060de87c45ceabc99e51135369b71048b9f15ca2c32dee32ed99dc3dadf01ab9

Analysis

max time kernel
145s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

avg_antivirus_free_setup.exe
Size

229KB
MD5

796ee1d354e110b802dff6873c9963a4
SHA1

4206d44bb07c3181030d498c34f924a4e07a8185
SHA256

060de87c45ceabc99e51135369b71048b9f15ca2c32dee32ed99dc3dadf01ab9
SHA512

208364bd6f95ee1ed5afd69ce2b9422350b40d87981c63b725d9532a44386019875889803b71ca8e90b51576f4565018d882326a71ed2c95916341140021e572
SSDEEP

3072:c2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCoKOhhWK0KL:c0KgGwHqwOOELha+sm2D2+UhngNQK4d

Score

6^/10

bootkit persistence

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avg_antivirus_free_setup_x64.exe

Downloads MZ/PE file

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup_x64.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe

Executes dropped EXE 9 IoCs

pid	Process
2644	avg_antivirus_free_setup_x64.exe
1184	Process not Found
1928	instup.exe
2968	instup.exe
3028	aswOfferTool.exe
1768	aswOfferTool.exe
2212	aswOfferTool.exe
1868	aswOfferTool.exe
2492	aswOfferTool.exe

Loads dropped DLL 31 IoCs

pid	Process
1736	avg_antivirus_free_setup.exe
1736	avg_antivirus_free_setup.exe
1184	Process not Found
2644	avg_antivirus_free_setup_x64.exe
2644	avg_antivirus_free_setup_x64.exe
2644	avg_antivirus_free_setup_x64.exe
2644	avg_antivirus_free_setup_x64.exe
2644	avg_antivirus_free_setup_x64.exe
2644	avg_antivirus_free_setup_x64.exe
2644	avg_antivirus_free_setup_x64.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
1928	instup.exe
2968	instup.exe
2212	aswOfferTool.exe
2492	aswOfferTool.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	avg_antivirus_free_setup_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avg_antivirus_free_setup_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "51"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "72"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "82"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "61"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "100"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "5"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "41"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "61"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "67"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "72"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: sbr_x64_ais"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: instup.exe"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "40"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "76"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "63"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "75"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "85"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "52"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "92"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "55"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: offertool_x64_ais-c62.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "74"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "100"	avg_antivirus_free_setup_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "100"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "20"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "56"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: avdump_x64_ais-c62.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "71"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "13"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "23"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "24"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "68"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "78"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "16"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "95"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "54"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "21"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "60"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "84"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "42"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "43"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "14"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "58"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "64"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "94"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "14"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "17"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "71"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "87"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "19"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "38"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "95"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "96"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "90"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "82"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: part-setup_ais-15020c62.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "22"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "44"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Main = "62"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "27"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "57"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "11"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "78"	instup.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	avg_antivirus_free_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	avg_antivirus_free_setup.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2644	avg_antivirus_free_setup_x64.exe
2968	instup.exe
2968	instup.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 32	2644	avg_antivirus_free_setup_x64.exe
Token: SeDebugPrivilege	1928	instup.exe
Token: 32	1928	instup.exe
Token: SeDebugPrivilege	2968	instup.exe
Token: 32	2968	instup.exe
Token: SeDebugPrivilege	1868	aswOfferTool.exe
Token: SeImpersonatePrivilege	1868	aswOfferTool.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1928	instup.exe
2968	instup.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2644	1736	avg_antivirus_free_setup.exe	28
PID 1736 wrote to memory of 2644	1736	avg_antivirus_free_setup.exe	28
PID 1736 wrote to memory of 2644	1736	avg_antivirus_free_setup.exe	28
PID 1736 wrote to memory of 2644	1736	avg_antivirus_free_setup.exe	28
PID 2644 wrote to memory of 1928	2644	avg_antivirus_free_setup_x64.exe	29
PID 2644 wrote to memory of 1928	2644	avg_antivirus_free_setup_x64.exe	29
PID 2644 wrote to memory of 1928	2644	avg_antivirus_free_setup_x64.exe	29
PID 1928 wrote to memory of 2968	1928	instup.exe	30
PID 1928 wrote to memory of 2968	1928	instup.exe	30
PID 1928 wrote to memory of 2968	1928	instup.exe	30
PID 2968 wrote to memory of 3028	2968	instup.exe	31
PID 2968 wrote to memory of 3028	2968	instup.exe	31
PID 2968 wrote to memory of 3028	2968	instup.exe	31
PID 2968 wrote to memory of 3028	2968	instup.exe	31
PID 2968 wrote to memory of 3028	2968	instup.exe	31
PID 2968 wrote to memory of 3028	2968	instup.exe	31
PID 2968 wrote to memory of 3028	2968	instup.exe	31
PID 2968 wrote to memory of 1768	2968	instup.exe	32
PID 2968 wrote to memory of 1768	2968	instup.exe	32
PID 2968 wrote to memory of 1768	2968	instup.exe	32
PID 2968 wrote to memory of 1768	2968	instup.exe	32
PID 2968 wrote to memory of 1768	2968	instup.exe	32
PID 2968 wrote to memory of 1768	2968	instup.exe	32
PID 2968 wrote to memory of 1768	2968	instup.exe	32
PID 2968 wrote to memory of 2212	2968	instup.exe	33
PID 2968 wrote to memory of 2212	2968	instup.exe	33
PID 2968 wrote to memory of 2212	2968	instup.exe	33
PID 2968 wrote to memory of 2212	2968	instup.exe	33
PID 2968 wrote to memory of 2212	2968	instup.exe	33
PID 2968 wrote to memory of 2212	2968	instup.exe	33
PID 2968 wrote to memory of 2212	2968	instup.exe	33
PID 2968 wrote to memory of 1868	2968	instup.exe	34
PID 2968 wrote to memory of 1868	2968	instup.exe	34
PID 2968 wrote to memory of 1868	2968	instup.exe	34
PID 2968 wrote to memory of 1868	2968	instup.exe	34
PID 2968 wrote to memory of 1868	2968	instup.exe	34
PID 2968 wrote to memory of 1868	2968	instup.exe	34
PID 2968 wrote to memory of 1868	2968	instup.exe	34

C:\Users\Admin\AppData\Local\Temp\avg_antivirus_free_setup.exe
"C:\Users\Admin\AppData\Local\Temp\avg_antivirus_free_setup.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\Temp\asw.28d75b043eb631c8\avg_antivirus_free_setup_x64.exe
  "C:\Windows\Temp\asw.28d75b043eb631c8\avg_antivirus_free_setup_x64.exe" /cookie:mmm_bav_998_999_000_m:dlid_FREEGSR-FAD /ga_clientid:05122a72-dbac-4c52-b773-f0e41cdf7f02 /edat_dir:C:\Windows\Temp\asw.28d75b043eb631c8
  2⤵
  - Checks for any installed AV software in registry
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\Temp\asw.401903642fcfc527\instup.exe
    "C:\Windows\Temp\asw.401903642fcfc527\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.401903642fcfc527 /edition:15 /prod:ais /stub_context:2508a98c-4b54-4f43-8dfa-c297365d09fd:10042744 /guid:6f6706f0-8c11-47e6-9dcb-84f7333c0be5 /ga_clientid:05122a72-dbac-4c52-b773-f0e41cdf7f02 /cookie:mmm_bav_998_999_000_m:dlid_FREEGSR-FAD /ga_clientid:05122a72-dbac-4c52-b773-f0e41cdf7f02 /edat_dir:C:\Windows\Temp\asw.28d75b043eb631c8
    3⤵
    - Checks for any installed AV software in registry
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\instup.exe
      "C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.401903642fcfc527 /edition:15 /prod:ais /stub_context:2508a98c-4b54-4f43-8dfa-c297365d09fd:10042744 /guid:6f6706f0-8c11-47e6-9dcb-84f7333c0be5 /ga_clientid:05122a72-dbac-4c52-b773-f0e41cdf7f02 /cookie:mmm_bav_998_999_000_m:dlid_FREEGSR-FAD /edat_dir:C:\Windows\Temp\asw.28d75b043eb631c8 /online_installer
      4⤵
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\aswOfferTool.exe" -checkGToolbar -elevated
        5⤵
        Executes dropped EXE
        
        PID:3028
    - - C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\aswOfferTool.exe" /check_secure_browser
        5⤵
        Executes dropped EXE
        
        PID:1768
    - - C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\aswOfferTool.exe" -checkChrome -elevated
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2212
    - - C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFA
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1868
      - C:\Users\Public\Documents\aswOfferTool.exe
        
        "C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFA
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\Setup.log

Filesize
27KB

MD5
2c88460fbe9a2aaf0b03900c299deb5f

SHA1
c75f034c8f5ed890add51b7f231c5e4642f65f49

SHA256
91224101cd1e801374192089828158f8c9e5b7e9fe5ab6435d08aa1d20e78c3c

SHA512
9a81f5a82df41a26f6b5eec3ee53598a877a1823a049137cc08623d5a4563f6335b8a740d9f18dd2477e1dcda528a77ee9509ab1ee8e1dc9ada28fad41a58454

Download Submit
C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\Setup.log

Filesize
1KB

MD5
cf79dea31bf3d100556efacdaf3960a7

SHA1
491c9fc5830a9810d4bb74459f9b1b16d4b7ae6d

SHA256
91b101efbf2b5fcf033eb9b8006ce84d1bbdc4baf3b950fb4c1dd5622309e521

SHA512
5b339dc89858904eac33f4cf1a35a62a25e04033134e2dfaa581d552a1f5a046b14c2b43054f08c310374b694aae700df7e4058b0e778499ca7d6180426c09df

Download Submit
C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\event_manager.log

Filesize
142B

MD5
6591b7ded4723e6e19abc343fd8981fe

SHA1
2dbd37a1885bd91631a160aa2379373b055b93f8

SHA256
3cc40ac4dbcfe513c88025198c5a156b53121a50eeec68c7b31ef4fb41563693

SHA512
6d9116c716979a0e085491660fd21af1169c73620c6e3796873c859f9563540271636e2f3b572cdd7901f9ce31a3944065a01c56d13b12d2563687efff4eecbf

Download Submit
C:\Windows\Temp\asw.28d75b043eb631c8\ecoo.edat

Filesize
38B

MD5
aaa8f0ca4acc800e63ec0cc3f9598380

SHA1
ba82445e4b1eae5bed00d6e5a78411b05700d88d

SHA256
9fa614083ebc934b52510cc41eb3246e1b0d199329ab1fd3aea08a5bce62bcdf

SHA512
cffec5401f95e8ddfd9edf6c2ea072114d3be913fd48f874938524046f08dea246823ce042fb9d452692c90c50a215c3dcaa19c02270d93534b6ff2da0d88dc0

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\HTMLayout.dll

Filesize
4.0MB

MD5
ac0c1a0c733887c4744fc5a22d14d17f

SHA1
2ed68fc4970b2f94a2deb5b30bfd7d53b8a76b29

SHA256
9489bdbd1009785756032d047f67976b4122800a565f5abc60fbbb92550db014

SHA512
d11e1bdca2a0e09859134f73735e94e28d8edd468e5956c3ee3aac553993eed37d1b7d70fba3129c9288cd24cfb0919959a9705091372e3c5aad6d7ea89dc6eb

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\Instup.dll

Filesize
18.2MB

MD5
145afe196a4112f88acb5a7965d0e1a5

SHA1
23a1a97116088efe5252375eb6da165139fb9a53

SHA256
5d67bc18cec66c1469271543698fe6cfcaad58854dcc1d06fac37bc6d3693041

SHA512
5caed6ca85a9187a93f7663b3224dd4a054ac4c95a137c4f5a2e2344bd6884f940a7620eaa84e540657894fc47fab9fccaa74ec899fb8a7506b27b2f955a9b56

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\asw0935c561ce33a55b.tmp

Filesize
3.8MB

MD5
0b830444a6ef848fb85bfbb173bb6076

SHA1
27964cc1673ddb68ca3da8018f0e13e9a141605e

SHA256
63f361195a989491b2c10499d626ab3306edc36fbcb21a9cd832c4c4c059bb8f

SHA512
31655204bfb16d1902bb70a603a47f6bf111c0f36962fea01e15193d72cc1fffcead1f1a7884d2929ceb77ac47c640ca8039a93b4648747496d462ffe6a05e65

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\asw0a82765806298b98.tmp

Filesize
4.5MB

MD5
bbb61ad0f20d3fe17a5227c13f09e82d

SHA1
01700413fc5470aa0ba29aa1a962d7a719a92a82

SHA256
39154701a5a844eacf6aa1ccc70297c66bda6e27450fd1043778cead49da859e

SHA512
c614246263664268970562908c63e933ddda0a7f1c2f06b63eab9a06a2d8253356636cac948f709c37e66929d5d8b57663bf5f0d34fcf591ac7461c2af5b63e4

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\asw13ed584839421c7c.tmp

Filesize
19.1MB

MD5
917a284494cbe4a4ec85e1ec768339c9

SHA1
47ccc0a04ecc7c3c1ff79bf42d424cfda356137c

SHA256
57cb03fbc4750eefba0079c3fcdfc1b077e4347e0438f41e13b8614e7f11b772

SHA512
90849e580c9da697689c664b126ed97b085bd2fd6016ac9193afd7a7ac625c76db84c9bf55a4bd0308da889a16b27832383738de5ecbec7e97bbd5b7962999d8

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\asw2f6e57fee3ef716b.tmp

Filesize
831KB

MD5
ce4d45d0b684f591d5a83fdbd99bd306

SHA1
e89637b905c37033950afadaca2161bd5b09fb5e

SHA256
907e054fef8297e3cd31d083299ff0ac495775eaa928e3e10e7000fdf6baaed7

SHA512
af0aefc20b9c9c91f63f34fcd70c27e9e304073d51cc9ec45113ab360dd5ba4ad104b5c752e022b8b153f435527b56f6bfbb6022dd4bca98f8d1778e2bfc97d1

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\asw5bea451d5e4517da.tmp

Filesize
907KB

MD5
43dc9e69f1e9db4059cf49a5e825cfda

SHA1
519298f8a681b41d2d70db2670cc7543f1ee6da4

SHA256
98efeee831a7984d94cf13800aeb1de68e79bea0bb5d95ff7adcbb43b648ed4d

SHA512
d0c07cb1e251f2135fdb21893e6ca70efc019a8b759274c87266fb5a2c48ebc0126aecee0020bd48cfd65ef2f794b81b1e417000c91db18e2ac128c86eac4079

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\asw6734a11850832d32.tmp

Filesize
3.1MB

MD5
c545527e69a46359a4a45f58794a0fe5

SHA1
e233e5837bfe5d1429300fb33f12f5b54689781b

SHA256
8d86976b5ecd432772d4ac5965ff86bff6da04318f231b3e7ea64818de6211f9

SHA512
754c891b4f582948ba5dd776a87edba35f96453a540c20c5dd78f2d816bc83161e0d3f8a0f6052b5d0835f5a0b4eeb6d7a871aa611bd74e61ca25ea7046837e0

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\New_15020c62\asw691ef04e75861bcd.tmp

Filesize
15KB

MD5
e38cc92cd980a55d811316ac62883e14

SHA1
fa83737abe11ee825c3da6843cc4d8e3b459729a

SHA256
be4d8a5dc335ca8446c0dbba4ee4ef07553a5c242bed560f11aaef4793855e87

SHA512
1422c8f94556ff0409a3cd1ff581f6c4ea56b01be36ba5b2c0e72465f4dad38391eb85bae28b079aa2f1204615d32a17b7e73e92ffcc9964f39c79626b7afe16

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\aswfbd676a865a9d3fc.ini

Filesize
565B

MD5
21a19ac53fa60c5bd24edcf81209dbe3

SHA1
64b8d72fa8e64a5bbc94aea8a7a4c39f3d21b2d1

SHA256
514d71fcb9d184d621f91ba655c02724cb9c67293ef512a71d78a7c2958baedc

SHA512
19c77d53cc24892babae64bae93415daaa63dc49051ffe9c260cf4d3feaaf212852fd846851029b60a2d77b2318da073511d28e23ffaecbc1882053ce55c7d0a

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\config.def

Filesize
18KB

MD5
329966c8fb59c4bc69ba4c4ff0235c96

SHA1
f24ee4ccc5f4a3bf6db004cabaf6078496f30e44

SHA256
ca0cc7b840860f27f97863f4b479a642f59b0aeb14e308912723fc4706f31f23

SHA512
a5e7dcb140604c0f8e10729821e98271a06ad86dd6d1e3c011a432057b81150652b264a45617ecbb65b134d139502f21c91b7baab5ac2e03179d6828d3455f7b

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\config.def

Filesize
18KB

MD5
8701dd219bbc772cab7580017ef87321

SHA1
346ce77883b9062ce299f737ad8748e03fba605b

SHA256
e93c61114c7347733f82c3629e81d9572790d49cfb7516a6399eb7670edfe80b

SHA512
9a1f79e743f78ee3c75479fcbce15fa58699af94b7cabf66675877f7faf3f6426d9ac1c7ae464985de38860e8d1479e18444e539e23852c9f1ef4764f396d7a7

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\config.def

Filesize
23KB

MD5
b2827601a0895186911a85aeff4461cb

SHA1
ac3bbcf2ee04de35e407f0d6308f547e85969041

SHA256
c69d20baafc2d62e3b85956b9a46d527f739fcd371d36c4595fe9a126923a936

SHA512
421aee458c5ea336106558cd5089dab63fc2f0721f7ba869c01c76abd506019d3d3a48e2e2cc173ee2b1cf05ed0ae141b93ad786fe7b98bbf9547b512c6ae98d

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\config.ini

Filesize
662B

MD5
c1b25dc5be5d2bd6e4f70e6b49e08722

SHA1
1de03b364cfc2c1120df75d1a53118fde187b24f

SHA256
4f1935aa259d73ffc52c571af1b6952bd398135087a9d66d375a713429708c87

SHA512
5e1b52f6c9dff310272db2ac2e959c92d31998302482050e98847bdb31e50d516af48aeaeea01ee9c1ce0a4b1b2aced26e10a9b0079e4d7c5f9e815d02528506

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\part-jrog2-68.vpx

Filesize
212B

MD5
148cac35cdc9813dfa4a3158ea06ff52

SHA1
d05e231516dc3f72e7d370696594cc77bd94b61c

SHA256
a1899b1f6e306c499921420849eef203430ecbea80192f5795e5a63b4d999125

SHA512
b36aad56ea3c4765080a7052ea6e4febe01924bc0273d000e1c444d0b4133b14e19be0eeb877c656b68bfe5fa84da4c2c3a14a63068bf7405d629a706918488f

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\part-prg_ais-15020c62.vpx

Filesize
175KB

MD5
29b9bfd25fabf42939e3a6877f9b3ece

SHA1
c30d865bc2d680311c68eb0bed0e356845f700f9

SHA256
ed586b6ceb3e9dcc7dd21dd7dc7addd89e71a2b90039fe15b751b367e402d475

SHA512
a22827a2f9bc3de3c6c0ed5a4e36c383b5f8d4989fc543aa1a4852034c84055925df7456c1f9466ff3923de81f9d58a6f12d8f24e782bb2e805b908ef814a90e

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\part-setup_ais-15020c62.vpx

Filesize
5KB

MD5
d5b798d8816b252e7d718195dfeb8a8c

SHA1
860c5807fd491aeeb12d661d8cf2ecca4ca1639b

SHA256
75176962c8691f84eb299a555d4c82796b53a12161f1e6616ec50cf97393b499

SHA512
16cd2e8f57c05ba2bae79de39867cc35178a6d99cd035d7d20efd8788076360a408affa9b6caf3ea09daf5c32834b995e47b1ab4ec29fcc1fdfddcf0ba96cce5

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\part-vps_windows-24052599.vpx

Filesize
7KB

MD5
ca58b4d552d00a0784f0e7755616f759

SHA1
d0f92545ba40a816900f69310e4679aa225a1b8d

SHA256
304b5a895b70b6f47556c9aadd7022ee08b38575a059ab745bd182fd184e6d5a

SHA512
950d8e310ccb0d4e39ad9a2298ea19414613d3dc78d31f6267f4f7afd269b7ce05e6f17128f86dc767dbf68d61217eaddc57c49410ba728be1d835aba7e24cd8

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\prod-pgm.vpx

Filesize
572B

MD5
718b9df691b86269bbeaaa755dcbea71

SHA1
340ca5c4f3ea045df917095608f4153befb4a4bd

SHA256
a915dcc4615dc978dc9ccd9d89b35717751bdef8ecd7fd6b750fa7e0f377bf5c

SHA512
ccbbac0db57e2f3a98cd122f2181c1cc9d289dc12afab9b69c76d02bbe92bb1fee25ebbfa19b9026369b5d0be18c4488ea17b48c94c53f6f036f46789d87249b

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\prod-vps.vpx

Filesize
343B

MD5
6904bbfa395ec2222d756a5e8d6fd068

SHA1
7384f58dcabc9a9cab6e2f5a77873fabddf795a2

SHA256
540f6473930df7e815701cbdb575e26c7a38fa8db345c3ca714671dcad01ed1e

SHA512
c7221b2a9fd1993d1a6436a63fde656830b511ef361ace989b66a49a7bf8685a4f3deb5eaac428c1732502ed4c73c5f1e82d50474cb54db93fa8c41232177976

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\prod-vps.vpx

Filesize
340B

MD5
2b479d00ab4887534259158ce93e0b93

SHA1
9a38ec797b9d1dd9bd2f3cb5ddb2a6ba1ce820d0

SHA256
2f6a29f186bd409cb0d765369baf5d478ac27faf28dfaa9cdf501296a8c2cdbb

SHA512
c85cb642030c326ec871795f767175fa0f79115a543892804d5d5837e32fb65d42d3349da39f81329b794a0edb6cbce7eeda3eedbd89e6b0d635b661dc80235f

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\servers.def

Filesize
27KB

MD5
dc9bf0c453a6711dca0192e10e256716

SHA1
6a5298059286b9cb31ff625b9d1f3742bec1df8c

SHA256
2b4c0f6f217a8b5239c130ea75fb2119b16c435c1bda62da33b49a1edf6cc8da

SHA512
22ad3bf3be9dc90863808380fed2d1e31df19842bd93796dbc9bf4a4d4855465964945451890f22f9d0187050cbb305df14b9ef361f5452141978707a00e7218

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\servers.def.vpx

Filesize
1KB

MD5
2df0afe29f09b1904b48e0bf66c15646

SHA1
fef3cadd4c307884d8d7de1234ac93aa825db06a

SHA256
5efcbe825750ddacd5d3cb6ad48c0d7fbb6008d0c22add33eb9c60554f3b66e4

SHA512
0dee6385fe3d825d77ac4035f26febdda7bf4a65f2242459073e07ed3411f7de8524ce606994772dfdf396b402fc833b474915d2d460a2501a5f27b918ab11ac

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\setup.def

Filesize
37KB

MD5
3fc9d055795a4c01893e5661f300c513

SHA1
29c64165afecea436a2dcb57dd5b54163a002df4

SHA256
425eb69377f5ab3508bca26402d48377ab0362840ef0c77852236f45efc597e0

SHA512
e1622c0390a66dba328f5c699b10b32c66aec8a20474a6b5d49c2e0faf3a9997620db0f2162d6763976d70159e53363e9217d372cb19f982241f66ec8761c902

Download Submit
C:\Windows\Temp\asw.401903642fcfc527\uat64.vpx

Filesize
16KB

MD5
e0cd7b9c9d603fe65a7920e07b171237

SHA1
9308f810b664eafd810f3d58fbcbf867004ebfe3

SHA256
52bcaf5399965a26765aa0b1c597649c265a49a80f891a2d62e111a007b7d52c

SHA512
98dbfee8a7ae35165b8138bff0e857e0011f14963c02c2963703be3f1e45b8cdcff42f9397f89dab9c1443aa97e2a6ee418d60892cad9e2e7d2f7d71ca0471ce

Download Submit
\Windows\Temp\asw.28d75b043eb631c8\avg_antivirus_free_setup_x64.exe

Filesize
9.6MB

MD5
5cacb3856cd146894444d49a4273f09b

SHA1
ed172dd3f4151752cd75de4cfcdae194b78a9630

SHA256
498b992280fcddeb6aa3fbf8fd1069664af94c7d64483782b40d0bd63d3e3b9a

SHA512
8ab0bd49c41cc978a579b682bde09b3e6602fe00b534e6f97c9f924e8b5c903572a4168187899bd69882aabaea4cee71742d985dfd9bbf5da8f4aa6c06d0fd97

Download Submit
\Windows\Temp\asw.401903642fcfc527\Instup.exe

Filesize
3.7MB

MD5
4d0396f9a5a80d5adb4bf1910d088905

SHA1
e946cd46ddd9451ac804aa6ecf8ef1d8e58bd851

SHA256
947f0bf77177419dd6d3c266042ee3d08702e79f3c797a20405722abdd73193e

SHA512
b988d687bb99718c4256a20f3ccae17c4bd88690c6003c6dc9700cab5b7c700c88e918cedb55c79215c9fcd9591c5add73e057a9c1c5efe558e02dae0ef32c12

Download Submit
\Windows\Temp\asw.401903642fcfc527\New_15020c62\gcapi_17167877272212.dll

Filesize
348KB

MD5
2973af8515effd0a3bfc7a43b03b3fcc

SHA1
4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

SHA256
d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

SHA512
b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

Download Submit
\Windows\Temp\asw.401903642fcfc527\uat64.dll

Filesize
29KB

MD5
378c94a0d4af38c28217e98e38d5c1f6

SHA1
acb2dbfb6477768ba1526d368542513aafc5e581

SHA256
24d8f567aef2b6cddae262aee4f0b04aa0ff695660c4c98aac15de403f100994

SHA512
9b0698ed4be62a5f4fb27a5995e128f90aadf3eeecbc4cd0eb1cf004c1681da009d0202618b4b25512dd4c2029e9019c7f35c4d42ab581edb2975f49990f9ccf

Download Submit
memory/2968-322-0x000007FEF31E0000-0x000007FEF35BA000-memory.dmp

Filesize
3.9MB

Download
memory/2968-321-0x000007FEF35C0000-0x000007FEF48E6000-memory.dmp

Filesize
19.1MB

Download
memory/2968-323-0x000007FEF35C0000-0x000007FEF48E6000-memory.dmp

Filesize
19.1MB

Download
memory/2968-333-0x000007FEF35C0000-0x000007FEF48E6000-memory.dmp

Filesize
19.1MB

Download
memory/2968-335-0x000007FEF35C0000-0x000007FEF48E6000-memory.dmp

Filesize
19.1MB

Download
memory/2968-340-0x000007FEF31E0000-0x000007FEF35BA000-memory.dmp

Filesize
3.9MB

Download
memory/2968-339-0x000007FEF35C0000-0x000007FEF48E6000-memory.dmp

Filesize
19.1MB

Download