9a90556d225677efefbdbcca5def7de8ab0fa06b7573deca6e5f3e14510b9fb7

Resubmissions

05/09/2024, 08:26

240905-kcchjawenq 10

11/09/2023, 15:37

230911-s2rbzsgg3v 10

11/09/2023, 15:35

230911-s1tqqagf9z 10

Analysis

max time kernel
210s
max time network
210s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

do-it-again-1.6-installer_v-hiQS1.exe
Size

1.7MB
MD5

41ae06d18ed5af6e6a0a4568b6bb7cc4
SHA1

b5d5e7e8a951e96e88215ca140c04b892e2d53de
SHA256

a350cd18e1b18c350088512a4baeaeb0ce8ae7e2bfae80636c61c5ba17103b04
SHA512

81228bac5babd3c602804bea5e1c1f9c4d97ddb7896aec6bcea14ef8cd34b83c5ddcc63a6c3a257698910663e2dfd85355a461ea5d02ceefaa2e25cead16c166
SSDEEP

24576:Y7FUDowAyrTVE3U5Fmi05np8tydyPaJPfrT90eKc4cgFLNPfs8duMpmsDGB:YBuZrEUOp8odywPH9RHgFLRdp/M

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\AVG\\Antivirus\\setup\\instup.exe\" /instop:repair /wait"	instup.exe

Checks for any installed AV software in registry 1 TTPs 26 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\SOFTWARE\AVAST Software\Avast	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV\Dir	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\SOFTWARE\AVG\AV\Dir	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\SOFTWARE\AVAST Software\Avast	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast	avg_secure_browser_setup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Browser\Installed	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\SOFTWARE\AVG\AV\Dir	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Browser\Installed	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast	avg_secure_browser_setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\SOFTWARE\AVAST Software\Avast	avg_secure_browser_setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Browser\Installed	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV\Dir	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\SOFTWARE\AVAST Software\Avast	avg_secure_browser_setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\SOFTWARE\Avira\Browser\Installed	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\SOFTWARE\Avira\Browser\Installed	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Browser\Installed	do-it-again-1.6-installer_v-hiQS1.tmp

Downloads MZ/PE file

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
1896	verclsid.exe

Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup_x64.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	avg_secure_browser_setup.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup.exe
File opened for modification	\??\PhysicalDrive0	avg_secure_browser_setup.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation	avg_secure_browser_setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation	avg_secure_browser_setup.exe

Drops file in Program Files directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AVG\Antivirus\setup\Stats.ini	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_avg_crt_x64-7d5.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_core-876.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_res-876.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_cmp_swhealth_x64-82e.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_dll_eng-818.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\instcont_x64_ais-c62.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\offertool_x64_ais-c62.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\setgui_x64_ais-c62.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\vps_binaries_64-1482.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\jrog2-14a5.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_gen_tools_x64-876.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\instup_x64_ais-c62.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_cmp_cleanup_x64-7e8.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_cmp_idp_x64-869.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_gen_streamfilter_x64-866.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_x64-876.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_dll_eng_x64-82e.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_gen_gui_x64-82e.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_gen_openssl_x64-7de.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_gui_cef-7cf.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\avbugreport_x64_ais-c62.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\vps_binaries-1482.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\sbr_x64_ais-c62.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\Stats.ini.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_avg_crt_x86-7d5.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_cmp_bpc-7cc.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_gen_core_x64-82e.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_gen_tools-876.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\avdump_x86_ais-c62.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_cmp_datascan_x64-82e.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_gen_protobuf_x64-7d0.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_gui_cef_x64-7de.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_gui_res-834.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_cmp_gamingmode-875.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_shl_mai_x64-82e.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\avdump_x64_ais-c62.vpx	instup.exe

Executes dropped EXE 11 IoCs

pid	Process
2504	do-it-again-1.6-installer_v-hiQS1.tmp
1700	avg_antivirus_free_setup.exe
540	avg_secure_browser_setup.exe
2820	avg_antivirus_free_setup_x64.exe
2408	instup.exe
892	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2776	instup.exe
1896	sbr.exe
1920	avg_antivirus_free_setup.exe
2264	avg_secure_browser_setup.exe

Loads dropped DLL 47 IoCs

pid	Process
348	do-it-again-1.6-installer_v-hiQS1.exe
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
1700	avg_antivirus_free_setup.exe
1700	avg_antivirus_free_setup.exe
2820	avg_antivirus_free_setup_x64.exe
2820	avg_antivirus_free_setup_x64.exe
2820	avg_antivirus_free_setup_x64.exe
2820	avg_antivirus_free_setup_x64.exe
2820	avg_antivirus_free_setup_x64.exe
2820	avg_antivirus_free_setup_x64.exe
2820	avg_antivirus_free_setup_x64.exe
2408	instup.exe
2408	instup.exe
1696	do-it-again-1.6-installer_v-hiQS1.exe
1544	do-it-again-1.6-installer_v-hiQS1.exe
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2408	instup.exe
2408	instup.exe
2408	instup.exe
2408	instup.exe
2408	instup.exe
2408	instup.exe
2408	instup.exe
2408	instup.exe
2408	instup.exe
2408	instup.exe
2408	instup.exe
2408	instup.exe
2776	instup.exe
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg_antivirus_free_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg_secure_browser_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	do-it-again-1.6-installer_v-hiQS1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	do-it-again-1.6-installer_v-hiQS1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg_antivirus_free_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg_secure_browser_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	do-it-again-1.6-installer_v-hiQS1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	do-it-again-1.6-installer_v-hiQS1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	do-it-again-1.6-installer_v-hiQS1.tmp

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	do-it-again-1.6-installer_v-hiQS1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	avg_antivirus_free_setup_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	do-it-again-1.6-installer_v-hiQS1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avg_antivirus_free_setup_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	do-it-again-1.6-installer_v-hiQS1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	do-it-again-1.6-installer_v-hiQS1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avg_antivirus_free_setup_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "64"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "83"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "23"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "43"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "55"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "90"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "38"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "50"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: ais_cmp_datascan_x64"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "57"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Main = "17"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "98"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: jrog2-14a5.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "36"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "37"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "20"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: ais_cmp_bpc-7cc.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: ais_res-876.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "85"	avg_antivirus_free_setup_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "24"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "71"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "68"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Main = "6"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: vps_binaries-1482.vpx"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage	avg_antivirus_free_setup_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "10"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: ais_core"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "11"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "30"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "55"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "74"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "75"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: ais_avg_crt_x64"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "7"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "26"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "84"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "15"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "46"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "93"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: ais_dll_eng-818.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Main = "30"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "14"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "44"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: ais_x64"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Replacing files"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "59"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "60"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: ais_avg_crt_x86"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: ais_cmp_swhealth_x64"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: ais_gen_tools-876.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "7"	avg_antivirus_free_setup_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "21"	avg_antivirus_free_setup_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Main = "35"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Main = "36"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "59"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: instup.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "31"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "0"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "69"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Main = "31"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "9"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "28"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: ais_gen_tools"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: vps_binaries"	instup.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	do-it-again-1.6-installer_v-hiQS1.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	avg_secure_browser_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	do-it-again-1.6-installer_v-hiQS1.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	do-it-again-1.6-installer_v-hiQS1.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	do-it-again-1.6-installer_v-hiQS1.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	do-it-again-1.6-installer_v-hiQS1.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	avg_secure_browser_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	do-it-again-1.6-installer_v-hiQS1.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	do-it-again-1.6-installer_v-hiQS1.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	do-it-again-1.6-installer_v-hiQS1.tmp

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	53	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2504	do-it-again-1.6-installer_v-hiQS1.tmp
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
540	avg_secure_browser_setup.exe
2820	avg_antivirus_free_setup_x64.exe
2820	avg_antivirus_free_setup_x64.exe
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe
2264	avg_secure_browser_setup.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 32	2820	avg_antivirus_free_setup_x64.exe
Token: SeDebugPrivilege	2820	avg_antivirus_free_setup_x64.exe
Token: SeDebugPrivilege	2408	instup.exe
Token: 32	2408	instup.exe
Token: SeDebugPrivilege	2776	instup.exe
Token: 32	2776	instup.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2504	do-it-again-1.6-installer_v-hiQS1.tmp
2312	do-it-again-1.6-installer_v-hiQS1.tmp

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 2504	348	do-it-again-1.6-installer_v-hiQS1.exe	30
PID 348 wrote to memory of 2504	348	do-it-again-1.6-installer_v-hiQS1.exe	30
PID 348 wrote to memory of 2504	348	do-it-again-1.6-installer_v-hiQS1.exe	30
PID 348 wrote to memory of 2504	348	do-it-again-1.6-installer_v-hiQS1.exe	30
PID 348 wrote to memory of 2504	348	do-it-again-1.6-installer_v-hiQS1.exe	30
PID 348 wrote to memory of 2504	348	do-it-again-1.6-installer_v-hiQS1.exe	30
PID 348 wrote to memory of 2504	348	do-it-again-1.6-installer_v-hiQS1.exe	30
PID 2504 wrote to memory of 1700	2504	do-it-again-1.6-installer_v-hiQS1.tmp	32
PID 2504 wrote to memory of 1700	2504	do-it-again-1.6-installer_v-hiQS1.tmp	32
PID 2504 wrote to memory of 1700	2504	do-it-again-1.6-installer_v-hiQS1.tmp	32
PID 2504 wrote to memory of 1700	2504	do-it-again-1.6-installer_v-hiQS1.tmp	32
PID 2504 wrote to memory of 1700	2504	do-it-again-1.6-installer_v-hiQS1.tmp	32
PID 2504 wrote to memory of 1700	2504	do-it-again-1.6-installer_v-hiQS1.tmp	32
PID 2504 wrote to memory of 1700	2504	do-it-again-1.6-installer_v-hiQS1.tmp	32
PID 2504 wrote to memory of 540	2504	do-it-again-1.6-installer_v-hiQS1.tmp	33
PID 2504 wrote to memory of 540	2504	do-it-again-1.6-installer_v-hiQS1.tmp	33
PID 2504 wrote to memory of 540	2504	do-it-again-1.6-installer_v-hiQS1.tmp	33
PID 2504 wrote to memory of 540	2504	do-it-again-1.6-installer_v-hiQS1.tmp	33
PID 2504 wrote to memory of 540	2504	do-it-again-1.6-installer_v-hiQS1.tmp	33
PID 2504 wrote to memory of 540	2504	do-it-again-1.6-installer_v-hiQS1.tmp	33
PID 2504 wrote to memory of 540	2504	do-it-again-1.6-installer_v-hiQS1.tmp	33
PID 1700 wrote to memory of 2820	1700	avg_antivirus_free_setup.exe	34
PID 1700 wrote to memory of 2820	1700	avg_antivirus_free_setup.exe	34
PID 1700 wrote to memory of 2820	1700	avg_antivirus_free_setup.exe	34
PID 1700 wrote to memory of 2820	1700	avg_antivirus_free_setup.exe	34
PID 2820 wrote to memory of 2408	2820	avg_antivirus_free_setup_x64.exe	35
PID 2820 wrote to memory of 2408	2820	avg_antivirus_free_setup_x64.exe	35
PID 2820 wrote to memory of 2408	2820	avg_antivirus_free_setup_x64.exe	35
PID 1696 wrote to memory of 892	1696	do-it-again-1.6-installer_v-hiQS1.exe	39
PID 1696 wrote to memory of 892	1696	do-it-again-1.6-installer_v-hiQS1.exe	39
PID 1696 wrote to memory of 892	1696	do-it-again-1.6-installer_v-hiQS1.exe	39
PID 1696 wrote to memory of 892	1696	do-it-again-1.6-installer_v-hiQS1.exe	39
PID 1696 wrote to memory of 892	1696	do-it-again-1.6-installer_v-hiQS1.exe	39
PID 1696 wrote to memory of 892	1696	do-it-again-1.6-installer_v-hiQS1.exe	39
PID 1696 wrote to memory of 892	1696	do-it-again-1.6-installer_v-hiQS1.exe	39
PID 1544 wrote to memory of 2312	1544	do-it-again-1.6-installer_v-hiQS1.exe	41
PID 1544 wrote to memory of 2312	1544	do-it-again-1.6-installer_v-hiQS1.exe	41
PID 1544 wrote to memory of 2312	1544	do-it-again-1.6-installer_v-hiQS1.exe	41
PID 1544 wrote to memory of 2312	1544	do-it-again-1.6-installer_v-hiQS1.exe	41
PID 1544 wrote to memory of 2312	1544	do-it-again-1.6-installer_v-hiQS1.exe	41
PID 1544 wrote to memory of 2312	1544	do-it-again-1.6-installer_v-hiQS1.exe	41
PID 1544 wrote to memory of 2312	1544	do-it-again-1.6-installer_v-hiQS1.exe	41
PID 2408 wrote to memory of 2776	2408	instup.exe	42
PID 2408 wrote to memory of 2776	2408	instup.exe	42
PID 2408 wrote to memory of 2776	2408	instup.exe	42
PID 2776 wrote to memory of 1896	2776	instup.exe	43
PID 2776 wrote to memory of 1896	2776	instup.exe	43
PID 2776 wrote to memory of 1896	2776	instup.exe	43
PID 2312 wrote to memory of 1920	2312	do-it-again-1.6-installer_v-hiQS1.tmp	44
PID 2312 wrote to memory of 1920	2312	do-it-again-1.6-installer_v-hiQS1.tmp	44
PID 2312 wrote to memory of 1920	2312	do-it-again-1.6-installer_v-hiQS1.tmp	44
PID 2312 wrote to memory of 1920	2312	do-it-again-1.6-installer_v-hiQS1.tmp	44
PID 2312 wrote to memory of 1920	2312	do-it-again-1.6-installer_v-hiQS1.tmp	44
PID 2312 wrote to memory of 1920	2312	do-it-again-1.6-installer_v-hiQS1.tmp	44
PID 2312 wrote to memory of 1920	2312	do-it-again-1.6-installer_v-hiQS1.tmp	44
PID 2312 wrote to memory of 2264	2312	do-it-again-1.6-installer_v-hiQS1.tmp	45
PID 2312 wrote to memory of 2264	2312	do-it-again-1.6-installer_v-hiQS1.tmp	45
PID 2312 wrote to memory of 2264	2312	do-it-again-1.6-installer_v-hiQS1.tmp	45
PID 2312 wrote to memory of 2264	2312	do-it-again-1.6-installer_v-hiQS1.tmp	45
PID 2312 wrote to memory of 2264	2312	do-it-again-1.6-installer_v-hiQS1.tmp	45
PID 2312 wrote to memory of 2264	2312	do-it-again-1.6-installer_v-hiQS1.tmp	45
PID 2312 wrote to memory of 2264	2312	do-it-again-1.6-installer_v-hiQS1.tmp	45

C:\Users\Admin\AppData\Local\Temp\do-it-again-1.6-installer_v-hiQS1.exe
"C:\Users\Admin\AppData\Local\Temp\do-it-again-1.6-installer_v-hiQS1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:348
- C:\Users\Admin\AppData\Local\Temp\is-RL9SD.tmp\do-it-again-1.6-installer_v-hiQS1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RL9SD.tmp\do-it-again-1.6-installer_v-hiQS1.tmp" /SL5="$40026,879088,832512,C:\Users\Admin\AppData\Local\Temp\do-it-again-1.6-installer_v-hiQS1.exe"
  2⤵
  - Checks for any installed AV software in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\component0_extract\avg_antivirus_free_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\component0_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5fcXyOJAtXvvH9pfBviYikVToMr8jZovh4MCfUnT0y58h38nGYLgxMOEtcm6bKCUyETQw2Iyk
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\Temp\asw.73b1d8904425de57\avg_antivirus_free_setup_x64.exe
      "C:\Windows\Temp\asw.73b1d8904425de57\avg_antivirus_free_setup_x64.exe" /silent /ws /psh:92pTu5fcXyOJAtXvvH9pfBviYikVToMr8jZovh4MCfUnT0y58h38nGYLgxMOEtcm6bKCUyETQw2Iyk /cookie:mmm_irs_ppi_902_451_o /ga_clientid:8663de60-7ee0-4164-92bb-c66c87724846 /edat_dir:C:\Windows\Temp\asw.73b1d8904425de57
      4⤵
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Windows\Temp\asw.43c4327c516ccbac\instup.exe
        
        "C:\Windows\Temp\asw.43c4327c516ccbac\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.43c4327c516ccbac /edition:15 /prod:ais /stub_context:898cf161-6f54-40de-afdd-9798b9e495df:10012544 /guid:5e1c84b3-8599-4727-83d3-d5c055464441 /ga_clientid:8663de60-7ee0-4164-92bb-c66c87724846 /no_delayed_installation /silent /ws /psh:92pTu5fcXyOJAtXvvH9pfBviYikVToMr8jZovh4MCfUnT0y58h38nGYLgxMOEtcm6bKCUyETQw2Iyk /cookie:mmm_irs_ppi_902_451_o /ga_clientid:8663de60-7ee0-4164-92bb-c66c87724846 /edat_dir:C:\Windows\Temp\asw.73b1d8904425de57
        5⤵
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2408
      - C:\Windows\Temp\asw.43c4327c516ccbac\New_15020c62\instup.exe
        
        "C:\Windows\Temp\asw.43c4327c516ccbac\New_15020c62\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.43c4327c516ccbac /edition:15 /prod:ais /stub_context:898cf161-6f54-40de-afdd-9798b9e495df:10012544 /guid:5e1c84b3-8599-4727-83d3-d5c055464441 /ga_clientid:8663de60-7ee0-4164-92bb-c66c87724846 /no_delayed_installation /silent /ws /psh:92pTu5fcXyOJAtXvvH9pfBviYikVToMr8jZovh4MCfUnT0y58h38nGYLgxMOEtcm6bKCUyETQw2Iyk /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.73b1d8904425de57 /online_installer
        6⤵
        Adds Run key to start application
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\Temp\asw.43c4327c516ccbac\New_15020c62\sbr.exe
        
        "C:\Windows\Temp\asw.43c4327c516ccbac\New_15020c62\sbr.exe" 2776 "AVG Antivirus setup" "AVG Antivirus is being installed. Do not shut down your computer!"
        7⤵
        Executes dropped EXE
        
        PID:1896
- - C:\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\component1_extract\avg_secure_browser_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\component1_extract\avg_secure_browser_setup.exe" /s /run_source=avg_ads_is_control /is_pixel_psh=BjYV6dENvVLueDHI6SaQgqRgkXNyWMOZ9emvKXDEXhxBoPdlSVthavW3habunQHFfMGgvWFNRvhUMhy /make-default
    3⤵
    - Checks for any installed AV software in registry
    - Writes to the Master Boot Record (MBR)
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:540

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:1896

C:\Users\Admin\AppData\Local\Temp\do-it-again-1.6-installer_v-hiQS1.exe
"C:\Users\Admin\AppData\Local\Temp\do-it-again-1.6-installer_v-hiQS1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\is-C8QML.tmp\do-it-again-1.6-installer_v-hiQS1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-C8QML.tmp\do-it-again-1.6-installer_v-hiQS1.tmp" /SL5="$9019E,879088,832512,C:\Users\Admin\AppData\Local\Temp\do-it-again-1.6-installer_v-hiQS1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:892

C:\Users\Admin\AppData\Local\Temp\do-it-again-1.6-installer_v-hiQS1.exe
"C:\Users\Admin\AppData\Local\Temp\do-it-again-1.6-installer_v-hiQS1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\is-4TBRB.tmp\do-it-again-1.6-installer_v-hiQS1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4TBRB.tmp\do-it-again-1.6-installer_v-hiQS1.tmp" /SL5="$6018C,879088,832512,C:\Users\Admin\AppData\Local\Temp\do-it-again-1.6-installer_v-hiQS1.exe"
  2⤵
  - Checks for any installed AV software in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Users\Admin\AppData\Local\Temp\is-HR226.tmp\component0_extract\avg_antivirus_free_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-HR226.tmp\component0_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5fcXyOJAtXvXLbsOEQNiNY1LwzM6Df2PAQiDbQx3mlvoMMywz6w6jyDu3x37JPckbrclgSsHC
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\is-HR226.tmp\component1_extract\avg_secure_browser_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-HR226.tmp\component1_extract\avg_secure_browser_setup.exe" /s /run_source=avg_ads_is_control /is_pixel_psh=BjYV6dENvVLueDHJYKPkZaFZzEoZch0HKfR8gRfR98LHfzdql6uP79q4EVqWgQJ6Ubn8JKNeeuFzkDS /make-default
    3⤵
    - Checks for any installed AV software in registry
    - Writes to the Master Boot Record (MBR)
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\AVG\Antivirus\setup\Stats.ini

Filesize
2KB

MD5
34337a7f370b1d4ddaeaaff526943c28

SHA1
24d6495b565bd50f83088c51ea06061172948c2c

SHA256
5bead349d8b4b7648230b7459c275e03c4fb29a92db9bf24391cc2f77a44f847

SHA512
463921c5b86b61c38cbeee6d97fb00a8956f4ba4396bf8f0a7f09e744eee44e72c1f85b09aa5c05994d41c0e24ce7aada75040ab159a60f6ca6d7d5860bfa7ba

Download Submit
C:\Program Files\AVG\Antivirus\setup\Stats.ini

Filesize
2KB

MD5
eed5118a000dbea298af82081b1887d6

SHA1
265972019e59d9423ff52a9bfde436b361d10432

SHA256
245297246e8cc3e5f2ec070402517e6d7a52426e34b5a89d35ad307e14138ce0

SHA512
40ad5f9e00ea65cddd77da2ba1b9983e5b6d43ff40dc794536d2557bc44a279b2bd6321809f020619e9be4a6f107a381b166e07eba313b6560f75d4de229d110

Download Submit
C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\Setup.log

Filesize
1KB

MD5
62b63de5185c3bde0a038a6fa5eeca4b

SHA1
ad9f8ff26b0edaf779d08cb4ce4fb1aa8c29e418

SHA256
f509ffdf644550d7c808ef697f849ab2ec0b0a9bfc15789ce30da7a90df587e9

SHA512
01ca13049beba411fc1b4e523e5cc1f94e59a03d799dd4fb7636bb8740e2e659264308bc632c5b4bb90347cd8facabf3e060e710f7b1510bbe9f72b972ae1d57

Download Submit
C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\Setup.log

Filesize
24KB

MD5
027a4527276be36974e795ac23691e3e

SHA1
4f6b5ac1f47aeac70def1615b9cf5cd96d609229

SHA256
bc7260146c5206e227668fd2cd8b8cb1efbfd77b39d5aed3966fe898a9f4d95a

SHA512
51db1d33444992dea1e68e52e28603304e6cc9c3340e705b4ea832107f90106af2ac785712363d158d17ae1975b39b7db18f5746db0bc1abe10fac6ef1f05674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6a314e41810b2061f106694387a7d75

SHA1
329af3ec8baa1192efbe9257a0c0d8cc86c2d078

SHA256
6ed177f5372883736b07c6daf89317cc2df9814f072debc3fe578ba2119e065c

SHA512
18acd2a0264de89efd7dcb92586b87ba19546cb45b6d5270d0c299a4ad48e5726212d9b4a276ce21afe01bdf47dd1803dfdfe3f18e1c70f530dcb375a7bb4573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e10c02be6c705a67e65a56a834449efe

SHA1
f01f3294c78428f41774430e85653838a67296c9

SHA256
724462cb56c0600366ed001f383f0df493f88f4e36261c18967f812055e219bc

SHA512
c4211086d0a8232efb8cd1f9a484b53fe29787a9c6e0da3f1d2e91a5421914db4ff20551f7198a1f94e72a6ba5ef90ea868add8bbb3865d11d067c8ec8ea9730

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE7B2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE7C5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\AVG_AV.png

Filesize
51KB

MD5
aee8e80b35dcb3cf2a5733ba99231560

SHA1
7bcf9feb3094b7d79d080597b56a18da5144ca7b

SHA256
35bbd8f390865173d65ba2f38320a04755541a0783e9f825fdb9862f80d97aa9

SHA512
dcd84221571bf809107f7aeaf94bab2f494ea0431b9dadb97feed63074322d1cf0446dbd52429a70186d3ecd631fb409102afcf7e11713e9c1041caacdb8b976

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\AVG_BRW.png

Filesize
29KB

MD5
0b4fa89d69051df475b75ca654752ef6

SHA1
81bf857a2af9e3c3e4632cbb88cd71e40a831a73

SHA256
60a9085cea2e072d4b65748cc71f616d3137c1f0b7eed4f77e1b6c9e3aa78b7e

SHA512
8106a4974f3453a1e894fec8939038a9692fd87096f716e5aa5895aa14ee1c187a9a9760c0d4aec7c1e0cc7614b4a2dbf9b6c297cc0f7a38ba47837bede3b296

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\component0.zip

Filesize
122KB

MD5
56b0d3e1b154ae65682c167d25ec94a6

SHA1
44439842b756c6ff14df658befccb7a294a8ea88

SHA256
434bfc9e005a7c8ee249b62f176979f1b4cde69484db1683ea07a63e6c1e93de

SHA512
6f7211546c6360d4be8c3bb38f1e5b1b4a136aa1e15ec5ae57c9670215680b27ff336c4947bd6d736115fa4dedea10aacf558b6988196f583b324b50d4eca172

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\component0_extract\avg_antivirus_free_setup.exe

Filesize
229KB

MD5
26816af65f2a3f1c61fb44c682510c97

SHA1
6ca3fe45b3ccd41b25d02179b6529faedef7884a

SHA256
2025c8c2acc5537366e84809cb112589ddc9e16630a81c301d24c887e2d25f45

SHA512
2426e54f598e3a4a6d2242ab668ce593d8947f5ddb36aded7356be99134cbc2f37323e1d36db95703a629ef712fab65f1285d9f9433b1e1af0123fd1773d0384

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\component1.zip

Filesize
5.7MB

MD5
6406abc4ee622f73e9e6cb618190af02

SHA1
2aa23362907ba1c48eca7f1a372c2933edbb7fa1

SHA256
fd83d239b00a44698959145449ebfcb8c52687327deac04455e77a710a3dfe1b

SHA512
dd8e43f8a8f6c6e491179240bdfefdf30002f3f2900b1a319b4251dfa9ca7b7f87ddf170ba868ab520f94de9cc7d1854e3bcfd439cad1e8b4223c7ee06d649f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\component1_extract\avg_secure_browser_setup.exe

Filesize
5.8MB

MD5
591059d6711881a4b12ad5f74d5781bf

SHA1
33362f43eaf8ad42fd6041d9b08091877fd2efba

SHA256
99e8de20a35a362c2a61c0b9e48fe8eb8fc1df452134e7b6390211ab19121a65

SHA512
6280064a79ca36df725483e3269bc1e729e67716255f18af542531d7824a5d76b38a7dcefca048022c861ffcbd0563028d39310f987076f6a5da6c7898c1984c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\x_in_black_circle.png

Filesize
1KB

MD5
e2a07fb89c61cbb4121c5f59003769fa

SHA1
9cc95e83a88a44792edd466abf1896a0927014fd

SHA256
c9e0ce645ee4bcb73e797cdab0efcb858093120cabe5fcf6a554856c14871efe

SHA512
393e0eb5df493ae3f4410f64d571d1037a5b653ff4c3a30bf37aa3841425adf4e53e02e151650454f2e8e72cf82056256f6f07cc96dd055e0e48da01f8ff29bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse7448.tmp\CR.History.tmp

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse7448.tmp\StdUtils.dll

Filesize
195KB

MD5
7602b88d488e54b717a7086605cd6d8d

SHA1
c01200d911e744bdffa7f31b3c23068971494485

SHA256
2640e4f09aa4c117036bfddd12dc02834e66400392761386bd1fe172a6ddfa11

SHA512
a11b68bdaecc1fe3d04246cfd62dd1bb4ef5f360125b40dadf8d475e603e14f24cf35335e01e985f0e7adcf785fdf6c57c7856722bc8dcb4dd2a1f817b1dde3a

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\Instup.dll

Filesize
18.2MB

MD5
37e51612361e689d50a8ba7761d8f8de

SHA1
df875ed71d93bbbeb275e6c2e68dae483b8b7c20

SHA256
2de47c0cf151797704f51971eeb9ba8914bf177b46ffc779e4677fce8a374f24

SHA512
5af9e773c272df5c823491ef81ccaab0fdae5610e602f30b6053f9e94b536b601bce904080cf5ed5d1d043d51be0b47fcc2135ef97d135b18f6dda7acf07f1eb

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\New_15020c62\asw08cfb48fcae86b40.tmp

Filesize
907KB

MD5
43dc9e69f1e9db4059cf49a5e825cfda

SHA1
519298f8a681b41d2d70db2670cc7543f1ee6da4

SHA256
98efeee831a7984d94cf13800aeb1de68e79bea0bb5d95ff7adcbb43b648ed4d

SHA512
d0c07cb1e251f2135fdb21893e6ca70efc019a8b759274c87266fb5a2c48ebc0126aecee0020bd48cfd65ef2f794b81b1e417000c91db18e2ac128c86eac4079

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\New_15020c62\asw28e4bbafb9dd8771.tmp

Filesize
4.5MB

MD5
bbb61ad0f20d3fe17a5227c13f09e82d

SHA1
01700413fc5470aa0ba29aa1a962d7a719a92a82

SHA256
39154701a5a844eacf6aa1ccc70297c66bda6e27450fd1043778cead49da859e

SHA512
c614246263664268970562908c63e933ddda0a7f1c2f06b63eab9a06a2d8253356636cac948f709c37e66929d5d8b57663bf5f0d34fcf591ac7461c2af5b63e4

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\New_15020c62\asw2fbc79dc1ad38aed.tmp

Filesize
3.1MB

MD5
c545527e69a46359a4a45f58794a0fe5

SHA1
e233e5837bfe5d1429300fb33f12f5b54689781b

SHA256
8d86976b5ecd432772d4ac5965ff86bff6da04318f231b3e7ea64818de6211f9

SHA512
754c891b4f582948ba5dd776a87edba35f96453a540c20c5dd78f2d816bc83161e0d3f8a0f6052b5d0835f5a0b4eeb6d7a871aa611bd74e61ca25ea7046837e0

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\New_15020c62\asw6db6aaee7f441a90.tmp

Filesize
3.8MB

MD5
0b830444a6ef848fb85bfbb173bb6076

SHA1
27964cc1673ddb68ca3da8018f0e13e9a141605e

SHA256
63f361195a989491b2c10499d626ab3306edc36fbcb21a9cd832c4c4c059bb8f

SHA512
31655204bfb16d1902bb70a603a47f6bf111c0f36962fea01e15193d72cc1fffcead1f1a7884d2929ceb77ac47c640ca8039a93b4648747496d462ffe6a05e65

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\New_15020c62\aswe771ed2978e4929e.tmp

Filesize
19.1MB

MD5
917a284494cbe4a4ec85e1ec768339c9

SHA1
47ccc0a04ecc7c3c1ff79bf42d424cfda356137c

SHA256
57cb03fbc4750eefba0079c3fcdfc1b077e4347e0438f41e13b8614e7f11b772

SHA512
90849e580c9da697689c664b126ed97b085bd2fd6016ac9193afd7a7ac625c76db84c9bf55a4bd0308da889a16b27832383738de5ecbec7e97bbd5b7962999d8

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\aswbf58c9499e83f6bb.ini

Filesize
565B

MD5
8aabb018169236d2cc4fdaca25a6ec77

SHA1
a07d22de896d8983f0a51fff85c77d9f008ddf33

SHA256
4af9683bf99b6661725957238b775f3139c35787a98887ea40a76fb03c6ea27c

SHA512
0ec21bf9062fd73513dd85e91cdb52612bf7a832aac1e204ad682c48182c11d1b159dbb904c29d752065ddcb22236b3398b3ff583aa51e3e566f15313cdc7607

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\config.def

Filesize
19KB

MD5
f73df26a3265d92bf3cb2db65e815f87

SHA1
12f5dc317d74c6ad2d94bb092c0ec1bfca90ef65

SHA256
b77adf13de02e958d29a17824dfaaffad95c3b87e3eaaafe0773457784c7eaa8

SHA512
a43d34ce29ab16ddbabd4fc5a03317c3fbca45e44e6503d8b479915ce9c92394636457acee3dab38293e1d4c9907a78b86728b7dc69cb214cc08b3c34d9b9cc8

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\config.def

Filesize
18KB

MD5
6889074b7f8dc1fbacf45861dae04136

SHA1
2f2a02187b57c08eff22d29f96a0e0be75dbef02

SHA256
a3850a411f4ebfc7e2b29c5ff3d50b7b0e120aa73d90ca1880a49c588257c78f

SHA512
df3f2a87d992d9a64771952933243ce34cc615f9bf153f6cdf9ddbb25398d7aaa1b8c7e220a602bad1eb517deb6329c331348b8371e964d5f23be2d836c4be3a

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\config.ini

Filesize
662B

MD5
b9ef0f15fa22b2d5de5f0e633cf3d2cb

SHA1
68c45fa71eadae68445a2536e61e02f460d4ba55

SHA256
67da13ab33d9d4208d115516b99d2bee1015eb69cfde712f34aa3c524c63e81f

SHA512
bd081be1c25791d93995d52a2b0ee11c06df6592984d07319c57aed910fb65b2a31e01892383961ca409b3a8fb21d3571274066ec6d2800a4d53f77a8b924c4a

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\offertool_x64_ais-c62.vpx

Filesize
831KB

MD5
ce4d45d0b684f591d5a83fdbd99bd306

SHA1
e89637b905c37033950afadaca2161bd5b09fb5e

SHA256
907e054fef8297e3cd31d083299ff0ac495775eaa928e3e10e7000fdf6baaed7

SHA512
af0aefc20b9c9c91f63f34fcd70c27e9e304073d51cc9ec45113ab360dd5ba4ad104b5c752e022b8b153f435527b56f6bfbb6022dd4bca98f8d1778e2bfc97d1

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\part-jrog2-14a2.vpx

Filesize
680B

MD5
6096e7b1a6362f5c49623388505c8cac

SHA1
2246b2b6136d1ab8ff401cd02989790cbe66dbc1

SHA256
ddb7d676be03a4fd7c12b646ccc915aca0bf27f822d4df8afd62190e3701b71a

SHA512
ef2a751bb6b16d339c118571f849d33988f9443ca4bf6c7d03acc79e719aa904b4673dd40c4d90517340d26708d9a90e2e0d8389319eac3206ecd4021c24d846

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\part-prg_ais-15020c62.vpx

Filesize
175KB

MD5
29b9bfd25fabf42939e3a6877f9b3ece

SHA1
c30d865bc2d680311c68eb0bed0e356845f700f9

SHA256
ed586b6ceb3e9dcc7dd21dd7dc7addd89e71a2b90039fe15b751b367e402d475

SHA512
a22827a2f9bc3de3c6c0ed5a4e36c383b5f8d4989fc543aa1a4852034c84055925df7456c1f9466ff3923de81f9d58a6f12d8f24e782bb2e805b908ef814a90e

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\part-setup_ais-15020c62.vpx

Filesize
5KB

MD5
d5b798d8816b252e7d718195dfeb8a8c

SHA1
860c5807fd491aeeb12d661d8cf2ecca4ca1639b

SHA256
75176962c8691f84eb299a555d4c82796b53a12161f1e6616ec50cf97393b499

SHA512
16cd2e8f57c05ba2bae79de39867cc35178a6d99cd035d7d20efd8788076360a408affa9b6caf3ea09daf5c32834b995e47b1ab4ec29fcc1fdfddcf0ba96cce5

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\part-vps_windows-24090500.vpx

Filesize
12KB

MD5
41cb1de8f3077150484c680f83aa81eb

SHA1
abd403fc02fb6334fc86aae3d6c727ceb8068af5

SHA256
bf747d853d4699922ceaee43a42767d1516a02a5026344caa6ba77aaf71ac5c1

SHA512
57999d25024744fd773e5d53f7f757d3954f24b2c97a0d036375831df56cdebd50c952574daf1eef869bfbb563b026be206920b299698a4134f004b698a9b1c8

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\prod-pgm.vpx

Filesize
571B

MD5
80923428355b73a2a7f50c916da5b567

SHA1
e9e75bca2f0ad14278ce45b8f007d57c2c326394

SHA256
bbbfa65884b4d637eda3ec79a5ad745f48ed5035f69223e4201409fca479d09d

SHA512
d3073315a51bb1b0073bec2d5aff4fd3a7064660d9d6b54c8bbedff2128fe94804ac1d2a1df7a4baeae42ee010729abe84fbe37e609e6ea9ab49e7980fc737f9

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\prod-vps.vpx

Filesize
344B

MD5
87b6adc8f7dc6334d4ddcf4e1299acfd

SHA1
1339d233b5e617b45df538c02d0bd50576d72612

SHA256
ed23a2dad672f03f9f3764cbe8976d7f478726ab14800b18a394b362822e5e37

SHA512
f5e921af6b2db5c069dc06ea52196b400446a002b27c812d20f4c3794c85987dc17ea7001fcaba8de818109f5310d3f34d7af764e922c58b2a16da759bd2673a

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\prod-vps.vpx

Filesize
342B

MD5
7b705de254aa4425a30f2391e6ca46a7

SHA1
7c4d17b2b6f04dc0444690adbdb0336eea9e33ab

SHA256
f6a3523ecede4f4f72d2031cdac3ce2d561510f3966b92ad4543b0a7cbb4687c

SHA512
b6af6891ace5f6618922053d67e9c291535f001d6883e01151b31f8621ce74a4a5336df9af9e5c5c24b1e49e1e5e467c96c7600e6a77d655bec8c9dd1f2e5cde

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\sbr_x64_ais-c62.vpx

Filesize
15KB

MD5
e38cc92cd980a55d811316ac62883e14

SHA1
fa83737abe11ee825c3da6843cc4d8e3b459729a

SHA256
be4d8a5dc335ca8446c0dbba4ee4ef07553a5c242bed560f11aaef4793855e87

SHA512
1422c8f94556ff0409a3cd1ff581f6c4ea56b01be36ba5b2c0e72465f4dad38391eb85bae28b079aa2f1204615d32a17b7e73e92ffcc9964f39c79626b7afe16

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\servers.def

Filesize
27KB

MD5
0e2440b112daade4f0b6ecd73a85cc94

SHA1
274167033de5bc41279e35b51b9a590da8f0de94

SHA256
d3f80118df9b7edaa29e6963dd407cfbf242f51d17f11b171aa85ca4795b57f1

SHA512
71a10c70bfb1f35c4192702e3bf37bee3caf901605236d98a619932197191923c2ae014fcd64013faa498d0f90f63512254a57ff9849b549e8a8aad26f4b4369

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\servers.def.vpx

Filesize
1KB

MD5
dee85b4a27ab47c79566e6b45b2c9b12

SHA1
ee3b18a603768697f2df824c739f45b45e046a4b

SHA256
16ba9a4bc2a15c8b6bfb0d7de0ef9020a6b1c70ac19b41843b6f2ba3dbda29c8

SHA512
e24fd8e1e5bec30f5dec0ec0a7d6db0ed6e6b324482c8851f9cfe4d3d7499291d46303ebd4c317e28cb0f50a4dba7a2459ae97da3da75a19b30f456acf9e2a5c

Download Submit
C:\Windows\Temp\asw.43c4327c516ccbac\uat64.vpx

Filesize
12KB

MD5
03c274423574fb57a8b30f9189c84da7

SHA1
a55ecb6f2aceb3f6bf171f9dfa1e72fb5ce08795

SHA256
331ec8e92ca3a0ec3246584664ff039e3205eb825a8d07e0187e3fe554ab35c5

SHA512
2d936e2d8fc8c993684151828aab801c166b52f38d5411f032e2e978a977293b3f3915a60d94fd6075da2a779f00758438c1ec92c9ed9f869472eac97572f0ec

Download Submit
C:\Windows\Temp\asw.73b1d8904425de57\ecoo.edat

Filesize
21B

MD5
3f44a3c655ac2a5c3ab32849ecb95672

SHA1
93211445dcf90bb3200abe3902c2a10fe2baa8e4

SHA256
51516a61a1e25124173def4ef68a6b8babedc28ca143f9eee3e729ebdc1ef31f

SHA512
d3f95262cf3e910dd707dfeef8d2e9db44db76b2a13092d238d0145c822d87a529ca58ccbb24995dfcf6dad1ffc8ced6d50948bb550760cd03049598c6943bc0

Download Submit
\Users\Admin\AppData\Local\Temp\is-P5L9M.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
\Users\Admin\AppData\Local\Temp\is-RL9SD.tmp\do-it-again-1.6-installer_v-hiQS1.tmp

Filesize
3.0MB

MD5
570ac7dec62a51b18b9359d1e9f3e23b

SHA1
0791494b26ba013034c5861c4b006cb6a9f66a36

SHA256
8c5ffa58d84d9d8eef793c780c20297f0ca93db40ea40fe0c15150718b9f046a

SHA512
44d68db3a30b99093db264b21ff680a6c74c4b6dcb7d1d49df4eaf0124dd52ad726dd0dd9419f89b89fe841852d6fda68c9383fbe80a681b15577f80e8bc617a

Download Submit
\Users\Admin\AppData\Local\Temp\nse7448.tmp\JsisPlugins.dll

Filesize
2.1MB

MD5
bd94620c8a3496f0922d7a443c750047

SHA1
23c4cb2b4d5f5256e76e54969e7e352263abf057

SHA256
c0af9e25c35650f43de4e8a57bb89d43099beead4ca6af6be846319ff84d7644

SHA512
954006d27ed365fdf54327d64f05b950c2f0881e395257b87ba8e4cc608ec4771deb490d57dc988571a2e66f730e04e8fe16f356a06070abda1de9f3b0c3da68

Download Submit
\Users\Admin\AppData\Local\Temp\nse7448.tmp\Midex.dll

Filesize
126KB

MD5
581c4a0b8de60868b89074fe94eb27b9

SHA1
70b8bdfddb08164f9d52033305d535b7db2599f6

SHA256
b13c23af49da0a21959e564cbca8e6b94c181c5eeb95150b29c94ff6afb8f9dd

SHA512
94290e72871c622fc32e9661719066bafb9b393e10ed397cae8a6f0c8be6ed0df88e5414f39bc528bf9a81980bdcb621745b6c712f4878f0447595cec59ee33d

Download Submit
\Users\Admin\AppData\Local\Temp\nse7448.tmp\jsis.dll

Filesize
127KB

MD5
4b27df9758c01833e92c51c24ce9e1d5

SHA1
c3e227564de6808e542d2a91bbc70653cf88d040

SHA256
d37408f77b7a4e7c60800b6d60c47305b487e8e21c82a416784864bd9f26e7bb

SHA512
666f1b99d65169ec5b8bc41cdbbc5fe06bcb9872b7d628cb5ece051630a38678291ddc84862101c727f386c75b750c067177e6e67c1f69ab9f5c2e24367659f4

Download Submit
\Users\Admin\AppData\Local\Temp\nse7448.tmp\nsJSON.dll

Filesize
36KB

MD5
ddb56a646aea54615b29ce7df8cd31b8

SHA1
0ea1a1528faafd930ddceb226d9deaf4fa53c8b2

SHA256
07e602c54086a8fa111f83a38c2f3ee239f49328990212c2b3a295fade2b5069

SHA512
5d5d6ee7ac7454a72059be736ec8da82572f56e86454c5cbfe26e7956752b6df845a6b0fada76d92473033ca68cd9f87c8e60ac664320b015bb352915abe33c8

Download Submit
\Users\Admin\AppData\Local\Temp\nse7448.tmp\thirdparty.dll

Filesize
93KB

MD5
070335e8e52a288bdb45db1c840d446b

SHA1
9db1be3d0ab572c5e969fea8d38a217b4d23cab2

SHA256
c8cf0cf1c2b8b14cbedfe621d81a79c80d70f587d698ad6dfb54bbe8e346fbbc

SHA512
6f49b82c5dbb84070794bae21b86e39d47f1a133b25e09f6a237689fd58b7338ae95440ae52c83fda92466d723385a1ceaf335284d4506757a508abff9d4b44c

Download Submit
\Windows\Temp\asw.43c4327c516ccbac\Instup.exe

Filesize
3.6MB

MD5
5589b2bfaccad2b2fe32fcf1813e2eea

SHA1
370d80408e229c51ac5e4734b20e06a9fa84659e

SHA256
8e44b04500ff08a4f232880d4fbde698848ba96d07dc56a10c715b23d5261057

SHA512
21d58d725562a15be2240c5c015cafcff25053815ca9b2faca626ddec3133e79636c761a286043bc9e462582480f2044978685fb9da0c51e7781315e59db3446

Download Submit
\Windows\Temp\asw.43c4327c516ccbac\uat64.dll

Filesize
23KB

MD5
d63615268f01f004c377f3c19fb3206c

SHA1
3f55798dd5b118ea69b73ce3ed953b87a6c96d32

SHA256
80b6f6164bf41246d8e9e917439e830f95ef4f9eca25bb93d81cf1a7eeb1047c

SHA512
c18c50536ccf71e2ddf5969a7059397766837b19aabc4b5c0f341b0624e615a35590a58c940a4305135904615ed8acb00e152e350d04bcc8bbc8cc54b2246f09

Download Submit
\Windows\Temp\asw.73b1d8904425de57\avg_antivirus_free_setup_x64.exe

Filesize
9.5MB

MD5
55bffb8a369429d422aef3d3ba0dc6a8

SHA1
4fe9be9dae0d4b08414f5b45c8b8a642d5117298

SHA256
719a2be936f0e226ac5f7d52ab74b55a97933192a1793a4bae2f06438cd35355

SHA512
b4ff92614b77314016714281a20462e0bc5f861b9ec5b099382604aa99c1afc81c7f7f0255f225213537acf21d59a014a5d1cc82070550189443a2d132ec1d05

Download Submit
memory/348-334-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/348-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/348-12-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/348-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/892-462-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/1544-890-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1544-465-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1544-496-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1696-455-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1696-464-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2312-486-0x0000000003A80000-0x0000000003A8F000-memory.dmp

Filesize
60KB

Download
memory/2312-838-0x0000000003A80000-0x0000000003A8F000-memory.dmp

Filesize
60KB

Download
memory/2312-888-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2312-869-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2312-497-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2312-498-0x0000000003A80000-0x0000000003A8F000-memory.dmp

Filesize
60KB

Download
memory/2312-837-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2312-674-0x0000000003A80000-0x0000000003A8F000-memory.dmp

Filesize
60KB

Download
memory/2312-673-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2504-134-0x0000000003A20000-0x0000000003A2F000-memory.dmp

Filesize
60KB

Download
memory/2504-14-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2504-144-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2504-283-0x0000000003A20000-0x0000000003A2F000-memory.dmp

Filesize
60KB

Download
memory/2504-138-0x0000000003A20000-0x0000000003A2F000-memory.dmp

Filesize
60KB

Download
memory/2504-137-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2504-332-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2504-282-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2504-145-0x0000000003A20000-0x0000000003A2F000-memory.dmp

Filesize
60KB

Download
memory/2504-128-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2504-8-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2776-839-0x000007FEF2B80000-0x000007FEF3EA6000-memory.dmp

Filesize
19.1MB

Download
memory/2776-675-0x000007FEF2B80000-0x000007FEF3EA6000-memory.dmp

Filesize
19.1MB

Download
memory/2776-723-0x000007FEF2B80000-0x000007FEF3EA6000-memory.dmp

Filesize
19.1MB

Download
memory/2776-636-0x000007FEF2B80000-0x000007FEF3EA6000-memory.dmp

Filesize
19.1MB

Download
memory/2776-909-0x000007FEF2B80000-0x000007FEF3EA6000-memory.dmp

Filesize
19.1MB

Download
memory/2776-971-0x000007FEF2B80000-0x000007FEF3EA6000-memory.dmp

Filesize
19.1MB

Download
memory/2776-1008-0x000007FEF2B80000-0x000007FEF3EA6000-memory.dmp

Filesize
19.1MB

Download