06e278e4848089b1482c418ffd7a23adaf344a3bc03c843d8878c33b740a2236

Analysis

max time kernel
98s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06e278e4848089b1482c418ffd7a23adaf344a3bc03c843d8878c33b740a2236.exe
Size 219KB
Sample240612-eebfcszfrj
SHA256 06e278e4848089b1482c418ffd7a23adaf344a3bc03c843d8878c33b740a2236
MD5 6f75f17b0e654f2a4a5860bf09d1f62c
SHA1 ae7657fa0e642d18148dd8d925ade6915e8c935e
SHA512 8370526a1cc93603fe4c333ab2e865a9b7f74affa901b97e6c6bb785ea451ea6666ed8745711fff9b226df020c9e1e602d4bb5ccb17ee0636f94af683b254699
SSDEEP 3072:n2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCoKOhh9K0Kq:n0KgGwHqwOOELha+sm2D2+UhngNHK4cS
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

pid	Process
3308	avg_antivirus_free_setup_x64.exe
3840	instup.exe
1160	instup.exe
4552	aswOfferTool.exe
456	aswOfferTool.exe
960	aswOfferTool.exe
1596	aswOfferTool.exe
2420	aswOfferTool.exe
3524	aswOfferTool.exe
1488	aswOfferTool.exe
1328	aswOfferTool.exe

Loads dropped DLL 13 IoCs

pid	Process
3000	06e278e4848089b1482c418ffd7a23adaf344a3bc03c843d8878c33b740a2236.exe
3840	instup.exe
3840	instup.exe
3840	instup.exe
3840	instup.exe
1160	instup.exe
1160	instup.exe
1160	instup.exe
1160	instup.exe
960	aswOfferTool.exe
2420	aswOfferTool.exe
1488	aswOfferTool.exe
1328	aswOfferTool.exe

Checks for any installed AV software in registry 1 TTPs 6 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	instup.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	06e278e4848089b1482c418ffd7a23adaf344a3bc03c843d8878c33b740a2236.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup_x64.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avg_antivirus_free_setup_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "30"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Main = "12"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "1"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "73"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: sbr_x64_ais"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "99"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Main = "100"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "7"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "13"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "28"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "33"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "50"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "64"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Replacing files"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "3"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage	avg_antivirus_free_setup_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "14"	avg_antivirus_free_setup_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "100"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "18"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "32"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "86"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: offertool_x64_ais"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: instup.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "51"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "91"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "4"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "9"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "53"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "60"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "63"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "93"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Main = "62"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "92"	avg_antivirus_free_setup_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "6"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "46"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "70"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "78"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "97"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: AvDump.exe"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "28"	avg_antivirus_free_setup_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "38"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "44"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "66"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "94"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "98"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "0"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "40"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "83"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "5"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "57"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Main = "0"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "8"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "34"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "42"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "88"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "92"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "21"	avg_antivirus_free_setup_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "17"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "29"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "56"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "69"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "71"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "10"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "24"	instup.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3308	avg_antivirus_free_setup_x64.exe
3308	avg_antivirus_free_setup_x64.exe
1160	instup.exe
1160	instup.exe
1160	instup.exe
1160	instup.exe
1160	instup.exe
1160	instup.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: 32	3308	avg_antivirus_free_setup_x64.exe
Token: SeDebugPrivilege	3840	instup.exe
Token: 32	3840	instup.exe
Token: SeDebugPrivilege	1160	instup.exe
Token: 32	1160	instup.exe
Token: SeDebugPrivilege	1596	aswOfferTool.exe
Token: SeImpersonatePrivilege	1596	aswOfferTool.exe
Token: SeDebugPrivilege	3524	aswOfferTool.exe
Token: SeImpersonatePrivilege	3524	aswOfferTool.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3840	instup.exe
1160	instup.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3308	3000	06e278e4848089b1482c418ffd7a23adaf344a3bc03c843d8878c33b740a2236.exe	92
PID 3000 wrote to memory of 3308	3000	06e278e4848089b1482c418ffd7a23adaf344a3bc03c843d8878c33b740a2236.exe	92
PID 3308 wrote to memory of 3840	3308	avg_antivirus_free_setup_x64.exe	93
PID 3308 wrote to memory of 3840	3308	avg_antivirus_free_setup_x64.exe	93
PID 3840 wrote to memory of 1160	3840	instup.exe	94
PID 3840 wrote to memory of 1160	3840	instup.exe	94
PID 1160 wrote to memory of 4552	1160	instup.exe	95
PID 1160 wrote to memory of 4552	1160	instup.exe	95
PID 1160 wrote to memory of 4552	1160	instup.exe	95
PID 1160 wrote to memory of 456	1160	instup.exe	96
PID 1160 wrote to memory of 456	1160	instup.exe	96
PID 1160 wrote to memory of 456	1160	instup.exe	96
PID 1160 wrote to memory of 960	1160	instup.exe	97
PID 1160 wrote to memory of 960	1160	instup.exe	97
PID 1160 wrote to memory of 960	1160	instup.exe	97
PID 1160 wrote to memory of 1596	1160	instup.exe	98
PID 1160 wrote to memory of 1596	1160	instup.exe	98
PID 1160 wrote to memory of 1596	1160	instup.exe	98
PID 1160 wrote to memory of 3524	1160	instup.exe	101
PID 1160 wrote to memory of 3524	1160	instup.exe	101
PID 1160 wrote to memory of 3524	1160	instup.exe	101
PID 1160 wrote to memory of 1328	1160	instup.exe	103
PID 1160 wrote to memory of 1328	1160	instup.exe	103
PID 1160 wrote to memory of 1328	1160	instup.exe	103

C:\Users\Admin\AppData\Local\Temp\06e278e4848089b1482c418ffd7a23adaf344a3bc03c843d8878c33b740a2236.exe
"C:\Users\Admin\AppData\Local\Temp\06e278e4848089b1482c418ffd7a23adaf344a3bc03c843d8878c33b740a2236.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\Temp\asw.0a76886c17e32e74\avg_antivirus_free_setup_x64.exe
  "C:\Windows\Temp\asw.0a76886c17e32e74\avg_antivirus_free_setup_x64.exe" /cookie:mmm_bav_008_999_a7f_m /ga_clientid:94dfe632-b3b7-43bb-a548-b51c16192a05 /edat_dir:C:\Windows\Temp\asw.0a76886c17e32e74
  2⤵
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - Writes to the Master Boot Record (MBR)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\Temp\asw.8810792c52abe808\instup.exe
    "C:\Windows\Temp\asw.8810792c52abe808\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.8810792c52abe808 /edition:15 /prod:ais /stub_context:421e2ba2-74b3-4d1c-b46c-2878b3ec61ab:9994552 /guid:bf474e6d-c780-4739-8948-7c4c6cd3fc84 /ga_clientid:94dfe632-b3b7-43bb-a548-b51c16192a05 /cookie:mmm_bav_008_999_a7f_m /ga_clientid:94dfe632-b3b7-43bb-a548-b51c16192a05 /edat_dir:C:\Windows\Temp\asw.0a76886c17e32e74
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - Writes to the Master Boot Record (MBR)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\instup.exe
      "C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.8810792c52abe808 /edition:15 /prod:ais /stub_context:421e2ba2-74b3-4d1c-b46c-2878b3ec61ab:9994552 /guid:bf474e6d-c780-4739-8948-7c4c6cd3fc84 /ga_clientid:94dfe632-b3b7-43bb-a548-b51c16192a05 /cookie:mmm_bav_008_999_a7f_m /edat_dir:C:\Windows\Temp\asw.0a76886c17e32e74 /online_installer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe" -checkGToolbar -elevated
        5⤵
        Executes dropped EXE
        
        PID:4552
    - - C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe" /check_secure_browser
        5⤵
        Executes dropped EXE
        
        PID:456
    - - C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe" -checkChrome -elevated
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:960
    - - C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
      - C:\Users\Public\Documents\aswOfferTool.exe
        
        "C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFC
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2420
    - - C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3524
      - C:\Users\Public\Documents\aswOfferTool.exe
        
        "C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFC
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1488
    - - C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\aswOfferTool.exe" -checkChrome -elevated
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup.log

Path C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\Setup.log
Size 26KB
SHA256 f05f8a897c1ba3a6ab491fbd9698a9da5fba126293fc60c615b3ef2bb5026564
MD5 5ff3746d4e6a7c897de8c03bfc1ce7e7
SHA1 ea775b0871f174f95c511b446923e46bdcc82e34
SHA512 3abd79cdd2452a892dd09133dadd17c5fe4235cd5daffb7a573ece7643ee90a8a012fc83f1fc6262b3e61d54f46f59f716691dbc712ab6e374f63bd79b07f854
SSDEEP 384:rtXspoojNE8jjIr9gjdjoj2j2jPj+jKvjPhd9dh:JspooxE8jlhUqijKIThd9dh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.log

Path C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\Setup.log
Size 1KB
SHA256 586465ec32695415b039f692b14a99421a3e0da9449776950f9e8a3633b57993
MD5 e4eb4ea1366a643f24519a2036ba57c7
SHA1 ddec040983ae5c9e05da385fd9d8e57bbb07beea
SHA512 1a1f1751a2eee2384451245fea6dcddf360dfc8b39f93994eb8073faea1ce1da22bb82c3f158b6eb3c2cadac64746aed2fbd5c8423e3375c7d07b876b573d79c
MD5 SHA1 SHA512

Submit Download

event_manager.log

Path C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\event_manager.log
Size 281B
SHA256 3b7e413b945277958f795e9597e512d03d0fcb6b0f712f49e4d88259f11278c3
MD5 8b2750df8f9965c196b219339f758af4
SHA1 32e1b6bee5a6c3d96743a7f5b6d9a52e46706abe
SHA512 b9503b13c81c0bd9c9a11e57bbccaf09393fdf409c33c3795d5b374caa72423463103970e8afdc0042edef546f3e018c7d259e09f80ee201b74657a04418de74
MD5 SHA1 SHA512

Submit Download

avg_antivirus_free_setup_x64.exe

Path C:\Windows\Temp\asw.0a76886c17e32e74\avg_antivirus_free_setup_x64.exe
Size 9.5MB
SHA256 47cee4d44e8fe27f3229fa751c11259227a00b605d6a42e2cb066f100a9049c3
MD5 72c1cad77d7a37f6eed6606b00b22738
SHA1 1883d039f42ead5318de8f5f37b61bad4b61fa72
SHA512 87104f2cf47683f113398e71b795fbeadd6835b5d333e1aedf22e7d3afec7de3e138cbc949947235ff4892489caaf219405832df91885084e361806ac22d0209
SSDEEP 196608:UbX7+wgrimZ+k8DJ6JaUsPs7qK72ry4jIFceON2QmXMinwaGTOU:aX7+ZNt8UsP6H72ryonF3yMinn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ecoo.edat

Path C:\Windows\Temp\asw.0a76886c17e32e74\ecoo.edat
Size 21B
SHA256 440d6eaf6f04e6b763e71a5fa256f92ad401f028a471f424f8b9db5ff50fadb0
MD5 5a3d02569b7607d7cc435694dbb78ae4
SHA1 aa1cf4f01feb1d8afd138ac81b560d7d7b8d0022
SHA512 efe749b2631594b66819424e75bbcdb27b999115615bdddeef11ab2bc832dcedf4da42a1d6584e906547a0453591f968f76b2404febe35414e8f244b4183f9a7
MD5 SHA1 SHA512

Submit Download

HTMLayout.dll

Path C:\Windows\Temp\asw.8810792c52abe808\HTMLayout.dll
Size 4.0MB
SHA256 0ffd67c501dd1778c35830465f07f2390e318a485e0b22e437404b0a9d4b5ad2
MD5 4cc6efda014cc654142c97cd09175e37
SHA1 9ff80f73eb8aa9563ee04f3857fedbb4167a9a2a
SHA512 064ceb07ef2a8a5db7d07a3ee58df07008efd642f12960c7dce837f533876199c0773a4b9861cf7907487b7fb2a96d6a1efdcc854855fd9246198ca438cab751
SSDEEP 98304:0cp5sXlHosul/7avy9WdvbIofyMcrqNNOSy0Oh:0caosa/eK9WJdyMcrqN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Instup.dll

Path C:\Windows\Temp\asw.8810792c52abe808\Instup.dll
Size 18.1MB
SHA256 67721cd04b1866888a97c1027e6d6ca5805b08124b724a31ff9931f9f3e28b2a
MD5 e9134948a4db2642f9bfaaf157a18bd0
SHA1 98249d941c196e9ee01f5d77713f13a12fff87f4
SHA512 629b39736755e9a9987a74aa9dab6aec94be061a3c70c140ce98d4eb9ca3575ccc02380990a023f3fbc1f49d56518f1dc9345fd8c7fe3b9cfbf7eb9c80187995
SSDEEP 393216:pNtDQf8KzI8uRAQ6uw1VTBtx+HpsDnOoqcTO6n5fUMFhWWSd84vClrQkp:pNtyQm1F5+qfNz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Instup.exe

Path C:\Windows\Temp\asw.8810792c52abe808\Instup.exe
Size 3.6MB
SHA256 068bd9cd5dc944ff9030bdf3e31638408314e54861b93cdaf8c3c905a8005cac
MD5 cb33ee6145c1dfad640103e1bc8b00e9
SHA1 e68405536c9501a5f7617636db734a7e7bfdb61c
SHA512 31608dc1d295c91d012fd4634494b182c6d4b70c255036cbd0f71ace56fbc1a69f8358b8799d2db21e0bea1010ad79dee774b6049bf31dd513042b460722508b
SSDEEP 49152:gJb/z8AyRxcItt7800NFqMIPwH/VoDpLWtFmWpVpA9mKAgtMtetk+b7TcNy0nJln:O/0c8MEpkmkp2hl
MD5 SHA1 SHA512 SSDEEP

Submit Download

asw16a64b679ba7b86e.tmp

Path C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\asw16a64b679ba7b86e.tmp
Size 19KB
SHA256 7fd358eddcef6756f315fec2bfad52286402f7194104fcfd3dcec7d588597025
MD5 ebd5c38aa827d9777dcde81e2a037b6f
SHA1 740eee39569863c6baa780e7d82c848c92abe0c1
SHA512 fc22fff31b6e84297af9769b84142960e45bf9d8b71e9039e3829be9c671fc173dd47c88c25807f3e7bca0b87f842de500f5227e21ed312bfae2e89d0b65ff0d
SSDEEP 384:4xaZ9QGb3KiVm+rTMypIYiiftG5fQAM+o/8E9VF0Nyf:4YZ99bhrYrYiiWfQAMxkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

gcapi.dll

Path C:\Windows\Temp\asw.8810792c52abe808\New_18050d08\gcapi.dll
Size 867KB
SHA256 e0d08b9da7e502ad8c75f8be52e9a08a6bcd0c5f98d360704173be33777e4905
MD5 3ead47f44293e18d66fb32259904197a
SHA1 e61e88bd81c05d4678aeb2d62c75dee35a25d16b
SHA512 927a134bdaec1c7c13d11e4044b30f7c45bbb23d5caf1756c2beada6507a69df0a2e6252ec28a913861e4924d1c766704f1036d7fc39c6ddb22e5eb81f3007f0
SSDEEP 24576:rvqA5tAf7fM6xEV1rnF6SZT0kiSJN5H9tmGn7sL0h:eAvAfAAEV1rnFTZT0krlGW+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

asw957c6bd21f917998.ini

Path C:\Windows\Temp\asw.8810792c52abe808\asw957c6bd21f917998.ini
Size 1KB
SHA256 8244a39b0f20a0fced77dab96ab441b9e4ac467ba9470fbc984a15dcc6f070a0
MD5 8c3881c3f5e6f0581e882af0685aa9d5
SHA1 0429de1cd4fd97e1b84099291ee4c92b33ea29b8
SHA512 3b3c52cf4a0fc2e1461dcdc9d2bc6363e4070a201c07d55ba1ed19d284e5866f870baca787568ceeffe67212c6967a199680c0cc1bfeda681e105a63f8177320
MD5 SHA1 SHA512

Submit Download

avbugreport_x64_ais-d08.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\avbugreport_x64_ais-d08.vpx
Size 4.7MB
SHA256 b1819bf1551be44e0f293f6b6ead1841aacb63ca3a9d90f1a31c9cb52f648c6e
MD5 ebc2e21a31af7ba94c3a70db0caf23ad
SHA1 36a25c19c6becbcf8e1c959458867f59cab774a3
SHA512 e777fd82cf1d782e73dc8796c57ecb9be4ed09256af456190ae0e414de651226c3eb616ae4ec1c245e55934843dd85485e0594c0125e013c47b48d89fff5f739
SSDEEP 49152:RML3H3ldwCj0Y1Jk3nGNzCC3fHwh1eyClUDsRBT5G39nJJn8Xz/2hMrtmm2rnIho:U4qCizUDYTEEHsI7YRsOc3WBN3iA
MD5 SHA1 SHA512 SSDEEP

Submit Download

avdump_x64_ais-d08.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\avdump_x64_ais-d08.vpx
Size 3.3MB
SHA256 55ebd9dc7c26877a51e11722d3ea17f1afdf39a30aeda07ef6804659c34e54c4
MD5 c339cfe0485edefebae496b088d41221
SHA1 684e4fa30a601ef645293cc5a8b008bbc03b9483
SHA512 c78b4735ed9184219f95a461e97a47d95b60f353ded28d692a72f9c3db2ead081b700731c8b673e8a1ca969519281d8e73cef449d5bb6bcfd282fcd2261f4a5d
SSDEEP 49152:XnXksgX2MB1qbvLHBIs9Mr/uJ4aF9jzb4BuRKr6+bw9reOrtPtxlCt6+0rGycT+5:XnUs6GvbFeBY+04ZObo
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.def

Path C:\Windows\Temp\asw.8810792c52abe808\config.def
Size 18KB
SHA256 e30036d31d2a1737db17c4a684a62059cc0aefedc6ebe662e00b0d9c0d94eb2e
MD5 57668a27b39c5dc639f3b91dc76229e6
SHA1 20306491d8a54b40976667edbc688db23f644259
SHA512 fc0b4049b92566a6401aade7e6a604850823d0ffb6fc54053e7f67a23122dfdc550af706917b09913a51c2db19d725ed93d96e8cd8ec570c2cca9248ea48efe2
SSDEEP 384:D19+eXHtHaV2gjJi0JNTJ3p+sG1Crr7dlTEq3eOA8okVAn:T+e9HmJi0JjWiJEq3eF8oKAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.def

Path C:\Windows\Temp\asw.8810792c52abe808\config.def
Size 24KB
SHA256 8f9d74022029d4dace08db9cbf74a2afd8c14023f038229526da3fc43c4a9422
MD5 9a2dc5c816e92f3c45e285456c75f64d
SHA1 bc878127e0d90d85ebdfa0ccc1f5864c90d5a469
SHA512 9b1859639cfa7a83c267e8cf8dae6d868c6e7875e71f80f7f14b2298d47bfcbb5bac01d80417edc47139355a0cb184c7c5c900389a7a599a664773d612c6d769
SSDEEP 768:pKutTkpty9HmJiHD4ZXBWiqEq3ee8oRkH:1QQceD4HL
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.def

Path C:\Windows\Temp\asw.8810792c52abe808\config.def
Size 18KB
SHA256 b64d1d23aef5cdeeb2279216a00c931b201bce90407c9cbff3a7ef2742873878
MD5 b86dd14aadb9e34d004ad39a4693ced0
SHA1 1cb7775cee3e4106b2ddba89a0ccdc9dd547c521
SHA512 03cb9215521da45e1df7b926fad7b0afd5ee001944c475a90c8646d7621d0d062267a682e102d81da0b5204ed215ec6ba4c7646d9340d71b0cb77ca12ddef0c1
SSDEEP 384:Dw9+eXHtHoV2gsJi0JeTJ3p+iG1srr7dlRD3eOA5ohJAT:O+e9HBJiRJBWwzD3eF5oTAT
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.ini

Path C:\Windows\Temp\asw.8810792c52abe808\config.ini
Size 676B
SHA256 90feffbc2b9497763566c864f0289494734581800d9259f15f44602364e8fcde
MD5 4e17397b45c1c8fa46ce2dcec595d713
SHA1 983ef70679ef1bf54aaa69b15df8dddf52038abb
SHA512 bd0cd4df34eec60f4972855fdc54c3e6b19dc665fb365d0d677ba9ce522a4e3e4284bf9a9244935392f3b26b91254b2959bf1e59ad4e44aded6acfd91beb11cd
MD5 SHA1 SHA512

Submit Download

offertool_x64_ais-d08.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\offertool_x64_ais-d08.vpx
Size 2.3MB
SHA256 0b7c3caa31928131ce0e1ca570aa72e20a98dda13e4ca0c59f31cc677d8e8c6e
MD5 993a67fbd5162510a2b0f3fba05bad33
SHA1 3c76258240a04c05341e611f55bef10341e34ff3
SHA512 44a335d3db00fa9148066a5f2d2a9f5250d7df2315d132ab2798b02e2d21b700525a00be91d960e1564a6ffc0ee95347f0df9ffc27a10cf807d5a926ab5154a3
SSDEEP 49152:fSfa0hggggM7QCpnouu2bhH+AvAfAAEV1rnFTZT0krlGW+T:f7jouu2bheAo7ELxTZT0krg
MD5 SHA1 SHA512 SSDEEP

Submit Download

part-jrog2-78.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\part-jrog2-78.vpx
Size 211B
SHA256 d7356e185708ab40b1bbe0f7691a97b5f2cfa3edf2e00f2aa5cab18ae3e63787
MD5 a1b8228fcdaa47b486cade7ff1159833
SHA1 6f090d73a081c0d854db42b9f6719ce5ecefdf91
SHA512 bb3e590504444bf9020a74ab9a7641dfe2ac15158af3f556a04666823f0dab75ac7c0f280f555d8ff8f3c5208fde6ddc801f3db5a4785d211b7d0fcdaedc3251
MD5 SHA1 SHA512

Submit Download

part-prg_ais-18050d08.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\part-prg_ais-18050d08.vpx
Size 73KB
SHA256 4b01a68078d7e1af1c0197baddbbb1ef4d3cbf13f71e8b9df766f88b4e6d8025
MD5 d264bf74d7ffcbad341d9fcefa4893bb
SHA1 c7e9a0972524fa573825865c46eb6728d3e219e0
SHA512 afbfdf6fdeb5dc427340de691726e79cb5bcc41bd488c557c684efe3f26d83a17f1118cc50bd64541a9a839d3dd4329a72a9423e65d3e9cdcfbd14003f1e0dc3
SSDEEP 1536:KqDyYjpqOSMR1P+p34KNFpeg3a9TcLajMZZk6PO8QuZgSHkOtghW:KcyYjpyE1PS344m9TcuwZKd8hSSH/GW
MD5 SHA1 SHA512 SSDEEP

Submit Download

part-setup_ais-18050d08.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\part-setup_ais-18050d08.vpx
Size 4KB
SHA256 675bd92f752a51bd7d9797895252b3130095a06d7d5db8f221ab6251735ead8d
MD5 0344288a18997069003d84c226a168f9
SHA1 0fe47920601834e620737ad321fbb24d38c7ee94
SHA512 b1680ef42d7e2e56fbb124c91da27f15e6c946450c7d03d95b937c3cde80dbc2260e11926578075df255058c2307058429fd2f7307fc0a105c775a9b8aa82429
SSDEEP 96:Di32XtsARbaKlqcnkXgsl6omgbN34CvyiC5Fq7opedK02F7n:DnDRDNnkXg3o/lSz5F1yMFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

part-vps_windows-24061003.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\part-vps_windows-24061003.vpx
Size 7KB
SHA256 544d75f184c7ccef191ba7526985f461e5b19493cd9f61ed73c422e449eed51e
MD5 769c8f235059d9a43ff880d268de20bd
SHA1 417804808fdc83a469d260ca3378bcc461b665ff
SHA512 1908c17c6566c5b592683d34670940bf9dafd7815bfc49ee530fe2db21114fdb90f109c5096a43aafee6cfd7b520ffd0c60c5a9e1ba501890e858fa7e356f0ae
SSDEEP 192:lBFaYPh7IfsCLWyAbXdysrcPCnmXSDJTAODNsrps7:zPe0CLYXdDlRDJkns7
MD5 SHA1 SHA512 SSDEEP

Submit Download

prod-pgm.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\prod-pgm.vpx
Size 572B
SHA256 846f9f2f624c8a1f001a4bd7c7ca3158c8c79cb11fa6d474cfdf8e48d0238a3f
MD5 6d08ac0131cac7a2f9f2ea5d9d0b0cc6
SHA1 25983c1419089c6a7570963dda2d06e022b3b36d
SHA512 753890f34fc1a925177a594c8bc5e19dc509fb8b32c1eef429496c5d19421200bdd75879c529981823340718bee82dafdf3f262a9ecf65de9ef03d12a1684b2c
MD5 SHA1 SHA512

Submit Download

prod-vps.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\prod-vps.vpx
Size 343B
SHA256 52e06087d9c0968150bc5d3b06895e3ab9b69aebea20e0328434b703aa242099
MD5 b516373c4f4f0bd98bbbcd71b4022e4d
SHA1 fb2ccdcbec8ddcd91f35fd762dd86a5b2cb8e062
SHA512 b1ef7ffd12b104a3caf8676c95285693c2af057537df0e87a292cea51bddf34be3ff00adae1337ecede93a8de9bb9ee71c464920f9f54c7bf3236d74aae98469
MD5 SHA1 SHA512

Submit Download

prod-vps.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\prod-vps.vpx
Size 341B
SHA256 ad8c1dbb522554e094112fceb4fd627d393638672559d9fbcd624d9efb13242b
MD5 fdb487ce4bbd3fb4300630d4b3633977
SHA1 d3f105078f5f490641f7062ea12b22cee848f624
SHA512 a9555d6a730c75a328c30200738ced9a4f9a7fdc30097f716ee4115d5ea9b4f4a12696419626e8b0e73d7c194488ac04e09a543ff72804f61d5721d4246af754
MD5 SHA1 SHA512

Submit Download

servers.def

Path C:\Windows\Temp\asw.8810792c52abe808\servers.def
Size 27KB
SHA256 1fc616dd97e72451eda1324979f65df6af823aaaee1c83e5c2c3f3308cd26a67
MD5 2b62fb1ecd174c7e951f2b8af502c1c0
SHA1 90744a9355dd5b74d2ecc7ee34fccbeca1c18f1b
SHA512 0f14fbab88469ed19cde8d54ad74276ae4b03a783bf99def2d0f4d655a6ff86a35aa7ce4e8a7dcb936c70789efc4714b9bf1b317e485a6a44f150be6792cd7a0
SSDEEP 768:29I3IeFiYOqys6nt6HfW5PcmRAOhbu7+ts4rE1qvKlWsT:ZFiY1
MD5 SHA1 SHA512 SSDEEP

Submit Download

servers.def.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\servers.def.vpx
Size 1KB
SHA256 e1b5e5122457b19ad5175b0b372d6d0b55813503827ad1d84c26f23b8506a66d
MD5 ca027a5ef5f6d21d7e42855fa4db4120
SHA1 eee669fe1c3cabd5f96c65ac992e4851f8eca9da
SHA512 8dcd63d2406f6f7e67053342553345bb372401a8dda64e1b41e937df7359a8e4c0afa9705d8fbb953aeed403d54bcd6a5d5bddf7ca1d6c43f1da37020bdda491
MD5 SHA1 SHA512

Submit Download

setup.def

Path C:\Windows\Temp\asw.8810792c52abe808\setup.def
Size 38KB
SHA256 0b9aedce74468150c054d27649dad8f98109e537a581649be6668a13cd29e6a7
MD5 49474897d267894daa13e9dcb168793d
SHA1 10331de148bb89ecc6e1af25bd3b0a862dd2b4eb
SHA512 687dfcfdff27d8be7fa2b7a277a6bd269bf719ca12bf5e7f38643582785032cb8b0e11c04180736dfa56c2b10a12e10c10e50427ceacf6d6332125ebf65eb9da
SSDEEP 384:KdvwY8ZysnOBuUBLCtzmW5qU2yhsI1uvMYYBjBuyvFKCt/ITPG5EDXO:HSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

uat64.dll

Path C:\Windows\Temp\asw.8810792c52abe808\uat64.dll
Size 29KB
SHA256 5a690ef46a5c889adbad580b773a6025040426ee11d3817927dd1e77698e8ece
MD5 c53dc6d8050e08d12939b95e2f5c53dc
SHA1 01f3fd1a4c730cad939d243e6bb8f9fe8f1e0138
SHA512 75ec453cfa12a071322877db4244746de6ecec779c4f267cb3b9729437f3e0a90ffa2fe1d42e5baf05c159c8c6ef6c71bc7e258044162e5fcbaad10a9e93d84a
SSDEEP 768:LyxCUKKBcns+DZgqsQpwNGMYiiZfAMxkE:LoEsxvQaNR7Q/x
MD5 SHA1 SHA512 SSDEEP

Submit Download

uat64.vpx

Path C:\Windows\Temp\asw.8810792c52abe808\uat64.vpx
Size 16KB
SHA256 bf60d1aa67abc73f927e1544ba8b66a79ec9143caedb15e1d94d023be6aba036
MD5 bd33707a5e0b6cc434fbaa32e69cb30a
SHA1 34ddc8fbda6acef9e07de571d4c00e65e3c09958
SHA512 02b78b7796e55e245d00ae5b94ae767c6c7da480ec609e84b1a4deafb5f6dbb8f15ad5947b3db421048e17d46419b2149ef23aa369ce42288d3bb5817a0863de
SSDEEP 384:mfh7yrvtygz0z+yW/Qn25LOkuxZ2lu5IU+HjMQJhu:mJUzll5LhuDl5v1
MD5 SHA1 SHA512 SSDEEP

Submit Download