Analysis
- max time kernel
126s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 11:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec80a54e5532f2e9ebd5bf9dc533a03637e36b2678680fe11404fc70c1aa40da.exe
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
ec80a54e5532f2e9ebd5bf9dc533a03637e36b2678680fe11404fc70c1aa40da.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target ec80a54e5532f2e9ebd5bf9dc533a03637e36b2678680fe11404fc70c1aa40da.exe
- Size 219KB
- Sample240612-n355baxejl
- SHA256 ec80a54e5532f2e9ebd5bf9dc533a03637e36b2678680fe11404fc70c1aa40da
- MD5 05557a48ced3340c7cedceb4c768e1a7
- SHA1 16e9d9d5f04cea324bfe6ea893a327588b61437c
- SHA512 f38b02d48a5b7584b2107b355346ca0c8460c20dc71142cf409a60220a02dfb56e6b68925ba0bd924027c3f9a0482bcbe1216feb2e307384c4992408dafe93df
- SSDEEP 3072:n2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCoKOhhdK0KB:n0KgGwHqwOOELha+sm2D2+UhngNnK4Qt
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 11 IoCs
pid Process 852 avg_antivirus_free_setup_x64.exe 2880 instup.exe 1448 instup.exe 2996 aswOfferTool.exe 2020 aswOfferTool.exe 2420 aswOfferTool.exe 3952 aswOfferTool.exe 2380 aswOfferTool.exe 4660 aswOfferTool.exe 640 aswOfferTool.exe 2696 aswOfferTool.exe - Loads dropped DLL 13 IoCs
pid Process 3836 ec80a54e5532f2e9ebd5bf9dc533a03637e36b2678680fe11404fc70c1aa40da.exe 2880 instup.exe 2880 instup.exe 2880 instup.exe 2880 instup.exe 1448 instup.exe 1448 instup.exe 1448 instup.exe 1448 instup.exe 2420 aswOfferTool.exe 2380 aswOfferTool.exe 640 aswOfferTool.exe 2696 aswOfferTool.exe - Checks for any installed AV software in registry 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast instup.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus instup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus instup.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast avg_antivirus_free_setup_x64.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast instup.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus instup.exe - Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 ec80a54e5532f2e9ebd5bf9dc533a03637e36b2678680fe11404fc70c1aa40da.exe File opened for modification \??\PhysicalDrive0 avg_antivirus_free_setup_x64.exe File opened for modification \??\PhysicalDrive0 instup.exe File opened for modification \??\PhysicalDrive0 instup.exe - Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 instup.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature avg_antivirus_free_setup_x64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz instup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision avg_antivirus_free_setup_x64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision instup.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 avg_antivirus_free_setup_x64.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz instup.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "92" avg_antivirus_free_setup_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "99" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "65" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "DNS resolving" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "40" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "66" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: sbr.exe" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "8" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "36" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "54" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "97" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "42" avg_antivirus_free_setup_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "0" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "15" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "23" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "81" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Main = "75" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: HTMLayout.dll" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "4" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "18" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "19" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "62" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "78" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: avdump_x86_ais" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "89" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "67" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "100" avg_antivirus_free_setup_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "2" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "68" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "72" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Main = "50" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "78" avg_antivirus_free_setup_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "31" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "32" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "44" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "60" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: instup_x64_ais" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "14" avg_antivirus_free_setup_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "85" avg_antivirus_free_setup_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "42" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "51" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "56" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: avdump_x64_ais-d08.vpx" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "85" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Replacing files" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "3" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "10" instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "17" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "73" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: instcont_x64_ais-d08.vpx" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: sbr_x64_ais-d08.vpx" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "45" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "82" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Main = "25" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: instcont_x64_ais" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Main = "87" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "85" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "0" avg_antivirus_free_setup_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: servers.def.vpx" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "6" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "77" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "94" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: avdump_x64_ais" instup.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 852 avg_antivirus_free_setup_x64.exe 852 avg_antivirus_free_setup_x64.exe 1448 instup.exe 1448 instup.exe 1448 instup.exe 1448 instup.exe 1448 instup.exe 1448 instup.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: 32 852 avg_antivirus_free_setup_x64.exe Token: SeDebugPrivilege 2880 instup.exe Token: 32 2880 instup.exe Token: SeDebugPrivilege 1448 instup.exe Token: 32 1448 instup.exe Token: SeDebugPrivilege 3952 aswOfferTool.exe Token: SeImpersonatePrivilege 3952 aswOfferTool.exe Token: SeDebugPrivilege 4660 aswOfferTool.exe Token: SeImpersonatePrivilege 4660 aswOfferTool.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2880 instup.exe 1448 instup.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3836 wrote to memory of 852 3836 ec80a54e5532f2e9ebd5bf9dc533a03637e36b2678680fe11404fc70c1aa40da.exe 91 PID 3836 wrote to memory of 852 3836 ec80a54e5532f2e9ebd5bf9dc533a03637e36b2678680fe11404fc70c1aa40da.exe 91 PID 852 wrote to memory of 2880 852 avg_antivirus_free_setup_x64.exe 92 PID 852 wrote to memory of 2880 852 avg_antivirus_free_setup_x64.exe 92 PID 2880 wrote to memory of 1448 2880 instup.exe 93 PID 2880 wrote to memory of 1448 2880 instup.exe 93 PID 1448 wrote to memory of 2996 1448 instup.exe 94 PID 1448 wrote to memory of 2996 1448 instup.exe 94 PID 1448 wrote to memory of 2996 1448 instup.exe 94 PID 1448 wrote to memory of 2020 1448 instup.exe 95 PID 1448 wrote to memory of 2020 1448 instup.exe 95 PID 1448 wrote to memory of 2020 1448 instup.exe 95 PID 1448 wrote to memory of 2420 1448 instup.exe 96 PID 1448 wrote to memory of 2420 1448 instup.exe 96 PID 1448 wrote to memory of 2420 1448 instup.exe 96 PID 1448 wrote to memory of 3952 1448 instup.exe 97 PID 1448 wrote to memory of 3952 1448 instup.exe 97 PID 1448 wrote to memory of 3952 1448 instup.exe 97 PID 1448 wrote to memory of 4660 1448 instup.exe 100 PID 1448 wrote to memory of 4660 1448 instup.exe 100 PID 1448 wrote to memory of 4660 1448 instup.exe 100 PID 1448 wrote to memory of 2696 1448 instup.exe 102 PID 1448 wrote to memory of 2696 1448 instup.exe 102 PID 1448 wrote to memory of 2696 1448 instup.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec80a54e5532f2e9ebd5bf9dc533a03637e36b2678680fe11404fc70c1aa40da.exe"C:\Users\Admin\AppData\Local\Temp\ec80a54e5532f2e9ebd5bf9dc533a03637e36b2678680fe11404fc70c1aa40da.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\Temp\asw.b2b26fe5f5e2ae86\avg_antivirus_free_setup_x64.exe"C:\Windows\Temp\asw.b2b26fe5f5e2ae86\avg_antivirus_free_setup_x64.exe" /cookie:mmm_bav_003_999_a7f_m:dlid_FREEGSR-HP /ga_clientid:392e00f2-a394-47f2-96c0-5e17d5c7aed4 /edat_dir:C:\Windows\Temp\asw.b2b26fe5f5e2ae862⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\Temp\asw.5c3f8b203c0cc8be\instup.exe"C:\Windows\Temp\asw.5c3f8b203c0cc8be\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.5c3f8b203c0cc8be /edition:15 /prod:ais /stub_context:fb4bcc41-a369-4312-93e1-07e19573d456:9994552 /guid:0df12edd-e28c-48e0-991c-d98cd66977fa /ga_clientid:392e00f2-a394-47f2-96c0-5e17d5c7aed4 /cookie:mmm_bav_003_999_a7f_m:dlid_FREEGSR-HP /ga_clientid:392e00f2-a394-47f2-96c0-5e17d5c7aed4 /edat_dir:C:\Windows\Temp\asw.b2b26fe5f5e2ae863⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\instup.exe"C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.5c3f8b203c0cc8be /edition:15 /prod:ais /stub_context:fb4bcc41-a369-4312-93e1-07e19573d456:9994552 /guid:0df12edd-e28c-48e0-991c-d98cd66977fa /ga_clientid:392e00f2-a394-47f2-96c0-5e17d5c7aed4 /cookie:mmm_bav_003_999_a7f_m:dlid_FREEGSR-HP /edat_dir:C:\Windows\Temp\asw.b2b26fe5f5e2ae86 /online_installer4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe"C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe" -checkGToolbar -elevated5⤵
- Executes dropped EXE
PID:2996
-
-
C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe"C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe" /check_secure_browser5⤵
- Executes dropped EXE
PID:2020
-
-
C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe"C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe" -checkChrome -elevated5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420
-
-
C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe"C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3952 -
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFC6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380
-
-
-
C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe"C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4660 -
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFC6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640
-
-
-
C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe"C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\aswOfferTool.exe" -checkChrome -elevated5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2736,i,5229431749694857451,16836185654682871752,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:81⤵PID:5104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\Setup.log
- Size 26KB
- SHA256 d6072cbacef3ff40b312b2b99c8f7e118629942c6a4c38ad6cc1d4f8bbf7ee78
- MD5 d11eeaf3898a0e00fd3aa3e0cb74ee8f
- SHA1 e3709a5360c7394f2307eddbd5491553e0ae96bf
- SHA512 7ecdd454fbcd7e3dad66e289bc68e9f7d8cb3fa2e77ff778e5ad09d50f4747c068d8cc666e0bc1c06bea9d17b7dcdad953ef03b3e58e1b2b33c996e2d9da17c3
- SSDEEP 384:1cnx/m7njNi/vjLkOj/jVjSjbjBzj/jK3jkvX7:G/m7nxi/vLLhm/FzD8gvX7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\Setup.log
- Size 1KB
- SHA256 bedc210addd87c9dc1083614386512df05b50f6f1f93462e88fe1068a9d995a8
- MD5 db177e45eb918b8a9ee3865467faad22
- SHA1 c8b95aa4965a5d19733582a7361a2ea9b80934a0
- SHA512 3a1199a7f4cd527c0a8c485a573b85100258b104990c5ae10b7f66e815bb038a92c0dc16f3a6d7c1549cfcaac7e058bf39fc3a809d3f9488384cd408c7b148e7
- MD5 SHA1 SHA512
- Path C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\event_manager.log
- Size 281B
- SHA256 b86b364cfeb4dc9ad5d0dc55d89dab1ee0c511c0f93414b17901df5359f6e397
- MD5 df0516168a160991f93d2a35f55be39c
- SHA1 9ee0b3e08875d833a535c78579e2865c6a64ac89
- SHA512 028f80477c4cede4a45b1d957c43072e83415ca61f6bc1adabcfe81b5cb22113db09a37601cfd3f723a409429ee61092fab0652ba5af70125424f03bfdfcdf9a
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\HTMLayout.dll
- Size 4.0MB
- SHA256 0ffd67c501dd1778c35830465f07f2390e318a485e0b22e437404b0a9d4b5ad2
- MD5 4cc6efda014cc654142c97cd09175e37
- SHA1 9ff80f73eb8aa9563ee04f3857fedbb4167a9a2a
- SHA512 064ceb07ef2a8a5db7d07a3ee58df07008efd642f12960c7dce837f533876199c0773a4b9861cf7907487b7fb2a96d6a1efdcc854855fd9246198ca438cab751
- SSDEEP 98304:0cp5sXlHosul/7avy9WdvbIofyMcrqNNOSy0Oh:0caosa/eK9WJdyMcrqN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\Instup.dll
- Size 18.1MB
- SHA256 67721cd04b1866888a97c1027e6d6ca5805b08124b724a31ff9931f9f3e28b2a
- MD5 e9134948a4db2642f9bfaaf157a18bd0
- SHA1 98249d941c196e9ee01f5d77713f13a12fff87f4
- SHA512 629b39736755e9a9987a74aa9dab6aec94be061a3c70c140ce98d4eb9ca3575ccc02380990a023f3fbc1f49d56518f1dc9345fd8c7fe3b9cfbf7eb9c80187995
- SSDEEP 393216:pNtDQf8KzI8uRAQ6uw1VTBtx+HpsDnOoqcTO6n5fUMFhWWSd84vClrQkp:pNtyQm1F5+qfNz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\Instup.exe
- Size 3.6MB
- SHA256 068bd9cd5dc944ff9030bdf3e31638408314e54861b93cdaf8c3c905a8005cac
- MD5 cb33ee6145c1dfad640103e1bc8b00e9
- SHA1 e68405536c9501a5f7617636db734a7e7bfdb61c
- SHA512 31608dc1d295c91d012fd4634494b182c6d4b70c255036cbd0f71ace56fbc1a69f8358b8799d2db21e0bea1010ad79dee774b6049bf31dd513042b460722508b
- SSDEEP 49152:gJb/z8AyRxcItt7800NFqMIPwH/VoDpLWtFmWpVpA9mKAgtMtetk+b7TcNy0nJln:O/0c8MEpkmkp2hl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\asw7cf0f2e1cd85eb2d.tmp
- Size 19KB
- SHA256 7fd358eddcef6756f315fec2bfad52286402f7194104fcfd3dcec7d588597025
- MD5 ebd5c38aa827d9777dcde81e2a037b6f
- SHA1 740eee39569863c6baa780e7d82c848c92abe0c1
- SHA512 fc22fff31b6e84297af9769b84142960e45bf9d8b71e9039e3829be9c671fc173dd47c88c25807f3e7bca0b87f842de500f5227e21ed312bfae2e89d0b65ff0d
- SSDEEP 384:4xaZ9QGb3KiVm+rTMypIYiiftG5fQAM+o/8E9VF0Nyf:4YZ99bhrYrYiiWfQAMxkE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\New_18050d08\gcapi.dll
- Size 867KB
- SHA256 e0d08b9da7e502ad8c75f8be52e9a08a6bcd0c5f98d360704173be33777e4905
- MD5 3ead47f44293e18d66fb32259904197a
- SHA1 e61e88bd81c05d4678aeb2d62c75dee35a25d16b
- SHA512 927a134bdaec1c7c13d11e4044b30f7c45bbb23d5caf1756c2beada6507a69df0a2e6252ec28a913861e4924d1c766704f1036d7fc39c6ddb22e5eb81f3007f0
- SSDEEP 24576:rvqA5tAf7fM6xEV1rnF6SZT0kiSJN5H9tmGn7sL0h:eAvAfAAEV1rnFTZT0krlGW+Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\asw2efc970cff36ed9e.ini
- Size 1KB
- SHA256 71c1997aebc9f5cfcb5eef151442e72a74664419c6aa67e8db1bc913461194ac
- MD5 bc3fde2d98ad64731734ecf238a88e2f
- SHA1 faf8680a222b5b823f6777f7065f8d92d9974fe5
- SHA512 d2e6e72e1d1bc44ca57a4a6af5952fb195fbd74a6a75c7a258115337864c64d38a8673861baba82f9e637251bb9027ee81af50a0cbc1952db610fb2b12a33e9f
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\aswa340aa5190bb3985.ini
- Size 579B
- SHA256 766ef8ae49828d48be5ef8e3766b8a18d7007ebdc81af387c5494f12ab647922
- MD5 224edb3a3eb1168c0361d00ba2607325
- SHA1 db362e5b650adc967a68a8fb3a7ae1f4d86a49ba
- SHA512 afe3118ef39ff7c77370e6c7ab3b876b3ac75a05f68fda5df1501e16d1002be1ee5b18009d21b76d9c88ff42cb52c2c21451715252eef58679dd360f39063ccc
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\avbugreport_x64_ais-d08.vpx
- Size 4.7MB
- SHA256 b1819bf1551be44e0f293f6b6ead1841aacb63ca3a9d90f1a31c9cb52f648c6e
- MD5 ebc2e21a31af7ba94c3a70db0caf23ad
- SHA1 36a25c19c6becbcf8e1c959458867f59cab774a3
- SHA512 e777fd82cf1d782e73dc8796c57ecb9be4ed09256af456190ae0e414de651226c3eb616ae4ec1c245e55934843dd85485e0594c0125e013c47b48d89fff5f739
- SSDEEP 49152:RML3H3ldwCj0Y1Jk3nGNzCC3fHwh1eyClUDsRBT5G39nJJn8Xz/2hMrtmm2rnIho:U4qCizUDYTEEHsI7YRsOc3WBN3iA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\avdump_x64_ais-d08.vpx
- Size 3.3MB
- SHA256 55ebd9dc7c26877a51e11722d3ea17f1afdf39a30aeda07ef6804659c34e54c4
- MD5 c339cfe0485edefebae496b088d41221
- SHA1 684e4fa30a601ef645293cc5a8b008bbc03b9483
- SHA512 c78b4735ed9184219f95a461e97a47d95b60f353ded28d692a72f9c3db2ead081b700731c8b673e8a1ca969519281d8e73cef449d5bb6bcfd282fcd2261f4a5d
- SSDEEP 49152:XnXksgX2MB1qbvLHBIs9Mr/uJ4aF9jzb4BuRKr6+bw9reOrtPtxlCt6+0rGycT+5:XnUs6GvbFeBY+04ZObo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\config.def
- Size 18KB
- SHA256 b64d1d23aef5cdeeb2279216a00c931b201bce90407c9cbff3a7ef2742873878
- MD5 b86dd14aadb9e34d004ad39a4693ced0
- SHA1 1cb7775cee3e4106b2ddba89a0ccdc9dd547c521
- SHA512 03cb9215521da45e1df7b926fad7b0afd5ee001944c475a90c8646d7621d0d062267a682e102d81da0b5204ed215ec6ba4c7646d9340d71b0cb77ca12ddef0c1
- SSDEEP 384:Dw9+eXHtHoV2gsJi0JeTJ3p+iG1srr7dlRD3eOA5ohJAT:O+e9HBJiRJBWwzD3eF5oTAT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\config.def
- Size 18KB
- SHA256 2ad35455993e3ac3974998b6bcf773ca04ff9af3a278cc703ee6e39e66b7e19a
- MD5 184622feb380b6f79038acd6e7784068
- SHA1 3a7bf1ac6fd9e5e75432611b33c4a2fd1abd509d
- SHA512 ebdd3417a4828716b20e043627dee700f12924d9bfe041fc018676c3396e833d9257139739ae6aafc8fdb113cdb9e29e60cea169761d3a941428dc93ce67426d
- SSDEEP 384:D19+eXHtHaV2gjJi0JNTJ3p+oG1Crr7dlTEq3eOA8okoAa:T+e9HmJi0J7WiJEq3eF8o3Aa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\config.def
- Size 24KB
- SHA256 83d74d9847c39cd432d06092eb32f7a15bfadd9dbba9c6a857e8cd37180f5b99
- MD5 b8d39952a74700aada572fd98619405f
- SHA1 6acb3e609099cef5a99dad335431555512504645
- SHA512 978640b45c379ce9aaa3dbe7439aa33a3aa2e3cab9f96b2bf54deb0963dba0d54de128f3a7e9236a735d8d6f78e22a43efc242c7ad7d103ef06fe550013a1f32
- SSDEEP 768:pKutTkpty9HmJiHD4Z3BWiqEq3ee8owkKa:1QQceD4Pja
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\config.ini
- Size 676B
- SHA256 938f66d4302b59d2987fdbcae028bda9fd8a4388dee0e9e642a7981cb3cc7c19
- MD5 014e6613750f2974ed78beaac3361c2b
- SHA1 4f3b9a84f1208b7234f15b2f4d889f43169a91ca
- SHA512 b17e61c94a8eb4568350a8bb25b88f13f16f2d81e4309e7d6d2d81b70bbc0f0aecfc39751ae78a3d4c0dae87788eb973bd4c7d2f2b2d46b6ec2c5a9f1a4ca3e1
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\offertool_x64_ais-d08.vpx
- Size 2.3MB
- SHA256 0b7c3caa31928131ce0e1ca570aa72e20a98dda13e4ca0c59f31cc677d8e8c6e
- MD5 993a67fbd5162510a2b0f3fba05bad33
- SHA1 3c76258240a04c05341e611f55bef10341e34ff3
- SHA512 44a335d3db00fa9148066a5f2d2a9f5250d7df2315d132ab2798b02e2d21b700525a00be91d960e1564a6ffc0ee95347f0df9ffc27a10cf807d5a926ab5154a3
- SSDEEP 49152:fSfa0hggggM7QCpnouu2bhH+AvAfAAEV1rnFTZT0krlGW+T:f7jouu2bheAo7ELxTZT0krg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\part-jrog2-79.vpx
- Size 211B
- SHA256 ba1333f2355a7660001410efc8ae3e0b49d1600806272050883980889d6e250b
- MD5 aa442786f758e5ad442aea88d6cf6124
- SHA1 6c464722d20d261a155e2c5f6105cd8a4f0e5c21
- SHA512 add459ffec8fa3883a56a64fb0a34bf0c99fbda9e296e30911f2fee313626a68ba3e1d56671615b6250a9adfa8a6e07e76a86dab234500a03c60a07556a50e1f
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\part-prg_ais-18050d08.vpx
- Size 73KB
- SHA256 4b01a68078d7e1af1c0197baddbbb1ef4d3cbf13f71e8b9df766f88b4e6d8025
- MD5 d264bf74d7ffcbad341d9fcefa4893bb
- SHA1 c7e9a0972524fa573825865c46eb6728d3e219e0
- SHA512 afbfdf6fdeb5dc427340de691726e79cb5bcc41bd488c557c684efe3f26d83a17f1118cc50bd64541a9a839d3dd4329a72a9423e65d3e9cdcfbd14003f1e0dc3
- SSDEEP 1536:KqDyYjpqOSMR1P+p34KNFpeg3a9TcLajMZZk6PO8QuZgSHkOtghW:KcyYjpyE1PS344m9TcuwZKd8hSSH/GW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\part-setup_ais-18050d08.vpx
- Size 4KB
- SHA256 675bd92f752a51bd7d9797895252b3130095a06d7d5db8f221ab6251735ead8d
- MD5 0344288a18997069003d84c226a168f9
- SHA1 0fe47920601834e620737ad321fbb24d38c7ee94
- SHA512 b1680ef42d7e2e56fbb124c91da27f15e6c946450c7d03d95b937c3cde80dbc2260e11926578075df255058c2307058429fd2f7307fc0a105c775a9b8aa82429
- SSDEEP 96:Di32XtsARbaKlqcnkXgsl6omgbN34CvyiC5Fq7opedK02F7n:DnDRDNnkXg3o/lSz5F1yMFj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\part-vps_windows-24061199.vpx
- Size 7KB
- SHA256 60cbcb938b4d06ec162bb2379fe94f0f22cac8927ea5740cb52260809c5ef50a
- MD5 91760dd268918f34d5035b70231c6662
- SHA1 c244a869726ab00bc674ea81970ddc739f240426
- SHA512 30f015fc4cb040e617caff7545290b7add9ce500a2bf10a72d53eed64b0972754e4a5dc1296b50b06f286a473950b21c3bec9fadbe9733942d59542ec19175d6
- SSDEEP 192:0eNSKpbXNBnYDohQj8rLTJe4VqA5LOcA0x+tcVCD:BzVzYX8X1e4QAdDgacD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\prod-pgm.vpx
- Size 572B
- SHA256 846f9f2f624c8a1f001a4bd7c7ca3158c8c79cb11fa6d474cfdf8e48d0238a3f
- MD5 6d08ac0131cac7a2f9f2ea5d9d0b0cc6
- SHA1 25983c1419089c6a7570963dda2d06e022b3b36d
- SHA512 753890f34fc1a925177a594c8bc5e19dc509fb8b32c1eef429496c5d19421200bdd75879c529981823340718bee82dafdf3f262a9ecf65de9ef03d12a1684b2c
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\prod-vps.vpx
- Size 343B
- SHA256 52e06087d9c0968150bc5d3b06895e3ab9b69aebea20e0328434b703aa242099
- MD5 b516373c4f4f0bd98bbbcd71b4022e4d
- SHA1 fb2ccdcbec8ddcd91f35fd762dd86a5b2cb8e062
- SHA512 b1ef7ffd12b104a3caf8676c95285693c2af057537df0e87a292cea51bddf34be3ff00adae1337ecede93a8de9bb9ee71c464920f9f54c7bf3236d74aae98469
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\prod-vps.vpx
- Size 340B
- SHA256 b5992d7f4f9cfbd8c06d0b40110f296e70a7b804e581553d120d22146efdfc92
- MD5 a6aa5195417c52019dac2ea520161d70
- SHA1 3867f26e50214fbef5698dcea3840ba6c35ab23b
- SHA512 6986e715d9adf1142d965f0b8d0ec99915537015cb95ea14b9565f0aab3f2fde6c36ef06d760c8c32e0ad452419edcce0695eee5397f97afed3a28e75f25fc50
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\servers.def
- Size 27KB
- SHA256 1fc616dd97e72451eda1324979f65df6af823aaaee1c83e5c2c3f3308cd26a67
- MD5 2b62fb1ecd174c7e951f2b8af502c1c0
- SHA1 90744a9355dd5b74d2ecc7ee34fccbeca1c18f1b
- SHA512 0f14fbab88469ed19cde8d54ad74276ae4b03a783bf99def2d0f4d655a6ff86a35aa7ce4e8a7dcb936c70789efc4714b9bf1b317e485a6a44f150be6792cd7a0
- SSDEEP 768:29I3IeFiYOqys6nt6HfW5PcmRAOhbu7+ts4rE1qvKlWsT:ZFiY1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\servers.def.vpx
- Size 1KB
- SHA256 e1b5e5122457b19ad5175b0b372d6d0b55813503827ad1d84c26f23b8506a66d
- MD5 ca027a5ef5f6d21d7e42855fa4db4120
- SHA1 eee669fe1c3cabd5f96c65ac992e4851f8eca9da
- SHA512 8dcd63d2406f6f7e67053342553345bb372401a8dda64e1b41e937df7359a8e4c0afa9705d8fbb953aeed403d54bcd6a5d5bddf7ca1d6c43f1da37020bdda491
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\setup.def
- Size 38KB
- SHA256 0b9aedce74468150c054d27649dad8f98109e537a581649be6668a13cd29e6a7
- MD5 49474897d267894daa13e9dcb168793d
- SHA1 10331de148bb89ecc6e1af25bd3b0a862dd2b4eb
- SHA512 687dfcfdff27d8be7fa2b7a277a6bd269bf719ca12bf5e7f38643582785032cb8b0e11c04180736dfa56c2b10a12e10c10e50427ceacf6d6332125ebf65eb9da
- SSDEEP 384:KdvwY8ZysnOBuUBLCtzmW5qU2yhsI1uvMYYBjBuyvFKCt/ITPG5EDXO:HSK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\uat64.dll
- Size 29KB
- SHA256 5a690ef46a5c889adbad580b773a6025040426ee11d3817927dd1e77698e8ece
- MD5 c53dc6d8050e08d12939b95e2f5c53dc
- SHA1 01f3fd1a4c730cad939d243e6bb8f9fe8f1e0138
- SHA512 75ec453cfa12a071322877db4244746de6ecec779c4f267cb3b9729437f3e0a90ffa2fe1d42e5baf05c159c8c6ef6c71bc7e258044162e5fcbaad10a9e93d84a
- SSDEEP 768:LyxCUKKBcns+DZgqsQpwNGMYiiZfAMxkE:LoEsxvQaNR7Q/x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.5c3f8b203c0cc8be\uat64.vpx
- Size 16KB
- SHA256 bf60d1aa67abc73f927e1544ba8b66a79ec9143caedb15e1d94d023be6aba036
- MD5 bd33707a5e0b6cc434fbaa32e69cb30a
- SHA1 34ddc8fbda6acef9e07de571d4c00e65e3c09958
- SHA512 02b78b7796e55e245d00ae5b94ae767c6c7da480ec609e84b1a4deafb5f6dbb8f15ad5947b3db421048e17d46419b2149ef23aa369ce42288d3bb5817a0863de
- SSDEEP 384:mfh7yrvtygz0z+yW/Qn25LOkuxZ2lu5IU+HjMQJhu:mJUzll5LhuDl5v1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.b2b26fe5f5e2ae86\avg_antivirus_free_setup_x64.exe
- Size 9.5MB
- SHA256 47cee4d44e8fe27f3229fa751c11259227a00b605d6a42e2cb066f100a9049c3
- MD5 72c1cad77d7a37f6eed6606b00b22738
- SHA1 1883d039f42ead5318de8f5f37b61bad4b61fa72
- SHA512 87104f2cf47683f113398e71b795fbeadd6835b5d333e1aedf22e7d3afec7de3e138cbc949947235ff4892489caaf219405832df91885084e361806ac22d0209
- SSDEEP 196608:UbX7+wgrimZ+k8DJ6JaUsPs7qK72ry4jIFceON2QmXMinwaGTOU:aX7+ZNt8UsP6H72ryonF3yMinn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\asw.b2b26fe5f5e2ae86\ecoo.edat
- Size 37B
- SHA256 928cc7649fe1d3acd42918fad923b05c49f9c199e267b41c6677333fe7bd9f90
- MD5 064440e52aabb1cb54770e83f7c19aa4
- SHA1 b1cf62543ef56eb279f9b49948cb702730de4f74
- SHA512 4b1d377f22f7cb24a8b1c02fa0b3f5b7b185d24f728f9e026eb87c0e208c8c696e47a7cb0088818777cf3ea578c7121d362864a07ef1e46b7ff6887cc3349ec7
- MD5 SHA1 SHA512