f54422c6357b82ea13a41eac5b13ce7dc4a6afc0a016c380d2f4b59f88d36859

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f54422c6357b82ea13a41eac5b13ce7dc4a6afc0a016c380d2f4b59f88d36859.exe
Size 219KB
Sample240612-e61vbs1cpj
SHA256 f54422c6357b82ea13a41eac5b13ce7dc4a6afc0a016c380d2f4b59f88d36859
MD5 fab32d60d59b9c2f00afda8fc3ba764a
SHA1 337b6ef68053a13b0dc911886cfdcba60eb94872
SHA512 68fb158d063f14b264cf1220355ec9010e04ce95d2f52255d055497304ebdcf78665d5ed2da5a77de1f76cc0f9cd1b2ba855e01ec024bb46053a9ab8e05354b2
SSDEEP 3072:02RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCoKOhhZK0KZ:00KgGwHqwOOELha+sm2D2+UhngN7K4t+
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
4100	avg_antivirus_free_online_setup.exe
1680	icarus.exe
412	icarus_ui.exe
3392	icarus.exe
5080	icarus.exe
1904	aswOfferTool.exe
4504	aswOfferTool.exe
4768	aswOfferTool.exe

Loads dropped DLL 6 IoCs

pid	Process
1416	f54422c6357b82ea13a41eac5b13ce7dc4a6afc0a016c380d2f4b59f88d36859.exe
4100	avg_antivirus_free_online_setup.exe
3392	icarus.exe
5080	icarus.exe
4504	aswOfferTool.exe
4768	aswOfferTool.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	f54422c6357b82ea13a41eac5b13ce7dc4a6afc0a016c380d2f4b59f88d36859.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_online_setup.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus_ui.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "4988a6b6-95b5-4cd1-bb09-22d0794e9dcc"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "4DEC930631D6A523D3820D3CE1249367"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "4988a6b6-95b5-4cd1-bb09-22d0794e9dcc"	avg_antivirus_free_online_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "4988a6b6-95b5-4cd1-bb09-22d0794e9dcc"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	avg_antivirus_free_online_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "4DEC930631D6A523D3820D3CE1249367"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "4988a6b6-95b5-4cd1-bb09-22d0794e9dcc"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "4DEC930631D6A523D3820D3CE1249367"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "4DEC930631D6A523D3820D3CE1249367"	avg_antivirus_free_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAH1KRSj+TSkKMPfxJCSRivAQAAAACAAAAAAAQZgAAAAEAACAAAADdoHAySSGjQMCRarE6JwFHIFZTpawHMO3kyWuAn7FRIQAAAAAOgAAAAAIAACAAAAB3Mtfe3aKxT33311HTeOtbB+H079WYmNW3ew8UyMuDHTAAAADfWQeT3hEDs/LZYd0/HWLMBTdIcVGydxwiXC4JDNEA4cjhpoXrHdgoa37TvoVqG1ZAAAAAd/sVJaNyDG9/gCd2OITQTaQm3K9WJ8hExnLDcL7LBVDwbAsnSqOrLRHsxIgAD1n8dnmt/EzZ2YfWVFwOUkRGmA=="	avg_antivirus_free_online_setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
412	icarus_ui.exe
412	icarus_ui.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeRestorePrivilege	1680	icarus.exe
Token: SeTakeOwnershipPrivilege	1680	icarus.exe
Token: SeRestorePrivilege	1680	icarus.exe
Token: SeTakeOwnershipPrivilege	1680	icarus.exe
Token: SeRestorePrivilege	1680	icarus.exe
Token: SeTakeOwnershipPrivilege	1680	icarus.exe
Token: SeRestorePrivilege	1680	icarus.exe
Token: SeTakeOwnershipPrivilege	1680	icarus.exe
Token: SeDebugPrivilege	1680	icarus.exe
Token: SeDebugPrivilege	412	icarus_ui.exe
Token: SeRestorePrivilege	3392	icarus.exe
Token: SeTakeOwnershipPrivilege	3392	icarus.exe
Token: SeRestorePrivilege	3392	icarus.exe
Token: SeTakeOwnershipPrivilege	3392	icarus.exe
Token: SeRestorePrivilege	3392	icarus.exe
Token: SeTakeOwnershipPrivilege	3392	icarus.exe
Token: SeRestorePrivilege	3392	icarus.exe
Token: SeTakeOwnershipPrivilege	3392	icarus.exe
Token: SeDebugPrivilege	3392	icarus.exe
Token: SeDebugPrivilege	1904	aswOfferTool.exe
Token: SeImpersonatePrivilege	1904	aswOfferTool.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4100	avg_antivirus_free_online_setup.exe
412	icarus_ui.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
412	icarus_ui.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4100	1416	f54422c6357b82ea13a41eac5b13ce7dc4a6afc0a016c380d2f4b59f88d36859.exe	90
PID 1416 wrote to memory of 4100	1416	f54422c6357b82ea13a41eac5b13ce7dc4a6afc0a016c380d2f4b59f88d36859.exe	90
PID 1416 wrote to memory of 4100	1416	f54422c6357b82ea13a41eac5b13ce7dc4a6afc0a016c380d2f4b59f88d36859.exe	90
PID 4100 wrote to memory of 1680	4100	avg_antivirus_free_online_setup.exe	91
PID 4100 wrote to memory of 1680	4100	avg_antivirus_free_online_setup.exe	91
PID 1680 wrote to memory of 412	1680	icarus.exe	92
PID 1680 wrote to memory of 412	1680	icarus.exe	92
PID 1680 wrote to memory of 3392	1680	icarus.exe	95
PID 1680 wrote to memory of 3392	1680	icarus.exe	95
PID 1680 wrote to memory of 5080	1680	icarus.exe	96
PID 1680 wrote to memory of 5080	1680	icarus.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f54422c6357b82ea13a41eac5b13ce7dc4a6afc0a016c380d2f4b59f88d36859.exe
"C:\Users\Admin\AppData\Local\Temp\f54422c6357b82ea13a41eac5b13ce7dc4a6afc0a016c380d2f4b59f88d36859.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\Temp\asw.bb97d41b277901ba\avg_antivirus_free_online_setup.exe
  "C:\Windows\Temp\asw.bb97d41b277901ba\avg_antivirus_free_online_setup.exe" /cookie:mmm_bav_012_999_a7f_m:dlid_FREEGSR-GLOWEB-7453-PPC-BRAND-ICARUS /ga_clientid:cad6f5b6-b6a3-4419-86e8-54f450b3967f /edat_dir:C:\Windows\Temp\asw.bb97d41b277901ba
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\common\icarus.exe
    C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\icarus-info.xml /install /cookie:mmm_bav_012_999_a7f_m:dlid_FREEGSR-GLOWEB-7453-PPC-BRAND-ICARUS /edat_dir:C:\Windows\Temp\asw.bb97d41b277901ba /track-guid:cad6f5b6-b6a3-4419-86e8-54f450b3967f /sssid:4100
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\common\icarus_ui.exe
      C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\common\icarus_ui.exe /cookie:mmm_bav_012_999_a7f_m:dlid_FREEGSR-GLOWEB-7453-PPC-BRAND-ICARUS /edat_dir:C:\Windows\Temp\asw.bb97d41b277901ba /track-guid:cad6f5b6-b6a3-4419-86e8-54f450b3967f /sssid:4100 /er_master:master_ep_d9c71354-79e8-4a65-8ca9-22f72c7040da /er_ui:ui_ep_3c87adbb-ab97-4674-b300-39930e22993f
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:412
  - - C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av-vps\icarus.exe
      C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av-vps\icarus.exe /cookie:mmm_bav_012_999_a7f_m:dlid_FREEGSR-GLOWEB-7453-PPC-BRAND-ICARUS /edat_dir:C:\Windows\Temp\asw.bb97d41b277901ba /track-guid:cad6f5b6-b6a3-4419-86e8-54f450b3967f /sssid:4100 /er_master:master_ep_d9c71354-79e8-4a65-8ca9-22f72c7040da /er_ui:ui_ep_3c87adbb-ab97-4674-b300-39930e22993f /er_slave:avg-av-vps_slave_ep_a95f990a-c597-439b-b272-2364b24b5159 /slave:avg-av-vps
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Writes to the Master Boot Record (MBR)
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3392
  - - C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av\icarus.exe
      C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av\icarus.exe /cookie:mmm_bav_012_999_a7f_m:dlid_FREEGSR-GLOWEB-7453-PPC-BRAND-ICARUS /edat_dir:C:\Windows\Temp\asw.bb97d41b277901ba /track-guid:cad6f5b6-b6a3-4419-86e8-54f450b3967f /sssid:4100 /er_master:master_ep_d9c71354-79e8-4a65-8ca9-22f72c7040da /er_ui:ui_ep_3c87adbb-ab97-4674-b300-39930e22993f /er_slave:avg-av_slave_ep_3bb9ca8b-d8d1-4b61-9927-b77ee6399ad4 /slave:avg-av
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Modifies registry class
      PID:5080
    - - C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av\aswOfferTool.exe
        
        "C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904
      - C:\Users\Public\Documents\aswOfferTool.exe
        
        "C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFC
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4504
    - - C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av\aswOfferTool.exe
        
        "C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av\aswOfferTool.exe" -checkChrome -elevated
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4040,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

icarus.log

Path C:\ProgramData\AVG\Icarus\Logs\icarus.log
Size 63KB
SHA256 48ff7d00a22c1475d906baae565829930c524716bea0e2b31ffa970509b53807
MD5 cc1a76c6f5426ada51b58abc6afb5d59
SHA1 dee0268d2fe657f79eadd3be73a2abd0fd10f9f4
SHA512 345c7d8ae293227a6f5ebc976c29be8fcef600bd2ee8402601a9f9f8a4b1ac164c745040033ad3515d36c33e68c114092e375024b1fd7868df04243f500c6e7b
SSDEEP 768:xgegZfwdaLWOmVOC/vfooZ4bcATI0hdhewQLmvAn4wC+Wwn:xgegZfwdaCPwCPX0h5or
MD5 SHA1 SHA512 SSDEEP

Submit Download

sfx.log

Path C:\ProgramData\AVG\Icarus\Logs\sfx.log
Size 13KB
SHA256 511cc008cd473f7bb4caecf3dcc4c644045b326ceb4ca61ddd3839414583d921
MD5 7e38ba4f28742397be83fe886a193ee8
SHA1 46b40cd0e69a6a14fb62c9ee554612a80e076772
SHA512 e6789185c5630ee070ffcd0438681deb1feb19e9fbfb9cf0b303eb9feb1fc4b5f55afc0fb547d05ebb5d5583ea24393d1d161d77c574321dad76af85e6efa3d3
SSDEEP 384:xZWTnMs/pPT/EPyYr2r+rurakr2rerc9f:xUTM2pPTcaYK6q+kya49f
MD5 SHA1 SHA512 SSDEEP

Submit Download

sui.log

Path C:\ProgramData\AVG\Icarus\Logs\sui.log
Size 18KB
SHA256 5089203060ac330bcf81f3448edcc77af8b8cd6d8ba104d8497c32a4c8f1ccc8
MD5 a6d7bc7c96b91dc2c1ded258cb98fc90
SHA1 fb1705adc1d688b37bc0177128f9bbdfc6041bcd
SHA512 dff7b6ba1f319248a3db9b5dea0a7f6722ecf17e062b3cc810dc6726486c63e402af724adb65e05c6809c0b81e73697072fdd8c25d64c073690dac931b8627bb
SSDEEP 192:RaVh6kC8JwihJizbnnBh55BhaaBh4eBh2BmOvO7eCE0Oh3MhUBmB/hzhqhAUYhN9:yC9NAnvnMgTI5nfnsVnUn19mKLlsED
MD5 SHA1 SHA512 SSDEEP

Submit Download

proxy.ini

Path C:\ProgramData\AVG\Icarus\settings\proxy.ini
Size 278B
SHA256 8e511706c04e382e58153c274138e99a298e87e29e12548d39b7f3d3442878b9
MD5 b8853a8e6228549b5d3ad97752d173d4
SHA1 cd471a5d57e0946c19a694a6be8a3959cef30341
SHA512 cf4edd9ee238c1e621501f91a4c3338ec0cb07ca2c2df00aa7c44d3db7c4f3798bc4137c11c15379d0c71fab1c5c61f19be32ba3fc39dc242313d0947461a787
MD5 SHA1 SHA512

Submit Download

D566D7D7-DCD6-471C-8109-BE0AD33199E3

Path C:\Users\Admin\AppData\Local\Temp\D566D7D7-DCD6-471C-8109-BE0AD33199E3
Size 64B
SHA256 374d172fa5910a136fd3adba14744e6f740efc9dd62e34f870ea5698e349f60e
MD5 168f03c5c241049561d93853fa2304dc
SHA1 ee086aa5bc60436a75015003cb2dd27ae57620ff
SHA512 169897b850ad3fa154452c34b87813f31723914110bf41e711c614e18b9850d036a2083cf908286a406d45db1c4a51f3b320792672b3287cfca08e756b5ee179
MD5 SHA1 SHA512

Submit Download

F07D8C6A-04B6-4025-869C-70A788D7B5C0

Path C:\Users\Admin\AppData\Local\Temp\F07D8C6A-04B6-4025-869C-70A788D7B5C0
Size 72B
SHA256 23ff3119ec17538101a4f800cf3759d8cbe0a47e4da62df2ce66909d4f910760
MD5 72a06758a483233265d0ed05a37958f5
SHA1 b910988adfb8641011ffa7bf8c26c72e1e5c629a
SHA512 e4e0a9120dfa2bab59368c03cd22ce97a2e46e2c7241831abd62be5ed451487d671e066ce93a1c2f90a3a682557e100190693cc4a093a87bebe9609c4e729949
MD5 SHA1 SHA512

Submit Download

gcapi.dll

Path C:\Users\Public\Documents\gcapi.dll
Size 867KB
SHA256 e0d08b9da7e502ad8c75f8be52e9a08a6bcd0c5f98d360704173be33777e4905
MD5 3ead47f44293e18d66fb32259904197a
SHA1 e61e88bd81c05d4678aeb2d62c75dee35a25d16b
SHA512 927a134bdaec1c7c13d11e4044b30f7c45bbb23d5caf1756c2beada6507a69df0a2e6252ec28a913861e4924d1c766704f1036d7fc39c6ddb22e5eb81f3007f0
SSDEEP 24576:rvqA5tAf7fM6xEV1rnF6SZT0kiSJN5H9tmGn7sL0h:eAvAfAAEV1rnFTZT0krlGW+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.def

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av-vps\config.def
Size 583B
SHA256 a98977649c4c1e25f732e3023515cac1cf5d54df88d58c170dde6f895bc695fc
MD5 88b8bbca6adfb658e9f64786290b1508
SHA1 a7e19f0be671882e7c0de8d546482d20045139de
SHA512 b7329cac2951e04645771d207dc0c095fe81dfa17bd3df185f4da1e1cc4f726750a48921fd97345b6777638e212624d4f0d3824d39f363d9421bbbffd44f3968
MD5 SHA1 SHA512

Submit Download

dump_process.exe

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av-vps\dump_process.exe
Size 3.4MB
SHA256 c109510846192f6f93efb0955a784c302b07858c98a8548e861209b353a31e71
MD5 21d84898683d48daa44ed5a2f0f3591b
SHA1 d1a3d3755d2facb545e69578459f64bb7ddc736b
SHA512 5bb4a5e0039059f32ef77aa4d45a7661801f539fe341fd1ed667da5ca8b20dad6d5ca405260084f780af4b2ff8db93c3598f859fe9d5d88cbeeb7d9f6dd0d117
SSDEEP 49152:gHUoldieiqq2EwFNWKpHdQbECdgJXUwATxsSI5falAe78JuKe+0V1fy0TDSqHtUX:gRlsaNcbSws35Oqo
MD5 SHA1 SHA512 SSDEEP

Submit Download

icarus_product.dll

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av-vps\icarus_product.dll
Size 851KB
SHA256 d060cb6368bf7df914a5f6619a3bcc51430558909434f7e565dcea484778d852
MD5 a4085f7f5bd1406f050995b529ed6640
SHA1 d59acba50b5ca04eeb55a08dfa09c24445b2e722
SHA512 bec6aeed862e12adda63689d806d331946c0b7d743712f1f1c3f11f76e6badfa7752323407ee73b82287f3335034f11014662014db382ad3a19a3c6825dfc6e4
SSDEEP 24576:4XB781vmpU3Xfg1LDgFh0lhSMXlwTiHB:4XJ84pUYDA
MD5 SHA1 SHA512 SSDEEP

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av-vps\product-def.xml
Size 57KB
SHA256 9e2ac05689165008170de29000cfc31e9aa497c2b6fd456fd877eebfb0aeeca4
MD5 8d1a4c6d55de0120e4959c31b7818344
SHA1 67490f520136fd0e73acbc4c44224c9836046957
SHA512 709c3d260983ffcafa257d24a7efec2464bf42b02b54fa83873578a5381cfb48048723d8abcabc9fe9cb92244f8dfa4ee5c0e5e1d5aabd6b3f6a197d1766e3bb
SSDEEP 1536:vOt4htHPgPSOKOYIZcXtRjf9KrLyHCyJFRs7vYn2IygDzj3PrdfACH4DUV/p47X8:44dFg6WI
MD5 SHA1 SHA512 SSDEEP

Submit Download

product-info.xml

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av-vps\product-info.xml
Size 5KB
SHA256 67615180c9ed46f545d489870e1cf547c1d12a972fc1f6f9f17e04fb9845750e
MD5 81e192a59c5c208b94df28535d341033
SHA1 508b79cf6bde8a42246e0956e78cd4c6a132efd0
SHA512 12b20de867edac0ac3943aa43badf71e5526bd24dabf0c952c3cb7a1dad15604d31addfbdfa1003d4e8b3026d8faede6e98ca00e1817e7650dd57ce45ef3fdb4
SSDEEP 96:aVZzPa3SYY5zBVvP4OhUzmXoVNmoVmDhj82AjrbJ6ReIoQVESNB+rlM:arzPa3RY5zBFP4OhUzAoHFVUhw2WrbJI
MD5 SHA1 SHA512 SSDEEP

Submit Download

aswOfferTool.exe

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av\aswOfferTool.exe
Size 2.3MB
SHA256 90364dd980f0c7a8b126d5fb65c7788921e13aba273ad8fb296b5eba59778f12
MD5 14ab1b335b1b9a39a7c3038626ef9d3d
SHA1 96608c4427861b524cea46ec47bd5185ea10815a
SHA512 913188939451702639f34299145e4a1719ce5ee416aa9ef13fbdec868185a9b6ccbedd4b0fbc8212f72035b757780c368e6f7d44b93dfb46e3577be1c16ab1d5
SSDEEP 49152:63QTb7ggggMf3H3/TYURhC7AvAfAAEV1rnFTZT0krlGW+lx:S3/TYURhaAo7ELxTZT0krg
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.def

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av\config.def
Size 757B
SHA256 96976bd5ecb653aded30321685e44a59886901652c031de101e3a13326d61387
MD5 264d61ef38e6f06891da07c11bf71436
SHA1 e4a258aa41ce4aaacdfa7f5c0f6f11d4859fe1b2
SHA512 c818737bcb76b4d50673c8007118320f0b6081108f4934016a04167d5a8f4835393274438769e05276c5db79c5d9f5e4e3748788a1439c974bdf16b3d5dd6890
MD5 SHA1 SHA512

Submit Download

config.def.edat

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av\config.def.edat
Size 20KB
SHA256 b419fe15dd54882a70e9c1ff902467d2e1abfa8565a9cfd0770481ff0ac84e10
MD5 934e4c0db2900855ec6b7bada158d464
SHA1 095811d2cc7924bf2b4c0d88537de9eaca106eb3
SHA512 0d7a0c5a0c545e6dc35d14ec16486f146e89145c2ac7126780012723ebb57d968b46208c6fd379f1d01ca3af188afb68e5a4fd74c351f40134f40630c50ef7a8
SSDEEP 384:DHJ7eXHtHcV2g2Ji0YklIV4H3p+8TBBG1srr7dl9D3eJc5otKxAN:t7e9HrJiH4HfBWw/D3em5o2AN
MD5 SHA1 SHA512 SSDEEP

Submit Download

edition.edat

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av\edition.edat
Size 2B
SHA256 e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb
MD5 9bf31c7ff062936a96d3c8bd1f8f2ff3
SHA1 f1abd670358e036c31296e66b3b66c382ac00812
SHA512 9a6398cffc55ade35b39f1e41cf46c7c491744961853ff9571d09abb55a78976f72c34cd7a8787674efa1c226eaa2494dbd0a133169c9e4e2369a7d2d02de31a
MD5 SHA1 SHA512

Submit Download

icarus_product.dll

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\avg-av\icarus_product.dll
Size 6.0MB
SHA256 dfdcaa2c3313544eeb19361a5fa343fe7e820a0ec6f37c6e6b866dd56f1e7c94
MD5 48868d9172e27b4dab1e0608bebb79c0
SHA1 7680a1779631b10e76ce4b7ab5993cb438fa1add
SHA512 848e5565a8f8809acf4ca7be594dbadf95ace9f4806e25b6bad8075acd247d10d85dd295ea85f6c63c8b8ede149afd8866e3ec0879c581892064323b107f66a2
SSDEEP 49152:KMLQHBldRmPyp2bXu8pC8vRYc1Lev0G8tB0Ic2O/izituUoySx78VqIITx6IFoNu:DPuhYR1sD/izirVkGjTEYh9Lw
MD5 SHA1 SHA512 SSDEEP

Submit Download

bug_report.exe

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\common\bug_report.exe
Size 4.8MB
SHA256 0bc7930fe347a5a4a0ad244f60122a4635baf0695ca30c9ac8df923f540013e6
MD5 51d5604dd0a85f5fa6586980e64d0785
SHA1 cfc31d787dbf01e039971365a9c7a1b6affa1132
SHA512 247490f99e7f8343c00223c1cb2a596ed12584f76c0c3fff24d14859651dacc11ef5ecaa5785af063ee62965b6c8bc535e12d1b78fa43c2bb3f8b133b5af0bda
SSDEEP 49152:+MLnHQldXhTXensN3gVdTBSD2H+/wmlk9cl3om5c9RwMomA8ekiDGuKbwI5qEYAo:NkQTB6K9Eh5In95iAE+1EyvRQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

icarus.exe

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\common\icarus.exe
Size 7.7MB
SHA256 dfefb27fc9a96a2a7aab2059067d670178ede0f926215464d61c298e8e3f895f
MD5 392d142e6b814f42079d5ed9011758f4
SHA1 4111eb5a27f84c26f1a95cc8d577e5b3743dfebf
SHA512 11678c9857ced88d947779b10089a91abc1e80a43f6518289c4fea88353241767406a59a6e682bf300344a7a5aab34126b373aff33fad04d0fee4a78db01b58d
SSDEEP 98304:InOY8sFQR0FBgnOhs8cK5CEkAltmDvXODfhOyBQ6TDf:IOY8eQR0Fan0wExltmDvXODfhTBfTDf
MD5 SHA1 SHA512 SSDEEP

Submit Download

icarus_mod.dll

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\common\icarus_mod.dll
Size 14KB
SHA256 41ed21bcc7c2e31bd5d7b40f2fdf6fb4a27e07e07ff454a560ab9563265c7786
MD5 ce33da043c6139937b48164733916798
SHA1 578b88b7369d76aab8fc671dc9e75125d4006b07
SHA512 ce2ef23cde2b5ee30cd3479ed20946f07055262b6d644fa4dc97c421f1e012a5acf5737dd69024771e2ac14d13742acd3a32a3cbb28c51d7e12b36b42c8185bb
SSDEEP 384:wOVgRTpD8IYiif3vcPAM+o/8E9VF0NyZsk:D6JYiiwAMxkEgk
MD5 SHA1 SHA512 SSDEEP

Submit Download

icarus_ui.exe

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\common\icarus_ui.exe
Size 11.7MB
SHA256 3342f6600ce7e3a7f88d041ad8f4a27fe8f06dc549c371d28eb202e4ec7e8064
MD5 93ac5443af08533a675113b0227705c0
SHA1 cecc66d306ec3a4cfbe93abf51472385aa157795
SHA512 9de0fd990e88ec37655b7968623823c9cef7aa2444573d8f7863cb77d6b55622e41197612421a19f08f60b65bd59f8d656556d6254b16ed8fcfed0613ca73071
SSDEEP 196608:V5b3rZlvykkkuZDzMQeCaeq7RTIhKIrqN3W:bb3rZEPDoQLaeq18oIrqNG
MD5 SHA1 SHA512 SSDEEP

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\common\product-def.xml
Size 1.3MB
SHA256 10bd70200dc8414774e02c8751d7f35e5d8ee80657db4c2efc54369e1da59d2f
MD5 bb399f3eb4cb55dc8f2467c1625535c6
SHA1 3b47ad5966bab7ad26b263e14a38c7792b9ee349
SHA512 7294a989592fae569f1066451f6dd7fd36c52ad20d956d6be20cf69e070ed812fdc9b6dd506c74b54d9fb35a31c5382b8353ca814207dd69b98f7963da7e6717
SSDEEP 12288:m8YO5SM2sinzL2SkZ3u6kH3vQ/NB9u2FFmJl4jL:m8Y00LMuFX4/42FFWl4f
MD5 SHA1 SHA512 SSDEEP

Submit Download

product-info.xml

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\common\product-info.xml
Size 9KB
SHA256 dc5ad9f2d6c6cc5c43c1f2fbb44008997de8c7a6cfdb22b3bbf061b10075284a
MD5 ec1d45e035964aa35a3e34138de2eb0e
SHA1 72dcf5cc92f0ddd139aedd754a7dc22bcd49082e
SHA512 38ad9991b9ec6601810413498decc740fb47130ac70093f9363c0fa17187ec100e89d45f8e798a47a8c8ad2fd64e6ba7d9b5d198d2986431ca08a85efd3e5816
SSDEEP 192:9zP730qBns0mNL2UsKprsUob7OUzPoHKVbvRZWlbJzReI5akNlUWRz9GWT0Ash:9nz9XmN1FZtgjXVubFRekaUXUWF0
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupui.cont

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\common\setupui.cont
Size 381KB
SHA256 79f91b261fede95ab25c4a2ed1d118221552a33ba3e13c9746b1f3200bdfc4ef
MD5 a55572f37fe1652b92e09b1f2a0d43bd
SHA1 4d1ffb01d15c8482607a8fcec2a4bcd905448946
SHA512 1da2fcfa34b72dc64e00f5907d59f68e23be20794884cccb838a41b6023683471dfcb1b0b5bf4695958879aa2e80e8f92385d1b081acde4d4c5002c8a1a468c6
SSDEEP 6144:GW3j68BtVuSAbamwjU/R3TPqlCXvj7JSWDkj+DfbazY5A8kE3gxyRXDHgvdd9Yph:GWzPVuJavmtDVzq+bmzQ+2dq9uh
MD5 SHA1 SHA512 SSDEEP

Submit Download

icarus-info.xml

Path C:\Windows\Temp\asw-be755cd6-fd5e-4fdd-b21d-64d71b425530\icarus-info.xml
Size 1KB
SHA256 2a56114c0518e4b72d3501807ebcaf4964cb275106465b1e756a35ef5d1c7371
MD5 7e144d59e6dcd9dc22090735a262ab7f
SHA1 274c6d72ddcb0e08d2f5206d2d6a8cf32e8edf7c
SHA512 c7eb5e1478ca9b1d6ebd4fdac164eddc485f2e905345997e598a08c8d0440c9bfdf4ace904f6d6224c66b4f53761e92777410c9a12dab1c122b79ee74e8bc79b
MD5 SHA1 SHA512

Submit Download

avg_antivirus_free_online_setup.exe

Path C:\Windows\Temp\asw.bb97d41b277901ba\avg_antivirus_free_online_setup.exe
Size 1.5MB
SHA256 78d4d80014d4815cd798b44272dba55056b7955a22e29c66e96e2ff47f2bb9a8
MD5 532f95e90c93fedd7c1d3758bea1dda6
SHA1 ecf90929ae1bcb1bf4247147b247363802ecb1cb
SHA512 865621304c0a2e993ee62e90c0915883d9e37d5c1ff329347692d32fe33c83366ef554891d61422fbbab6efd1ba3da59071860b5aaccca96ad6ce4d3835f5801
SSDEEP 49152:yWnGv9OUz0ooooEhD7FYd+RWigJsee4rNp3:yWXUzzFYd+RWTo6
MD5 SHA1 SHA512 SSDEEP

Submit Download