64\avgvamsv.exe
        
        38⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
        
        C:\Windows\SysWOW64\avgvwdsr.exe
        
        "C:\Windows\system32\avgvwdsr.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1772
        
        C:\Windows\SysWOW64\avgvwdsr.exe
        
        40⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1092
        
        C:\Windows\SysWOW64\avgvnt.exe
        
        "C:\Windows\system32\avgvnt.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1576
        
        C:\Windows\SysWOW64\avgvnt.exe
        
        42⤵
        Executes dropped EXE
        Sets file execution options in registry
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1140
        
        C:\Windows\SysWOW64\avgvamsv.exe
        
        "C:\Windows\system32\avgvamsv.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1176
        
        C:\Windows\SysWOW64\avgvamsv.exe
        
        44⤵
        Executes dropped EXE
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvwdsr.exe > nul
        41⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvamsv.exe > nul
        39⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\asdvsp.exe > nul
        37⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvrak.exe > nul
        35⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\asvupsa.exe > nul
        33⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvagui.exe > nul
        31⤵
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\asvupsa.exe > nul
        29⤵
        
        PID:596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvagui.exe > nul
        27⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvupsv.exe > nul
        25⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\asvsv.exe > nul
        23⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvagui.exe > nul
        21⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvamsv.exe > nul
        19⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvrak.exe > nul
        17⤵
        
        PID:676
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvrak.exe > nul
        15⤵
        
        PID:552
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvema.exe > nul
        13⤵
        
        PID:920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvschd.exe > nul
        11⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvup.exe > nul
        9⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvema.exe > nul
        7⤵
        
        PID:1672
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvagui.exe > nul
        5⤵
        
        PID:824
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\953F13~1.EXE > nul
    3⤵
    - Deletes itself
    PID:1012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\avgvagui.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvagui.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvagui.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvrak.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvrak.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvrak.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvschd.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvschd.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvschd.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvup.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvup.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
C:\Windows\SysWOW64\avgvup.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvagui.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvagui.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvagui.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvagui.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvagui.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvagui.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvagui.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvagui.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvema.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvrak.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvrak.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvrak.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvrak.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvrak.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvschd.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvschd.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvschd.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvschd.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvschd.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvschd.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvschd.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvschd.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvup.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvup.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvup.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvup.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvup.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvup.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvup.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
\Windows\SysWOW64\avgvup.exe

Filesize
96KB

MD5
bc9da4452d562769d5ba2a1296edb350

SHA1
4cbf990b4ac00878c6001b21ea18f220ce421bfd

SHA256
953f13daf2d284b56a0aacc29b9323eef7ce342424f9c89a184987e5290d48d0

SHA512
68952d4b7a74033b7ece22f77a3fb2875d96c95a3e80e26e6a6422a37ec244c6d8ce11be1e509754861d4b6d6b72cdf8f10edef70fb332038e45d6b2b45fc703

Download Submit
memory/268-381-0x0000000000000000-mapping.dmp

Download
memory/520-70-0x0000000000000000-mapping.dmp

Download
memory/552-258-0x0000000000000000-mapping.dmp

Download
memory/592-233-0x0000000000101EDE-mapping.dmp

Download
memory/596-383-0x0000000000000000-mapping.dmp

Download
memory/616-346-0x0000000000000000-mapping.dmp

Download
memory/676-276-0x0000000000000000-mapping.dmp

Download
memory/768-341-0x0000000000101EDE-mapping.dmp

Download
memory/824-133-0x0000000000000000-mapping.dmp

Download
memory/892-270-0x0000000000101EDE-mapping.dmp

Download
memory/900-377-0x0000000000101EDE-mapping.dmp

Download
memory/912-256-0x0000000000000000-mapping.dmp

Download
memory/920-240-0x0000000000000000-mapping.dmp

Download
memory/928-359-0x0000000000101EDE-mapping.dmp

Download
memory/936-292-0x0000000000000000-mapping.dmp

Download
memory/936-419-0x0000000000000000-mapping.dmp

Download
memory/940-288-0x0000000000101EDE-mapping.dmp

Download
memory/956-306-0x0000000000101EDE-mapping.dmp

Download
memory/964-401-0x0000000000000000-mapping.dmp

Download
memory/964-328-0x0000000000000000-mapping.dmp

Download
memory/968-394-0x0000000000101EDE-mapping.dmp

Download
memory/1012-96-0x0000000000000000-mapping.dmp

Download
memory/1072-99-0x0000000000000000-mapping.dmp

Download
memory/1092-467-0x0000000000101EDE-mapping.dmp

Download
memory/1124-185-0x0000000000000000-mapping.dmp

Download
memory/1140-484-0x0000000000101EDE-mapping.dmp

Download
memory/1176-489-0x0000000000000000-mapping.dmp

Download
memory/1216-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1220-435-0x0000000000000000-mapping.dmp

Download
memory/1296-274-0x0000000000000000-mapping.dmp

Download
memory/1296-191-0x0000000000000000-mapping.dmp

Download
memory/1344-56-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/1344-60-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/1344-65-0x0000000000101EDE-mapping.dmp

Download
memory/1344-68-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/1344-67-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/1344-63-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/1344-58-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/1344-55-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/1400-312-0x0000000000000000-mapping.dmp

Download
memory/1424-348-0x0000000000000000-mapping.dmp

Download
memory/1496-176-0x0000000000101EDE-mapping.dmp

Download
memory/1528-294-0x0000000000000000-mapping.dmp

Download
memory/1528-126-0x0000000000000000-mapping.dmp

Download
memory/1540-399-0x0000000000000000-mapping.dmp

Download
memory/1544-413-0x0000000000101EDE-mapping.dmp

Download
memory/1548-310-0x0000000000000000-mapping.dmp

Download
memory/1560-156-0x0000000000000000-mapping.dmp

Download
memory/1576-471-0x0000000000000000-mapping.dmp

Download
memory/1588-145-0x0000000000101EDE-mapping.dmp

Download
memory/1592-213-0x0000000000000000-mapping.dmp

Download
memory/1600-440-0x0000000000000000-mapping.dmp

Download
memory/1604-220-0x0000000000000000-mapping.dmp

Download
memory/1612-203-0x0000000000101EDE-mapping.dmp

Download
memory/1668-501-0x0000000000101EDE-mapping.dmp

Download
memory/1672-163-0x0000000000000000-mapping.dmp

Download
memory/1684-438-0x0000000000000000-mapping.dmp

Download
memory/1716-363-0x0000000000000000-mapping.dmp

Download
memory/1736-88-0x0000000000101EDE-mapping.dmp

Download
memory/1772-455-0x0000000000000000-mapping.dmp

Download
memory/1776-449-0x0000000000101EDE-mapping.dmp

Download
memory/1812-324-0x0000000000101EDE-mapping.dmp

Download
memory/1812-238-0x0000000000000000-mapping.dmp

Download
memory/1848-473-0x0000000000000000-mapping.dmp

Download
memory/1912-331-0x0000000000000000-mapping.dmp

Download
memory/1944-365-0x0000000000000000-mapping.dmp

Download
memory/1960-505-0x0000000000000000-mapping.dmp

Download
memory/1980-252-0x0000000000101EDE-mapping.dmp

Download
memory/1984-117-0x0000000000101EDE-mapping.dmp

Download
memory/2028-431-0x0000000000101EDE-mapping.dmp

Download
memory/2040-417-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads