Overview

overview

8

Static

static

3

winprofile

windows7-x64

8

winprofile

windows10-1703-x64

8

Analysis

  • max time kernel
    300s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20-06-2024 23:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dbcc4dfa51f18c523ea677699a0399dcf0c7551492800835587c1cec7848c3b1.exe

  • Size

    5.8MB

  • MD5

    13b3860a2827e505cb6de1418f640b16

  • SHA1

    d48f434491b197234337d6751166ac539e9dc650

  • SHA256

    dbcc4dfa51f18c523ea677699a0399dcf0c7551492800835587c1cec7848c3b1

  • SHA512

    1a3e74879ecf8ea503d56a871eb8a526dbd3e145521b0ca21530b58e30c566ea64bc4ca2991ac16a975341e888357f40ab76912f1c684fbcd2226f280bca1f63

  • SSDEEP

    98304:1ALz1JdBgUZrjJeVcqdYwyQ50Fk8ou3xUEBS9/RZJUGXjZvYHiUYDt:1AzPzgUZrt54Yj20Fk8oLEBSZRfUGT6I

Score
8/10
bootkitdiscoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\dbcc4dfa51f18c523ea677699a0399dcf0c7551492800835587c1cec7848c3b1.exe
    "C:\Users\Admin\AppData\Local\Temp\dbcc4dfa51f18c523ea677699a0399dcf0c7551492800835587c1cec7848c3b1.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks for any installed AV software in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Users\Admin\AppData\Local\Temp\aj6D82.exe
      "C:\Users\Admin\AppData\Local\Temp\aj6D82.exe" /relaunch=8 /was_elevated=1 /tagdata
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Checks whether UAC is enabled
      • Writes to the Master Boot Record (MBR)
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3344
      • C:\Users\Admin\AppData\Local\Temp\nsv6F65.tmp\AVGBrowserUpdateSetup.exe
        AVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dedge --import-cookies --auto-launch-chrome"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3180
        • C:\Program Files (x86)\GUM7A8F.tmp\AVGBrowserUpdate.exe
          "C:\Program Files (x86)\GUM7A8F.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dedge --import-cookies --auto-launch-chrome"
          4⤵
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • Drops file in Program Files directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1988
          • C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
            "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4260
          • C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
            "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:768
            • C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:2516
            • C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:1264
            • C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:3860
          • C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
            "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezI3M0M0NUM4LUM5NTktNEQzNi05MUQ0LTMxNTE0REE1MjMzRn0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9InsxODVDQ0FDRC0xNzNDLTRGNTctOThCOC05REEwMzQzMEU0MDZ9IiB1c2VyaWRfZGF0ZT0iMjAyNDA2MjAiIG1hY2hpbmVpZD0iezAwMDA1OEQ0LUIyN0EtMDEyQi05RTNFLTQ1NDE0NzFFNkM2OX0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDYyMCIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9IntFQ0I0RDBEQS1GNjM1LTQ1QzEtQTkzNi1FRTgzRkYyQUM3RTd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTUwNjMuMCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTI0OSIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNjg4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2352
          • C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
            "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dedge --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{273C45C8-C959-4D36-91D4-31514DA5233F}" /silent
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2468
      • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        AVGBrowser.exe --heartbeat --install --create-profile
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks for any installed AV software in registry
        • Writes to the Master Boot Record (MBR)
        • Checks SCSI registry key(s)
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1460
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=125.0.25426.176 --initial-client-data=0xe0,0xe4,0xe8,0xbc,0xec,0x7fff891f1c40,0x7fff891f1c4c,0x7fff891f1c58
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:648
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2020,i,6563554347983041096,13053199558011958096,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4144
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1728,i,6563554347983041096,13053199558011958096,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3312
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2196,i,6563554347983041096,13053199558011958096,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:784
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3328,i,6563554347983041096,13053199558011958096,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:360
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3316,i,6563554347983041096,13053199558011958096,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2376
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3340,i,6563554347983041096,13053199558011958096,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3676
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --field-trial-handle=3388,i,6563554347983041096,13053199558011958096,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2512
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3856,i,6563554347983041096,13053199558011958096,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2004
      • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        AVGBrowser.exe --silent-launch
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks for any installed AV software in registry
        • Writes to the Master Boot Record (MBR)
        • Checks SCSI registry key(s)
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:352
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=125.0.25426.176 --initial-client-data=0xdc,0xe0,0xe4,0xb8,0xe8,0x7fff891f1c40,0x7fff891f1c4c,0x7fff891f1c58
          4⤵
          • Executes dropped EXE
          PID:4484
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2072,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
          4⤵
          • Executes dropped EXE
          PID:1876
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1796,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
          4⤵
          • Executes dropped EXE
          PID:4300
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=1836,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:1604
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=2708,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:3360
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3168,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:216
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3388,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:3076
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3412,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5056
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=2704,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4492
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3624,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4148
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=3420,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2680
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3628,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4612
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=3380,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:3604
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3852,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4956
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=3856,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4108
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3860,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4952
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=3408,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4256
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3584,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2384
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=3568,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2308
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=4008,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5080
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4040,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2584
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=4044,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2928
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=3532,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2400
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=3472,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:876
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3612,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2992
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=3824,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:380
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4144,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2492
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3640,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4732
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=4072,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2792
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=4952,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4956
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3652,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5028
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4124,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:592
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4800,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5356
        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=5408,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
          4⤵
            PID:2984
          • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
            "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4960,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
            4⤵
              PID:5700
            • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
              "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=4964,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
              4⤵
                PID:5440
              • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5976,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
                4⤵
                  PID:5468
                • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=4956,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
                  4⤵
                    PID:5592
                  • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                    "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6124,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
                    4⤵
                      PID:3552
                    • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                      "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6428,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
                      4⤵
                        PID:2532
                      • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5996,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=1064 /prefetch:8
                        4⤵
                          PID:5756
                        • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                          "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect
                          4⤵
                            PID:2660
                            • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                              "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=125.0.25426.176 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff891f1c40,0x7fff891f1c4c,0x7fff891f1c58
                              5⤵
                                PID:4960
                              • C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe
                                "C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe" --registration reg-task --taskintr PT10M --runonce
                                5⤵
                                  PID:4652
                              • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --field-trial-handle=6424,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
                                4⤵
                                  PID:1400
                                • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --field-trial-handle=6056,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
                                  4⤵
                                    PID:700
                                  • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                    "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --field-trial-handle=4936,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
                                    4⤵
                                      PID:3724
                                    • C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                      "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --field-trial-handle=6464,i,10458281021252099111,10163904265279943462,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
                                      4⤵
                                        PID:5764
                                • C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                  "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Writes to the Master Boot Record (MBR)
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of WriteProcessMemory
                                  PID:1848
                                  • C:\Program Files (x86)\AVG\Browser\Update\Install\{2FED1C2C-A30D-4D95-BA67-68A0E8DBA0B8}\AVGBrowserInstaller.exe
                                    "C:\Program Files (x86)\AVG\Browser\Update\Install\{2FED1C2C-A30D-4D95-BA67-68A0E8DBA0B8}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=edge --import-cookies --auto-launch-chrome --system-level
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:2896
                                    • C:\Program Files (x86)\AVG\Browser\Update\Install\{2FED1C2C-A30D-4D95-BA67-68A0E8DBA0B8}\CR_18B66.tmp\setup.exe
                                      "C:\Program Files (x86)\AVG\Browser\Update\Install\{2FED1C2C-A30D-4D95-BA67-68A0E8DBA0B8}\CR_18B66.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{2FED1C2C-A30D-4D95-BA67-68A0E8DBA0B8}\CR_18B66.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=edge --import-cookies --auto-launch-chrome --system-level
                                      3⤵
                                      • Boot or Logon Autostart Execution: Active Setup
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:4084
                                      • C:\Program Files (x86)\AVG\Browser\Update\Install\{2FED1C2C-A30D-4D95-BA67-68A0E8DBA0B8}\CR_18B66.tmp\setup.exe
                                        "C:\Program Files (x86)\AVG\Browser\Update\Install\{2FED1C2C-A30D-4D95-BA67-68A0E8DBA0B8}\CR_18B66.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=125.0.25426.176 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff7dd485390,0x7ff7dd48539c,0x7ff7dd4853a8
                                        4⤵
                                        • Executes dropped EXE
                                        PID:1308
                                  • C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe
                                    "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:5064
                                  • C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe
                                    "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:596
                                • C:\Program Files\AVG\Browser\Application\125.0.25426.176\elevation_service.exe
                                  "C:\Program Files\AVG\Browser\Application\125.0.25426.176\elevation_service.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:4260
                                • C:\Program Files\AVG\Browser\Application\125.0.25426.176\elevation_service.exe
                                  "C:\Program Files\AVG\Browser\Application\125.0.25426.176\elevation_service.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:2504
                                • C:\Program Files\AVG\Browser\Application\125.0.25426.176\elevation_service.exe
                                  "C:\Program Files\AVG\Browser\Application\125.0.25426.176\elevation_service.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:2616
                                • C:\Program Files\AVG\Browser\Application\125.0.25426.176\elevation_service.exe
                                  "C:\Program Files\AVG\Browser\Application\125.0.25426.176\elevation_service.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:620
                                • \??\c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
                                  1⤵
                                    PID:4112
                                  • \??\c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
                                    1⤵
                                      PID:2992
                                    • \??\c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc
                                      1⤵
                                      • Modifies data under HKEY_USERS
                                      PID:5160

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Active Setup

                                    1
                                    T1547.014

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Event Triggered Execution

                                    2
                                    T1546

                                    Component Object Model Hijacking

                                    1
                                    T1546.015

                                    Image File Execution Options Injection

                                    1
                                    T1546.012

                                    Pre-OS Boot

                                    1
                                    T1542

                                    Bootkit

                                    1
                                    T1542.003

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Active Setup

                                    1
                                    T1547.014

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Event Triggered Execution

                                    2
                                    T1546

                                    Component Object Model Hijacking

                                    1
                                    T1546.015

                                    Image File Execution Options Injection

                                    1
                                    T1546.012

                                    Defense Evasion

                                    Modify Registry

                                    3
                                    T1112

                                    Pre-OS Boot

                                    1
                                    T1542

                                    Bootkit

                                    1
                                    T1542.003

                                    Credential Access

                                    Unsecured Credentials

                                    1
                                    T1552

                                    Credentials In Files

                                    1
                                    T1552.001

                                    Discovery

                                    Peripheral Device Discovery

                                    1
                                    T1120

                                    Query Registry

                                    5
                                    T1012

                                    Software Discovery

                                    1
                                    T1518

                                    Security Software Discovery

                                    1
                                    T1518.001

                                    System Information Discovery

                                    5
                                    T1082

                                    Lateral Movement

                                    Collection

                                    Data from Local System

                                    1
                                    T1005

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Program Files (x86)\GUM7A8F.tmp\AVGBrowserCrashHandler.exe
                                      Filesize

                                      149KB

                                      MD5

                                      f73e60370efe16a6d985e564275612da

                                      SHA1

                                      2f829a0a611ac7add51a6bc50569e75181cdfd58

                                      SHA256

                                      9cf076866935a0c64366efaeff2ec76d45ac816030ebd616fd5defb1870bc30e

                                      SHA512

                                      2e44e87c285bb7b72d45c8119d08ea6f2d13cea77cf0005a3cf530790bb86c7f2df7c5edac9d86c9d7214abb224738c3bf6b31f6bf104051512bb1de133042dc

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\AVGBrowserCrashHandler64.exe
                                      Filesize

                                      170KB

                                      MD5

                                      deef1e7382d212cd403431727be417a5

                                      SHA1

                                      fac0e754a5734dd5e9602a0327a66e313f7473bb

                                      SHA256

                                      7d410e9eabd086827b16c89ee953a643c3e2f7929616c0af579253fd8ca60088

                                      SHA512

                                      6b472a57fb89b128aad9ab6313a9ce8b171f7d73264c67f669adc5cf1f0421d81f654dad1419b620476abb59dd54e1aa03a74a26c5c93813f6fb8575fbd97d4d

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\AVGBrowserUpdate.exe
                                      Filesize

                                      204KB

                                      MD5

                                      cbcdf56c8a2788ed761ad3178e2d6e9c

                                      SHA1

                                      bdee21667760bc0df3046d6073a05d779fdc82cb

                                      SHA256

                                      e9265a40e5ee5302e8e225ea39a67d452eaac20370f8b2828340ba079abbbfd3

                                      SHA512

                                      5f68e7dffdd3424e0eb2e5cd3d05f8b6ba497aab9408702505341b2c89f265ebb4f9177611d51b9a56629a564431421f3ecb8b25eb08fb2c54dfeddecb9e9f2e

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\AVGBrowserUpdateComRegisterShell64.exe
                                      Filesize

                                      428KB

                                      MD5

                                      2a3ad7362e6c8808fbb4d4ccaba4ed4a

                                      SHA1

                                      3f896f7df7fe202f4a717713c503665bb4dcaed6

                                      SHA256

                                      4dcd341907880c8dea840819628b19c5ea42ca2b5c61ad57147d0ac7da9b6759

                                      SHA512

                                      892042ac713e4d5b488262a584355dafa18d967035788799c1773eb39a4616461beb9d79a230d9f85cdefd1b4076b8a5e1d4bde17254bff1f08c3eba56469679

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\AVGBrowserUpdateCore.exe
                                      Filesize

                                      512KB

                                      MD5

                                      dd5dc945cd848bf503862d0a68c3ea5d

                                      SHA1

                                      9b277a0c733ed5698b0656da8c3b99d2f90c7ef8

                                      SHA256

                                      8cc98345e367b083f545ace66d93bf69e03a4fa08b84805a9925fa4c94ef3f8f

                                      SHA512

                                      f6eab8422bde24d89a7723c6175b4197a50e18aa0bb5b8f419e5a23b265d85dcaacaf136b8f6ef6bbf2bd6c0eaecd8f86093f594fb98e596f4b39e9c6ff227e1

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdate.dll
                                      Filesize

                                      1.4MB

                                      MD5

                                      04a6438c50564146e880c5eb9d57905e

                                      SHA1

                                      edf5d454de99159d832cc9bd0d8dbe132d749804

                                      SHA256

                                      26109d47bf9960e531888e6c545ca8cfc24fee2202b549df29fb8bf9c58e0812

                                      SHA512

                                      8705d0ab2f8a6c1ef567ad00b33ff2cca01391b105eb0ade201d981f091e4ba87e709860ab9849bf9781698fb42ab8efe53ea731af310781766bace1eb1dc19d

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_am.dll
                                      Filesize

                                      42KB

                                      MD5

                                      ba03b29d5d44341084eb06bea8f1e702

                                      SHA1

                                      7d8dd7556ea5e299b55ddc7477ca758fe2c64f48

                                      SHA256

                                      6a6aad33e2910c29a6d919aad074d89359c5e6723ced7ba4e215a62e9513749b

                                      SHA512

                                      29f902587b7078deb12bee6bf9993748109749ec12e6490d5f84bc9c532a5a1f414149d5760641ef052611bf2d441423d115dfb5a4c4c6f5e6d6a1f386924cf2

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_ar.dll
                                      Filesize

                                      41KB

                                      MD5

                                      9c77be0843f0fe4864a04f8d5f24a593

                                      SHA1

                                      be03adb4d3c33520e652c7a6ee45f09d5ff54a54

                                      SHA256

                                      39547fa5d7b93856235288b1021699b4f36f0bea10b10d6b89ea184a3ad77bb1

                                      SHA512

                                      f504c98b03a5d72c078b38a2cc4fdd94dbed159f5a2ed47c2c4a53fc6ec8a3b1fd969d5ad85fc7503e64427a36adee7a14f15f1275a9194103e43c8a8ee45d28

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_bg.dll
                                      Filesize

                                      44KB

                                      MD5

                                      c0b41217fc33a6a53ec69ae7399460f2

                                      SHA1

                                      d7dd8d543b7297f1a1e138efa1806972c9489c3f

                                      SHA256

                                      d75a1a41ad7e5277576e3bdf35a858be3a6f540d21c8ab4156c842d8f1b3295b

                                      SHA512

                                      37abb726b78421aaccdbc94b358cda6b581e89ac519258eb39c6a7f0706cfc64c3a96f5c29539ba67c6e2d2afd6f10b6b0c063b54366c03376ce234d132a8253

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_bn.dll
                                      Filesize

                                      44KB

                                      MD5

                                      aedf6d96ccb64f488379bb1fe65f697a

                                      SHA1

                                      901bbb7873d8f698f49c4b6be74fb50b353d7b5e

                                      SHA256

                                      941d22186ef1bfe27052e78d21944d6088cea152d1ede51452f04fb032c92f90

                                      SHA512

                                      d1d889a1fe75924f3569e07d9ee3f552afc02165210f5c439d4697be898b72db397bb89e7d0706259f92c1cb5759009f9e1ba5c52f764e63514b3da41dada1cc

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_ca.dll
                                      Filesize

                                      44KB

                                      MD5

                                      f951cf3ca93e5ae5fc1ce2da93121d98

                                      SHA1

                                      15bc869406857437babe41cd3f500c356913499b

                                      SHA256

                                      eb00cad19ed1d16f52928962f2cc6231d65eb74b2314976ebeb1ec860103e746

                                      SHA512

                                      b77086ad2b39723d697d7839d9243c1c0769a2cb0f6287cd3f2d64eabd6a48d8fc2d253e9089c6586637ed5dc5970c2608615fe77cef5003f0c4d53401ef73bc

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_cs.dll
                                      Filesize

                                      43KB

                                      MD5

                                      7f3dcd851645d3d75f636c8440fb057f

                                      SHA1

                                      85debe41ddcb46555a0d00795e41e460a35583c2

                                      SHA256

                                      0b31785d1931580cad5ef16d4ff5723802d12c38b56746e70fcf91d71162e043

                                      SHA512

                                      d0d21c397899aaa6a718b77195a6af1556309615616fd6583ecb84b04aa7087e76eb5fdd6cae0a4ff1c0f85bf72e1f51ae002042078095f640eb95da363889e4

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_da.dll
                                      Filesize

                                      43KB

                                      MD5

                                      9a421423686559027e4301d36bcf58b2

                                      SHA1

                                      9669424f4e7c765ddb917a515d5a8b1486f87daf

                                      SHA256

                                      9d8ff148793d99974fab93f38027e1999323a48620b303f82170751be5dd6b69

                                      SHA512

                                      f5d62fe17a820323c4b1832cd3bd9c8fa291d44dceb88a8a1a8f94c6166e550ab9baf9357c5ec3388230bc75f0ccd3aa2d5247fa5d242013d22c61001128a951

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_de.dll
                                      Filesize

                                      45KB

                                      MD5

                                      1c15851d9dd22e4ae3f3bf249da79035

                                      SHA1

                                      60fc5652b5e1c55056c961d4d3b961492cb3432b

                                      SHA256

                                      a9dd72a08c0c58a71b2289d76efae681a5c8eb5faf73e49b873f15ba4050baa6

                                      SHA512

                                      6da386c35b317f39613da73340631f927606bccd0a8c626537eda896eb32c9a2ed1d71c7cf838f1a4b90553f3f788eeb5e02fe84774fb0ad2f574bf4e4d7e248

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_el.dll
                                      Filesize

                                      45KB

                                      MD5

                                      0d15748f01df49dae986f1e27dc098ef

                                      SHA1

                                      35a435bdaaf47795977b28cdae2e4ea1fdae73a3

                                      SHA256

                                      df13c38061cb0b02dd8a9023a17da0bbe1cda6fdedad5203129fc702c7fdd9b1

                                      SHA512

                                      290e9936f50e3bd11c1b9d28decf3b43f5e23bbff16801e7b0491690773d057b6bcdcf48c48a7ee16fa2400723b3e974e2b74e3899590a8e660c2e9c78b9d141

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_en-GB.dll
                                      Filesize

                                      43KB

                                      MD5

                                      02465169cd873c4492196e03457f2771

                                      SHA1

                                      837ca5e54a8c12577d0d05a32996dfc04067c5ea

                                      SHA256

                                      4eb9edf550bf1f66382e5d8bd4958438891cd2ca46557d14f4b945dc176ec025

                                      SHA512

                                      e73b5f3951050f2903b80b89d2b9fd9ebf69adb922eb8238ef4c01f413ae67727d7598d4ac15f7ac8b9257aef0139e0924c70c5898357142a303d7e2b15394c3

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_en.dll
                                      Filesize

                                      42KB

                                      MD5

                                      418853fe486d8c021d0cca2e85a63d63

                                      SHA1

                                      9504500a7b5076579d74c23294df4bdb1b7c517d

                                      SHA256

                                      4cbb2591c1eeda32bcf295685c993ce4d16acc968697fa12e2a00a1b7c4b37a3

                                      SHA512

                                      dc2ab4e2056e6d73a274d700bc16f75c7c687b35874029c1908b183428dec010373045d4a52eb3f5745f8b91d624cf5d40cd7f37e353f3a41348e2a054a266a3

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_es-419.dll
                                      Filesize

                                      44KB

                                      MD5

                                      3e5971e8559c77e8901ce30d14034730

                                      SHA1

                                      04cc21ac4a84abd29f7d7585282345881fd81721

                                      SHA256

                                      613418b8779f7440b88f1734d6c514706df9dc9a58a623966cc1c9ba4e29c28f

                                      SHA512

                                      b4592b25cf676db6d6de1be811c39bdeecc24bbfd4dc72fa4b3f97de866f9b0fec7c85f7d56f048f61829c1d8b4109e4a0c7e14a9e410e30a6a8da702941e00e

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_es.dll
                                      Filesize

                                      45KB

                                      MD5

                                      5f8ea18786d5ef1927cd95537abc3ae0

                                      SHA1

                                      5530650ecc719d83b7aa89e0b326b5698e8adda2

                                      SHA256

                                      fa416294b078226a8919dbb8f75533a6ef96d63d5bd17aac854eae68791433cf

                                      SHA512

                                      577dc7d19e4443e8aede759a781826c091c17d12fb06e89b1306133f21e01dab919045183a916e1b5647ddf485134a8459745a9199df5c7e36abe192645d8e25

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_et.dll
                                      Filesize

                                      43KB

                                      MD5

                                      5029406d9202d6f2f279fdd3a06f55a1

                                      SHA1

                                      dcca8bf9392faa0038c6cb5d25929726b16804af

                                      SHA256

                                      cac545e04d701c39f4a730aec4c3dad177d8ea4baca10651f150925644874864

                                      SHA512

                                      519538e05f8e21966e4878291692cf25057bba3c993c0034a33b1da7c9eb0a8fb881565717ceb6c1139fd601b73b1f1e2aa46e20aeb6b93f897cd2ef93172934

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_fa.dll
                                      Filesize

                                      42KB

                                      MD5

                                      8564514501256ff045cf7aa6c1b5a797

                                      SHA1

                                      40b9aa8d04c48fe2ecf193c2089418ccc938676d

                                      SHA256

                                      f3f46a6da6c8ccb3ce7fdd0cb5882f45523decca95852b8c775bb90f8e92c1b3

                                      SHA512

                                      701077c8a1c70c1bd0c35f54aa838dba7b7b6f832e0ef2776673092fca546276166c3638676451c9655086b740b9e193cd54f952fd5fca481b964083b881bcc2

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_fi.dll
                                      Filesize

                                      43KB

                                      MD5

                                      57dad7c22bd635a5af8fcdcd63d4e530

                                      SHA1

                                      8aa11ea5c1cacd9b23c29989f22e82c43c827d0e

                                      SHA256

                                      1e0d05927a455115265db9308e0f78ffb7bbb5442f36b8483549efbe415454a2

                                      SHA512

                                      4236609e37ec41bf46d0f45e228c9021c1624e2f98a642eab513d290a4482da13764fcc2d044f78ebdc09e0cfc63a251678d169cb33e251d6f6d5de9b96c31b6

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_fil.dll
                                      Filesize

                                      44KB

                                      MD5

                                      5ed0105f4043466a99557dde1f70e97f

                                      SHA1

                                      c57c935cc4b25b6375ab3fcdfbb265f4c586ec3e

                                      SHA256

                                      cfbe0120ddf8d5574f7c44c85488f53aecec4df9bfb25f1cefbabcad5af46096

                                      SHA512

                                      4fa641810f758e0031388ec146467fc130780e2f2cc8495b6a2fff0679d7bcbe7526356f85a97b5338e84d791ba14e812b2c182fdae01763640be3324fb59526

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_fr.dll
                                      Filesize

                                      45KB

                                      MD5

                                      8ddc3f7276c12ac407cadcda6e2a3e12

                                      SHA1

                                      78c5e802f67c8b6ae3fe13202e6a54d3cca69df4

                                      SHA256

                                      7f2f0f9f443a022f5aedacc40c28d0654fec488f34435c75979118464256a8b7

                                      SHA512

                                      0d05bdd2d5e9f36eb09182e8b13507ba03e256c4aadb77bbfedf29584a47fd1e0733a825a3f687d3058e53c8075caf6dd9d24ec93f1bdd58ca97106827323540

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_gu.dll
                                      Filesize

                                      45KB

                                      MD5

                                      a4061e8408cc59cb898adfdc4f173278

                                      SHA1

                                      ae34e3058a40449481590bb3a63aa0225b4f6f98

                                      SHA256

                                      e033c950ecc6333dfcb944e70622e77a6498ba0e23fd144117dbe9a2a0c15be6

                                      SHA512

                                      d8a847e9a21c86c7b9b072e16914f42185e3c0e1d99f6ea5259382eb0fb89578c7a7f9f62f892f1d20be180dfc327bc076ea038057895c8b92cb1f0c053e0b2a

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_hi.dll
                                      Filesize

                                      43KB

                                      MD5

                                      38525b8a1b15a8aeb4fcfc8bee8358bc

                                      SHA1

                                      ac2ba33b8ad778a8165c87b579dad0dbef5bed75

                                      SHA256

                                      271e83bc86e490cd5b6cb9cb34057c7684d233c56a53f4f553aa07507c9dae52

                                      SHA512

                                      ad8df196174ceeadce4588dcd365066665267b922078d92b328ba661a4ebfa6d06b4263a4b8a28e4efb4d86e1140d71a3c3bf4b7b60970aa20552aa7f0c73acb

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_hr.dll
                                      Filesize

                                      44KB

                                      MD5

                                      27c0dbd61a71420bb4d1a0be2373a175

                                      SHA1

                                      47b4c107b711caf5a6b2978bd6fd6b53ebdec5e3

                                      SHA256

                                      43191a4c507a112e96e06f959b6cf78406bf970b021ad8d7db59d1b9c52779bd

                                      SHA512

                                      d1f20e9a628bdcbd26b8d5de89b87bdbc8dab871651c86d47c023daea86c7ada0a565fdd05b48c7643a63db044639f4eb89d1640e58c9b32722e4926c3c5e72a

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_hu.dll
                                      Filesize

                                      44KB

                                      MD5

                                      114cc594fab2e564ccb24a826f3623e4

                                      SHA1

                                      c3c3fb4ef6ea6ff0e7a1e0289320b2fd2788b03b

                                      SHA256

                                      c89e223a42d7173f915dd088ebc84b0048cec772bd4221b4b90ce4c0e419ffe6

                                      SHA512

                                      9a7eb5710340cecb2d32de26322dc862812e185b6d260d76c0c7f642f30cf9e43c88aec76b515148ef986db0c77fd0e31f71c8fd26d56a4cc72dff0d023abb5d

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_id.dll
                                      Filesize

                                      43KB

                                      MD5

                                      7e7deef6ac35c9d52410fc356391c7e4

                                      SHA1

                                      43b3d918867a93ba109a3e4eacb45f3cd5c40b93

                                      SHA256

                                      963f4d2ad7ddcdcfb6185521c0590a92f2014897d5f5f525471ac81f3807fc5e

                                      SHA512

                                      9eb0e9be0a973693b4bd167f6c1118dd9d702b1951a90f0a3a6103e77c43ee6afa173b79d3ab21fe94a98c320b17ab0b787cf5b6ec47d9dde9e3e8c14b8cadc7

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_is.dll
                                      Filesize

                                      43KB

                                      MD5

                                      dae35fa037b6248876347521c5298566

                                      SHA1

                                      8358fc05a675ea56f720052fbb4b384d97b94d86

                                      SHA256

                                      ce0652b8dfaf21b6192b66bf75e140b3d72aa545e0edf62d9e82e9b0878ac5c5

                                      SHA512

                                      4158b8fef0da76ead12b5d6e421c5709664ba84d1ddde44ef6bbd1023084cad3820a37abea03b206635a945a2435b301234cf5bac3c8e2861a852b2699036ade

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_it.dll
                                      Filesize

                                      45KB

                                      MD5

                                      3ae3106694098f8420b182ad5e3354ab

                                      SHA1

                                      bc9dab621b03d4126b97c260becd7f4525255462

                                      SHA256

                                      59b406b29538c3c3d0f060b5fc0ccd36556f8a6278327935a5475c6b21741dc9

                                      SHA512

                                      f3625be57976083d642b01a41a53d6db6cad3bfc584a50de3565fe10975a5d7d2cf4f8b41bcdaa5ac70f8fc4ada113084de07e2ed45f26401dc2d4f8f4c322a9

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_iw.dll
                                      Filesize

                                      41KB

                                      MD5

                                      31227325c8617b308ccd268c2be7e72a

                                      SHA1

                                      71e369f26e644e643fcd538d933e4087dd593f1f

                                      SHA256

                                      4a98e34a528eff04c2baf4e9e50489086e58d2e32e1851f33674abbe5e104c68

                                      SHA512

                                      ba8d94dde5b7b74a39ed54a5f3e47a558e0c1deb632018c82423c06806071143851bb1d8c7a7bada6f13e71734e7a29457f3741266972b777cded41c953a9645

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_ja.dll
                                      Filesize

                                      40KB

                                      MD5

                                      0cfc5b7b3f86d6bfaec9a0713da74df3

                                      SHA1

                                      81a278fdee9edc302fe4e7a88c9addb230ce6df2

                                      SHA256

                                      1d7fd1b6a614538530385e7a40efc95d3b8be75057ae03bf999aa2419d1f9f24

                                      SHA512

                                      8b8f834ccee41c69c581f0b80f26b0cdb536f87bebd5a6b1f02cdf6f1aea5cf5b29c356e82c7a8fd591bb16c0938a790ac8f90f6d27edc95fc48a5aa3c30cbf0

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_kn.dll
                                      Filesize

                                      45KB

                                      MD5

                                      49000b4a101e635b05123f21b360b492

                                      SHA1

                                      635f697f41c0591168e0eee10930728d9dec5a53

                                      SHA256

                                      a2aab58a4397c040bff69d45bef4ede6842034bf897799a9347232c4b6c9c7a5

                                      SHA512

                                      9b62c2048e9c132089cce7da02ea5c95b5856f1c6e28d5581f4a0b1748e681bdd78c7d537d273a64f9d476e4ec62da5c6021cc1ccb69f7bee216e7bec6ddc6e0

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_ko.dll
                                      Filesize

                                      39KB

                                      MD5

                                      dd2f783c0017630f9a2969957f4eb84e

                                      SHA1

                                      d42218de12a7c1c48fb5e7d60e61e32ce0cd9ac6

                                      SHA256

                                      07e63e0e3d23f192ac131efc459c2d9f79a4ecdc39403d43fbff320c4b5fa261

                                      SHA512

                                      689f625df8aec45a6343249739ec094cbb1245a9dd8847ffe6bf62fd2d7042d529f77216dd22e8b33830cf21b158f0ef6ea42af2248051c8d97205eb0229a22b

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_lt.dll
                                      Filesize

                                      43KB

                                      MD5

                                      38606bfb6c9bfdf74503f833ee2733e5

                                      SHA1

                                      670abd1279f642ec7b19f663e53f2813a716331f

                                      SHA256

                                      df6c4228da3bf66929d81b99cb35df4a4389418490144630e1d9d5f422b56b38

                                      SHA512

                                      6cc6f2fb0e5bf0241656cce5dc7311f05b8d79633f2176f8c172a9fcfa9813e3963576363d539fa1a8a58fa6bba138dd0baa7562274fbe99be5cda60f4671747

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_lv.dll
                                      Filesize

                                      44KB

                                      MD5

                                      83c356f6310d51f8ffc1d67d580f5914

                                      SHA1

                                      f9bc318975f288fa47e8426b4c450a93b10af45c

                                      SHA256

                                      98e35cea7cddce15191594a70f8e15ff2dd1c02bde87225af0331441c65bca26

                                      SHA512

                                      28a26cb1d88d072d7898ed27c3e9d056efedaa2cd9eccf951429f41df2c0162be3c14e58cfb4cf50b633d759825fa815a9249e7690d2ab75f60424b30dbe0424

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_ml.dll
                                      Filesize

                                      47KB

                                      MD5

                                      74e24332295807ca5ab8be9f37dd19dc

                                      SHA1

                                      82feee443e0c8342ef830c182fc2a3c98f57faf7

                                      SHA256

                                      4675474b7ccaf45c9fca9c4d141260f233807ddc68cf854d0900bb1f58522b67

                                      SHA512

                                      6682d18ed66b06f07bb6b1dc227808d5c872685ed271ff4b34a57d4ec7c7fe5316b6207d1094327db4e3166fc2288e47065cb72a275666a4b403dde8e33379af

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_mr.dll
                                      Filesize

                                      44KB

                                      MD5

                                      390c8645cb5e0f93054c063c5e5928f4

                                      SHA1

                                      0d17ac3976b3219750853715c06baa34e8ed751c

                                      SHA256

                                      98ae5da68f38dd4e43e307543d3218d4180c09433ae72c3b661eb73591a7a589

                                      SHA512

                                      b1bf09a5111890fa61dd944dbf0cf2804cdd96c5fee3193a80fb15cdc6fdb455fb4e535e8aec337ca4595623bef29c7f6784e53e222c7a5df400dc61965830f6

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_ms.dll
                                      Filesize

                                      43KB

                                      MD5

                                      d9999c911f60a32046d1a4c559ae5de3

                                      SHA1

                                      e84c1c32708a97a81358dd8adb3fb40681f5a7aa

                                      SHA256

                                      31a64ff7f0b1d8bb81e83680c3391c0dc5530c798b9322d11e62e2389933b548

                                      SHA512

                                      eefb62c906c85a94025d79a0dd35b634a08b457fca57e2b97d514f1b5f0b9ea8450c9d387b4d9683c5d01d0088e03fd106b530470aa88229ab4123edf00032aa

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_nl.dll
                                      Filesize

                                      44KB

                                      MD5

                                      ccadd45844090d479f00d8707e962f35

                                      SHA1

                                      0654501881968cb2d954cb95da6150047c49c0c7

                                      SHA256

                                      854804cb86a3059bec32d10f44123ff93060aae05eaa72821148a4e2764ace3e

                                      SHA512

                                      098a384baf41a11a6e50b2d22e1c1e1cb2d9f5897776afa676b235f075c9ed3f404a92d4593c229e6ededab4da614b25e5cd0c73f3cb7e0ac02231cce800f7a4

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_no.dll
                                      Filesize

                                      43KB

                                      MD5

                                      5a19716ac62f7b636d666ba166d00a3e

                                      SHA1

                                      0fa31113684f879e259f8521be08ff87286724e4

                                      SHA256

                                      94365146ae8320732dad96344dcf6fa83d9eaf65cb7bf30e50613964f5a33e66

                                      SHA512

                                      accfbfd86c4648fff856fafffbe7317907e19261ed81ce5e6cd9e5ad59ae9abbe677730527704a1b0ba898195dcc6a5081a136b4d95563863f05a8eb9fbaf9fc

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_pl.dll
                                      Filesize

                                      44KB

                                      MD5

                                      5215164235c7dc3d72bcd0f832ddcd22

                                      SHA1

                                      bde57f57953bf119b6767e0b56380dbf0e4cad35

                                      SHA256

                                      c997f4bad6082c5d2483684b6a72d22153c502df6575e28cc1bf02789d08547b

                                      SHA512

                                      721423ea189d096764088fd8079988cbbcd98503ae2b82b0f485cb71bc81cb367588a9fcbdc9c5d09f20067f5ec8744572d252500af034edf900243e096526c3

                                      Download Submit
                                    • C:\Program Files (x86)\GUM7A8F.tmp\goopdateres_pt-BR.dll
                                      Filesize

                                      43KB

                                      MD5

                                      97c200cbd682c1b4bd28222437d7f630

                                      SHA1

                                      6bed6312571ea79df6deda2934d328683674b059

                                      SHA256

                                      3adc3bd14d6a1ae14de42ea501fa74ed651b197a7c8912b43d31fa92f500d630

                                      SHA512

                                      8e1af6b73729f5f6e3015c3890e8ad28ed851d1615fe0ae2b7997f3ae48958fbc90e74ce70ce4ef35aeea35a810de0699494d5b913f4774416acc1aa8ef0a9d6

                                      Download Submit
                                    • C:\Program Files\AVG\Browser\Application\125.0.25426.176\Installer\setup.exe
                                      Filesize

                                      3.4MB

                                      MD5

                                      5c1c7600e9d86906f171e7d6381a57fb

                                      SHA1

                                      ead88df2842757fdebc2d5364e00634cd6c41f49

                                      SHA256

                                      253948a9a6d1c275bab25296dd1a9e8c2e6fbe1bb33b719f14caf2f44208489b

                                      SHA512

                                      83605e6497f11c984483e3737901343a240373ac31bc1f1ad348d303a81147218d204e4ba8e3784b44c24cc3e24033a59b0337e1f5141bfedd96bf244cc3c8fa

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\25fa68c5-d3b3-4a70-bef1-94b38143be86.tmp
                                      Filesize

                                      168KB

                                      MD5

                                      27e0a973f1449e90508c04e5a6a5b86e

                                      SHA1

                                      a73aeda6a24c88cd513edb51fe82057888b33e31

                                      SHA256

                                      1a1d3f226e1b5d6b13a15080b67865bbd624d8bfd9c4f8a2f7e35b029c6b39d0

                                      SHA512

                                      8724eced195065a2bbb38f3fa940ae8b66202690e12fdc598a669574ffaee36d86a32e7fc608b23c83715f7859e6cfb556cc659181f7c90178b7241240449679

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Bookmarks
                                      Filesize

                                      36KB

                                      MD5

                                      471fee11953d0d3421f14db49a125570

                                      SHA1

                                      175aabd230fd45f3a0fa192b9a7c2d346011ac1c

                                      SHA256

                                      990b0c3ec490b4ef3a617dbb2039f0f9cbb16321994cb2ca14b15a3cce254f4e

                                      SHA512

                                      0c30b0ccf8a07d4b9518433b4f5d3fd23e37e3d121386930ad227319877d4b5d90f4efe8817dd7f9b671a1c45cffb6b967163e55ed7cc89ee82645ed51243c30

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
                                      Filesize

                                      96B

                                      MD5

                                      046878915709b3d973d4e58953c72a16

                                      SHA1

                                      260874e405c9eb1e357d322c2640682f8a6298bb

                                      SHA256

                                      2fb73d818c3a97c354a504322a6aab2d7af77ca3710a62f55b57b585e868c77a

                                      SHA512

                                      99771eef8bbc4be2fb80cd4efe589d415e235679a1c6513ebc7eab2e386b07bc3f0832bb4546ef94e044a6fd5f3cb755dda87136d770a352f613ac75cfc694f5

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
                                      Filesize

                                      48B

                                      MD5

                                      0ab602f6dff6badedfaa0fa9c1caf2cc

                                      SHA1

                                      fcc300086348c02405ac115d282f1a6805364993

                                      SHA256

                                      8109fa163c8199507a3812ac733319b40b4d23677556f06e61c590ddc428b55f

                                      SHA512

                                      15c62e5b36768a508d57cbb0e4ead188072a549ae848062d5fa3a257df03d4023c25cdcf72fbe7e207a3503865a4c4054abae1f113d9b62ce5de9a22c6dbe624

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\GPUCache\data_0
                                      Filesize

                                      8KB

                                      MD5

                                      cf89d16bb9107c631daabf0c0ee58efb

                                      SHA1

                                      3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                      SHA256

                                      d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                      SHA512

                                      8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\GPUCache\data_1
                                      Filesize

                                      264KB

                                      MD5

                                      d0d388f3865d0523e451d6ba0be34cc4

                                      SHA1

                                      8571c6a52aacc2747c048e3419e5657b74612995

                                      SHA256

                                      902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                                      SHA512

                                      376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\GPUCache\data_2
                                      Filesize

                                      8KB

                                      MD5

                                      0962291d6d367570bee5454721c17e11

                                      SHA1

                                      59d10a893ef321a706a9255176761366115bedcb

                                      SHA256

                                      ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                      SHA512

                                      f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\GPUCache\data_3
                                      Filesize

                                      8KB

                                      MD5

                                      41876349cb12d6db992f1309f22df3f0

                                      SHA1

                                      5cf26b3420fc0302cd0a71e8d029739b8765be27

                                      SHA256

                                      e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                      SHA512

                                      e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Local Storage\leveldb\CURRENT
                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Network\Network Persistent State
                                      Filesize

                                      1015B

                                      MD5

                                      e4cd60ab7e49893e1264c1122c32fd9f

                                      SHA1

                                      51d1042a85b20c4316bc921f2a2657b300b62cf6

                                      SHA256

                                      c0580ce45c4388421e698d5615a78c9fe565d5d62ca4f82bb4a38097d96c180d

                                      SHA512

                                      20ac291a5ce5bf19b7f47a58715e14044a0f5c24457fd86f902da49dfd693153fed550747d8dbf9334fa23c1cf82a8e00c1a62f0b8f337cdad6cc33e4255557d

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Network\SCT Auditing Pending Reports
                                      Filesize

                                      2B

                                      MD5

                                      d751713988987e9331980363e24189ce

                                      SHA1

                                      97d170e1550eee4afc0af065b78cda302a97674c

                                      SHA256

                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                      SHA512

                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Network\TransportSecurity
                                      Filesize

                                      188B

                                      MD5

                                      8091dd7cab50fa34abadffcce48c944e

                                      SHA1

                                      fd6a15bdb28a159b6252f593a34b994033514b91

                                      SHA256

                                      aa901e1eef6b172e1fc11149d6ffa16fdd0549a54c85e088ce9abd03d674c249

                                      SHA512

                                      7f39cdaf8bd1d00bf46ef228e547d2dbf8d40999a0f75e394181099d2cbb7eb07d2437b23bb39f4948c578299032fdf0842fd81a7c771e06200cee5749121203

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Network\TransportSecurity~RFe5b0d4b.TMP
                                      Filesize

                                      188B

                                      MD5

                                      ce2df681bba8d2111e73ca11386329f9

                                      SHA1

                                      29e55e7355aa77b982bcd2d28cab5feaca40a466

                                      SHA256

                                      ecb13f5dfe4fed14d77ce446c3ec4858a01a7542dacd71dca1beb660f192064a

                                      SHA512

                                      68c772f06a64f65b8102b60eb006db6a938b282e04be4b3e02387e90baed8884be9f8fbf9706c3fec5f7d1b99aede600eb4682f421d99da5d5a93c9abd29ca67

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Preferences
                                      Filesize

                                      46KB

                                      MD5

                                      6c1b74349d49a500c2b88cc9a5403409

                                      SHA1

                                      498e7d31cf080fce9d2c99ef91b3917b614a322e

                                      SHA256

                                      2376adfb29503454ec6c44b966320a8a56be864481626cb28e9772d8742e642c

                                      SHA512

                                      ca317f88c5661ff780e999f327bc34b3938a1397bd709078f0fee945a90e75f98bca9e9af656ef80b134f6ef02a00a2074c396f97e8742a92f26e6fb1bf7103a

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Preferences
                                      Filesize

                                      39KB

                                      MD5

                                      ed8ed75c409399c575ba1dd169d7cfcd

                                      SHA1

                                      eb0f1528547c5bc5e4311df40cb825e82ff1eeb1

                                      SHA256

                                      c0c45dc293f9dec4ed7fcbfff3e53516092a8411f6541953142bd01cf7e7d962

                                      SHA512

                                      fbf186129323f161e3088ba2b3711492858bac7371e16452138ceea4493fc62199ec6082547447e376bebfe13c96749269d6117c2e6752405cd22c724560e6fe

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Preferences
                                      Filesize

                                      46KB

                                      MD5

                                      3798093636bee6677eeba3c28554398c

                                      SHA1

                                      7b7409f332dd1363948faa1bcdd2e73be1738890

                                      SHA256

                                      48069ece51d49d6dc2c99de4e7b530586bf34c918181bf3f2379cbf576596376

                                      SHA512

                                      b668c70398a0eeec1162914f136e50b035719e9f637779c981956c0e2d373d8db0941d8213ffa84ec048d9979b6efe39d4c110dbe780fc770877b50dec7aa86e

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Preferences~RFe584457.TMP
                                      Filesize

                                      3KB

                                      MD5

                                      8511dc1a402eed3dc960ed7e6ac70698

                                      SHA1

                                      0a0102d9d7f721cdaf597800e3c55c5b0a642ed7

                                      SHA256

                                      cdef4862e07ef3f2005d7f101daa8369f3f1256fe941ed412333a75cfd490a7f

                                      SHA512

                                      2e8805b4808b6b3d13fc9129c4cf957d3d31077a59bd8619745482722b884a6f559638b372bf0d6f63ed0b92a2b8dcc8b9a026e069f2760fc129f3eba83cc801

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Secure Preferences
                                      Filesize

                                      11KB

                                      MD5

                                      5315d751730afd81dac5150b24ae0c77

                                      SHA1

                                      d63a021d77b2211bcf7bc93e492d5e24d082b085

                                      SHA256

                                      f491e346df35693187cd0d0ff8406239265fbeac8f93cd522943f11aa79df2a0

                                      SHA512

                                      10b43624a1599decb3830669a9f994bdf52506dfbc71d8621634014d550877d7c25891436d5929ee74670e579e798b0a6bfa80dc57c89171f6b2dbcf8dbb0776

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Site Characteristics Database\MANIFEST-000001
                                      Filesize

                                      41B

                                      MD5

                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                      SHA1

                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                      SHA256

                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                      SHA512

                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Local State
                                      Filesize

                                      4KB

                                      MD5

                                      30aab5f9682128fdf18c0fb2c823b192

                                      SHA1

                                      944b5a382fbe8b2098c247c5c0cad4f116c7e73e

                                      SHA256

                                      1d307aff41b78779ba61cb848e3847258482b26308d8dd57c722aee47866446e

                                      SHA512

                                      77c942b5ccbd5dfa8e522af5398f78b782dbafe5b51d1ba49b763eded0712d6ead7e0691f64beb8b051ed0aae766a3709476075abb281f3c085c5bb055c2e46b

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Local State
                                      Filesize

                                      4KB

                                      MD5

                                      9be7576f290b6b47dd31bbcdaf002f54

                                      SHA1

                                      85f32c1d62949a05f3c25570c6c796349507e707

                                      SHA256

                                      d926c2be4d7912862c5f0737bb5261cb80b09cbf2b0f63e1ec97989b488e6448

                                      SHA512

                                      0a5a0ff733f2319ccc213f833567d6134490c99eea4d1a2a99ebe6ee32e3f4b9545aee2f2f55e06507e910d167d5db0cbacf6c946b5b0cc397f446ab056674b5

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Local State
                                      Filesize

                                      7KB

                                      MD5

                                      ac0d0aef7ccb4a8f89a5b4a41c4713a4

                                      SHA1

                                      a2ba51ee9369195f32e29c80fa37c7599a4c98ee

                                      SHA256

                                      c2c723922c4ba50f4d98fb51563561079f8e288da078aa1e36caa29ff76e8ebd

                                      SHA512

                                      99daa5f7593cdc5556f1a512b21c3853c1173509dec3db97bdd574a315d9eb0a8a4db781a30a89c31b2e05c002316b217c90a939a1a3985edb8ccedab4983ca5

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Local State
                                      Filesize

                                      7KB

                                      MD5

                                      8895b3ab313e239dfc5a54d9a97b9c7a

                                      SHA1

                                      94bfe9da56ee4135a12072c66a41176c402815f0

                                      SHA256

                                      bf064b0ea3666fd6b5b9b0a123f511f5c82a48cb8e87f50c8c33d76690fc703a

                                      SHA512

                                      0018136b42ee5a884e53dd816a281f4c90d61ba302755c1f0257dcecc0a1ab6ec7d6e69ce339ceea9b3076435f8ffdbdf9e454e0bfed8b16aa84d58146c3565f

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Local State
                                      Filesize

                                      6KB

                                      MD5

                                      c08d6f5031a68439f3483fa294550c7b

                                      SHA1

                                      bab472607ce00239d9f857e326434742e761af50

                                      SHA256

                                      c972ee65a68960e21176cb5f5647e0a10d038484fafb472b50e900a93269fa10

                                      SHA512

                                      182b733b9ae095d3278dfa9ce61046a28753e02b744ba74cf69daa67d0c45fe1636cd51763807128760d94f66b3cfc0f1e63fe97f654bf5ea644695e4d11161c

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Local State
                                      Filesize

                                      1KB

                                      MD5

                                      a29d3e76f1c66fb9f61cc93e9deea4c2

                                      SHA1

                                      a53af5f3150195f2426c4bfbf170519d8fa3cc7b

                                      SHA256

                                      33887c43271d96df464744269a32f30763b9bb1dd595f814eb8403e913c2e300

                                      SHA512

                                      e1b68201a71379879e49369125704104613085daa8761f1a6041770364ec4cf97e03055de29c00d081f6a6690eb4b105e5fa351b33d3ababa32690303cd54fec

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Local State~RFe5840fc.TMP
                                      Filesize

                                      1008B

                                      MD5

                                      276bd8d4f1086ae26150836b30d3bddc

                                      SHA1

                                      d02141fe541263aa2755c1672757b38c9c54bd9c

                                      SHA256

                                      46daddc118d1cf744f27cc7858b3fa6374e488e86f6c34bb89e2b9ed942e7314

                                      SHA512

                                      e69155d992bfcbff0db68622efa895595df9bacb7ec537d4a0e6a3e00fae734afe5601bfa3d4801969b6f183bd8cfb53476fe0cf18f991860b69d086174d9460

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\0e8525cb-5e82-473f-aaf0-82019c6e1094.tmp
                                      Filesize

                                      1.3MB

                                      MD5

                                      06d466a1cde4306356506b35153c5ebd

                                      SHA1

                                      c43850528e8150e1f0e253653d2f0155d00585fd

                                      SHA256

                                      6b1205e9b435c6241ab9c244b1dc3c309c1d82211268501e71e43c4425fbf590

                                      SHA512

                                      5d79ae61fea7097ddf4b5f2c639ddd1ebdffb7d0e69b74aac47e166afbe94e88e3a4dbd1cf34d55c6c8b0fcba3c30b676c8460b120470c17278caf22896b0b33

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\40cfc6f2-def3-46fe-9da8-05de68771f45.tmp
                                      Filesize

                                      1.9MB

                                      MD5

                                      21b06e448a0bee23eb6b80dfb39f1e82

                                      SHA1

                                      d60b3a9021a704247af4ba58bd539d42f780661f

                                      SHA256

                                      3cad9f24f2ec2bee7bef2410ef713924640bda964e865096db6dde37103481ba

                                      SHA512

                                      9678b1302eb289f04c0fad0a60455da7d24da4bb72177561f8668f0995d695485eba915bb222d7231a8188ac6ff3b4b0ffbbfe3b725b9c0112ca6af9465f5709

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\5b183def-f715-412d-a45b-f2a23c7a06e7.tmp
                                      Filesize

                                      2.2MB

                                      MD5

                                      ffcff8e2ba102530ce54f9ea1529ce48

                                      SHA1

                                      0d3ebcf3ca535032d825b6a0c5a4c5e45733033a

                                      SHA256

                                      bfaebcbdaf420eac93d20ad94680fd13fa391bb8d4f7a29603b5172628fc093f

                                      SHA512

                                      e5c8aeccc919a8b07442bb291b1da38a0f82f5a1352b8ac1edbbf9b471675b92cfae53d118c819ed32dc8992ef8efb943e8ecea73d28706a7c88b8d83fd025ec

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\66025337-47c1-447e-b3d6-97b10c0fca26.tmp
                                      Filesize

                                      90KB

                                      MD5

                                      65a028a0d2831eed0228ecda4ab9ef2f

                                      SHA1

                                      86d5eaec3e1c7ecde3f37ab36a017599ddcb2138

                                      SHA256

                                      5cae2b06bc5525e26e08cfaa43be7a5f8df88053397676cf81a5402a1ea0059a

                                      SHA512

                                      edad812dffcc0c8b399d3c5c216973bab2fe9e9dbc0d2c6efffc8cca5f1c58e126b83046c4c90febf003f3afd3d3c12c9ba46ad9d18975f2a6c5094643ca4f87

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\692f7218-93e5-4fe9-b6e1-73024326e171.tmp
                                      Filesize

                                      1.2MB

                                      MD5

                                      d343a7167bf2962f27b54de17ec166a9

                                      SHA1

                                      cec2497d5ea819f05be656b8e15f79a6eaf27acf

                                      SHA256

                                      a00f73fe6dedd17fd34252c40d89c6be5524027ddb2c0effdbb298d7d7065de3

                                      SHA512

                                      64ada12e0bbd202c2f4817bb804d7583baaac469eaac0fd8db0df6bbc9d8d33603feb0cbeae6830b205fa056765da835b0e35b0733e3ce8964b8890aba382a4d

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\a8049c15-c9b5-4ae5-b4d6-76fb3d01ccae.tmp
                                      Filesize

                                      71KB

                                      MD5

                                      23905ea78979b66c6d307de1ba55cea8

                                      SHA1

                                      73c187582cf3a843367751b565180dbdd88498fd

                                      SHA256

                                      d3e2dd4dc06d3f0feeeb44ca24cd60d076931ff6c0ac1692b509f40f58d8595a

                                      SHA512

                                      a32f59e91c5be60eb032f33a5ff799e125143e9da4d93ae0b57abdd80b778ff0001ea28d553a947560b54b9d214ac96e5d0ce98d36d655b26f1b6d4ec64dbeae

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\ab6ebe25-1769-4824-82b0-3f7b1ae99ff5.tmp
                                      Filesize

                                      1B

                                      MD5

                                      5058f1af8388633f609cadb75a75dc9d

                                      SHA1

                                      3a52ce780950d4d969792a2559cd519d7ee8c727

                                      SHA256

                                      cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                      SHA512

                                      0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\aj6D82.exe
                                      Filesize

                                      5.8MB

                                      MD5

                                      c79bb78a0bad2559a7037913dd1f1f34

                                      SHA1

                                      a5b36348ad93fdf971201f31136d8c9b056984a7

                                      SHA256

                                      f63b47288af395ac9c02c980592691e2d446fe8b4d3813007433ae262af693c3

                                      SHA512

                                      1bd81cbe784427e54903159225e0fd94c0fab1d9498c11db177d86268f34129e6835759a9a3e3822c717349043930e13168390fcc2f9a74f9699f14497cfc888

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\avg-securebrowser-web-tags
                                      Filesize

                                      53B

                                      MD5

                                      4c94408946d796a8b19c17df5cf0562d

                                      SHA1

                                      89056150d90683f9548dadc308eb2789a67c2a47

                                      SHA256

                                      68042cb47d900c4110ffc5f46e5f8395b35f42d33fc75e58ee34c7f5d8726de7

                                      SHA512

                                      96a31f0b7254f42fec787233e2d11991709bc0b2514d163dd1f7696015e7318f9810d9811473fc13d6782d65e40f6a94fe6a7ffef3cb962032cff3bfe8b99a29

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\efe8e7a8-95ec-4cea-bdd3-c7e7c12b86c5.tmp
                                      Filesize

                                      1.2MB

                                      MD5

                                      7fabb7813703295a20612e6c811f982a

                                      SHA1

                                      be28a80def657caf474829dec119858325115d9f

                                      SHA256

                                      493bcea5b2aded060e245e3285276813795831006abf24abb2463479148fb570

                                      SHA512

                                      724f2091a84eefb064e39061b8787511f08b935e552c706796cb1ffd2a4b2451c30f3e47c272b327a2c3164fecab018344908f76612aad9ed39016215d3999dc

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\nsv6F65.tmp\AVGBrowserUpdateSetup.exe
                                      Filesize

                                      1.6MB

                                      MD5

                                      9750ea6c750629d2ca971ab1c074dc9d

                                      SHA1

                                      7df3d1615bec8f5da86a548f45f139739bde286b

                                      SHA256

                                      cd1c5c7635d7e4e56287f87588dea791cf52b8d49ae599b60efb1b4c3567bc9c

                                      SHA512

                                      2ecbe819085bb9903a1a1fb6c796ad3b51617dd1fd03234c86e7d830b32a11fbcbff6cdc0191180d368497de2102319b0f56bfd5d8ac06d4f96585164801a04b

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\nsv6F65.tmp\CR.History.tmp
                                      Filesize

                                      148KB

                                      MD5

                                      90a1d4b55edf36fa8b4cc6974ed7d4c4

                                      SHA1

                                      aba1b8d0e05421e7df5982899f626211c3c4b5c1

                                      SHA256

                                      7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

                                      SHA512

                                      ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\scoped_dir352_1930814681\CRX_INSTALL\img\common\extensions_page\icon_16.png
                                      Filesize

                                      540B

                                      MD5

                                      67816b9f9f56727c41d64793d0eb4902

                                      SHA1

                                      99dee423dc2ec6ddb923208240b2fd13409c8ca5

                                      SHA256

                                      7b9847ea5d27c37df0430ff4056ecf18b2248d18a10d7ee1cd7f8908f0a82d5d

                                      SHA512

                                      6fab420866894593620e95ce3cd988e6a9525b6bdb0b4577f8ee5fe513f3ba187996ccbda9d0b54b493122136e52c7bd179da22cd8106725f24401816429a3c7

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\scoped_dir352_2029009635\73a78a78-bfe1-4f9b-af77-e7fbc7c5248d.tmp
                                      Filesize

                                      839KB

                                      MD5

                                      f50e00df362d5a597b9e7f549df2587c

                                      SHA1

                                      cf6aafdc3f25bcffdcabd3a5db2e40d1cf42dbc9

                                      SHA256

                                      1518106d36a5770684ce0cd86279e19ee601225d9222f7f555421990a130eebf

                                      SHA512

                                      4691ef983c58d2f027bb0a283ed0a3b11da972588c4c4ab3462fd2e4546f0df85ed1c1f56a481cd86470e3ed02ee8859f22bd04c75a47ce1fe5cb5c983e64577

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\scoped_dir352_313776841\3fe8a530-1979-44a0-876f-fc7e9e14a7f9.tmp
                                      Filesize

                                      2.8MB

                                      MD5

                                      f75cbfbb5eaa5f46574955ed6651da78

                                      SHA1

                                      4ce276c03898e57667b401761fe1df5f11304a68

                                      SHA256

                                      643962e7cc16bb8e9edbea5f05473764199c7179d06a65bd88a0d101d1d5a9bd

                                      SHA512

                                      287847c5caae39fc80e90ae105a5fb0c9349f402872721c599eb9c9ccaf171437879f0ef8bdeae923bf4520befa316b60acd3e975caf8496f05dad24e1b34e40

                                      Download Submit
                                    • \Users\Admin\AppData\Local\Temp\nsh65FF.tmp\JsisPlugins.dll
                                      Filesize

                                      2.1MB

                                      MD5

                                      d21ae3f86fc69c1580175b7177484fa7

                                      SHA1

                                      2ed2c1f5c92ff6daa5ea785a44a6085a105ae822

                                      SHA256

                                      a6241f168cacb431bfcd4345dd77f87b378dd861b5d440ae8d3ffd17b9ceb450

                                      SHA512

                                      eda08b6ebdb3f0a3b6b43ef755fc275396a8459b8fc8a41eff55473562c394d015e5fe573b3b134eeed72edff2b0f21a3b9ee69a4541fd9738e880b71730303f

                                      Download Submit
                                    • \Users\Admin\AppData\Local\Temp\nsh65FF.tmp\StdUtils.dll
                                      Filesize

                                      195KB

                                      MD5

                                      34939c7b38bffedbf9b9ed444d689bc9

                                      SHA1

                                      81d844048f7b11cafd7561b7242af56e92825697

                                      SHA256

                                      b127f3e04429d9f841a03bfd9344a0450594004c770d397fb32a76f6b0eabed0

                                      SHA512

                                      bc1b347986a5d2107ad03b65e4b9438530033975fb8cc0a63d8ef7d88c1a96f70191c727c902eb7c3e64aa5de9ce6bb04f829ceb627eda278f44ca3dd343a953

                                      Download Submit
                                    • \Users\Admin\AppData\Local\Temp\nsh65FF.tmp\jsis.dll
                                      Filesize

                                      127KB

                                      MD5

                                      2027121c3cdeb1a1f8a5f539d1fe2e28

                                      SHA1

                                      bcf79f49f8fc4c6049f33748ded21ec3471002c2

                                      SHA256

                                      1dae8b6de29f2cfc0745d9f2a245b9ecb77f2b272a5b43de1ba5971c43bf73a1

                                      SHA512

                                      5b0d9966ecc08bcc2c127b2bd916617b8de2dcbdc28aff7b4b8449a244983bfbe33c56f5c4a53b7cf21faf1dbab4bb845a5894492e7e10f3f517071f7a59727c

                                      Download Submit
                                    • \Users\Admin\AppData\Local\Temp\nsh65FF.tmp\nsJSON.dll
                                      Filesize

                                      36KB

                                      MD5

                                      f840a9ddd319ee8c3da5190257abde5b

                                      SHA1

                                      3e868939239a5c6ef9acae10e1af721e4f99f24b

                                      SHA256

                                      ddb6c9f8de72ddd589f009e732040250b2124bca6195aa147aa7aac43fc2c73a

                                      SHA512

                                      8e12391027af928e4f7dad1ec4ab83e8359b19a7eb0be0372d051dfd2dd643dc0dfa086bd345760a496e5630c17f53db22f6008ae665033b766cbfcdd930881a

                                      Download Submit
                                    • \Users\Admin\AppData\Local\Temp\nsh65FF.tmp\thirdparty.dll
                                      Filesize

                                      93KB

                                      MD5

                                      7b4bd3b8ad6e913952f8ed1ceef40cd4

                                      SHA1

                                      b15c0b90247a5066bd06d094fa41a73f0f931cb8

                                      SHA256

                                      a49d3e455d7aeca2032c30fc099bfad1b1424a2f55ec7bb0f6acbbf636214754

                                      SHA512

                                      d7168f9504dd6bbac7ee566c3591bfd7ad4e55bcac463cecb70540197dfe0cd969af96d113c6709d6c8ce6e91f2f5f6542a95c1a149caa78ba4bcb971e0c12a2

                                      Download Submit
                                    • \Users\Admin\AppData\Local\Temp\nsv6F65.tmp\Midex.dll
                                      Filesize

                                      126KB

                                      MD5

                                      2597a829e06eb9616af49fcd8052b8bd

                                      SHA1

                                      871801aba3a75f95b10701f31303de705cb0bc5a

                                      SHA256

                                      7359ca1befdb83d480fc1149ac0e8e90354b5224db7420b14b2d96d87cd20a87

                                      SHA512

                                      8e5552b2f6e1c531aaa9fd507aa53c6e3d2f1dd63fe19e6350c5b6fbb009c99d353bb064a9eba4c31af6a020b31c0cd519326d32db4c8b651b83952e265ffb35

                                      Download Submit
                                    • \Users\Admin\AppData\Local\Temp\{61B4D8FE-59BC-4D1D-825C-B84CB1309232}\scrt.dll
                                      Filesize

                                      5.7MB

                                      MD5

                                      f36f05628b515262db197b15c7065b40

                                      SHA1

                                      74a8005379f26dd0de952acab4e3fc5459cde243

                                      SHA256

                                      67abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31

                                      SHA512

                                      280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8

                                      Download Submit
                                    • memory/784-552-0x00007FFF93520000-0x00007FFF93521000-memory.dmp
                                      Filesize

                                      4KB

                                      Download
                                    • memory/784-553-0x00007FFF95DA0000-0x00007FFF95DA1000-memory.dmp
                                      Filesize

                                      4KB

                                      Download
                                    • memory/1876-911-0x00007FFF93AE0000-0x00007FFF93AE1000-memory.dmp
                                      Filesize

                                      4KB

                                      Download