Analysis

  • max time kernel
    146s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 21:51

General

  • Target

    avg_antivirus_free_setup.exe

  • Size

    247KB

  • MD5

    18854664af657aa0a6d62196c321acf0

  • SHA1

    86c944fbadfc4481533fa6b948cb2879f9411a2c

  • SHA256

    979437ed2a4c9a008e48df0aa7f8c0470de20adcb4f83aaaf17903e1e4d55605

  • SHA512

    5ddbd2e06c33e6464bcc407b63da8e9173c44f4cb91a6870b5a3bbffec6edf647649c71a35d51a1c773c4acc6753d26ac87fe90f27d5b5210b873090a07bdc62

  • SSDEEP

    6144:PtgJcB7RG80fGwvDBn9Egw7Qj3EVfQ57:PtgJORaGiDB9y1fW7

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 30 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\avg_antivirus_free_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\avg_antivirus_free_setup.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Windows\Temp\asw.e2ee3950eba1850e\avg_antivirus_free_setup_x64.exe
      "C:\Windows\Temp\asw.e2ee3950eba1850e\avg_antivirus_free_setup_x64.exe" /cookie:mmm_bav_998_999_000_m:dlid_FREEGSR-FAD /ga_clientid:99736dda-0a05-4c53-a8b6-547b34407642 /edat_dir:C:\Windows\Temp\asw.e2ee3950eba1850e
      2⤵
      • Checks for any installed AV software in registry
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\Temp\asw.aeea441ad5de6f11\instup.exe
        "C:\Windows\Temp\asw.aeea441ad5de6f11\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.aeea441ad5de6f11 /edition:15 /prod:ais /stub_context:24b80587-b8f6-488f-bba8-29a33adae804:11167936 /guid:431651c3-2489-4efa-81c9-6648edabc796 /ga_clientid:99736dda-0a05-4c53-a8b6-547b34407642 /no_delayed_installation /cookie:mmm_bav_998_999_000_m:dlid_FREEGSR-FAD /ga_clientid:99736dda-0a05-4c53-a8b6-547b34407642 /edat_dir:C:\Windows\Temp\asw.e2ee3950eba1850e
        3⤵
        • Checks for any installed AV software in registry
        • Writes to the Master Boot Record (MBR)
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2064
        • C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\instup.exe
          "C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.aeea441ad5de6f11 /edition:15 /prod:ais /stub_context:24b80587-b8f6-488f-bba8-29a33adae804:11167936 /guid:431651c3-2489-4efa-81c9-6648edabc796 /ga_clientid:99736dda-0a05-4c53-a8b6-547b34407642 /no_delayed_installation /cookie:mmm_bav_998_999_000_m:dlid_FREEGSR-FAD /edat_dir:C:\Windows\Temp\asw.e2ee3950eba1850e /online_installer
          4⤵
          • Checks for any installed AV software in registry
          • Writes to the Master Boot Record (MBR)
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1644
          • C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\aswOfferTool.exe
            "C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\aswOfferTool.exe" -checkGToolbar -elevated
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1020
          • C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\aswOfferTool.exe
            "C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\aswOfferTool.exe" /check_secure_browser
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2724
          • C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\aswOfferTool.exe
            "C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\aswOfferTool.exe" -checkChrome -elevated
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2908
          • C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\aswOfferTool.exe
            "C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFA
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2776
            • C:\Users\Public\Documents\aswOfferTool.exe
              "C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFA
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\Setup.log

    Filesize

    28KB

    MD5

    19e8c413c6811dfffe58d7b87cd770dd

    SHA1

    7d60d4ee9abdd3b702625bc69c27724bf54d8821

    SHA256

    865b3775092258cf86e8d160d8100b833fef9d085e966036989e87a6888e56fb

    SHA512

    390642031d9e26dee05e4a720db3fb37a42cb8141b4a2b1e01652398980ef0188380f0f371d79ee1739b47ff4c3023e5d46256ef2d41e1657c8d40056500cfd1

  • C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\Setup.log

    Filesize

    1KB

    MD5

    daba72d50f296ce464a2103911fb6577

    SHA1

    013f1d055efbfcb99ae7d490ba5a2d1ee4607b40

    SHA256

    2a18000c4c2cd0911889e405ae6de5a18bb6fb0d48915970ca6ce62fcd6f2b6e

    SHA512

    a12913147a7cca71b49458a92dacfed8452196f2062c4866f8168bd2c4bb2e0d00fefdbe4ad7c678a5dfcb81bd8c85d90de45de822b1f778798df18f6024ac61

  • C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\event_manager.log

    Filesize

    142B

    MD5

    5a624701bffd273add4aaa088e85130a

    SHA1

    65d3614023b6e6f6cb75b43f937cb9a636080660

    SHA256

    53174f79d6b4ce5d996fe8d25260240cac1fbfc639d788d00de20d537d33794a

    SHA512

    32e96cf80ba901f358eae276a718b4fc078ac28c776df81d8e715c7e042653321d066f9f5a81d256fa7ae159b0b398019c755a98bddf246326463ef87a57a148

  • C:\Windows\Temp\asw.aeea441ad5de6f11\HTMLayout.dll

    Filesize

    4.0MB

    MD5

    b39614a52de7353db442a5e990d8b007

    SHA1

    6b9e95a06905267729e721167f99982033a3fa11

    SHA256

    22a35a503c3060365c5107bb0f6b17113cca77f9c76993904140f616858ea10f

    SHA512

    5ad0217ef70eb3baba368ccb5d05c54a479351be706ac95b268ee7dc1aa24ea00674134dc60c143bcbe5cf21d6759c18e965a6bd89bef7d0cc20f77967f56b7c

  • C:\Windows\Temp\asw.aeea441ad5de6f11\Instup.dll

    Filesize

    21.7MB

    MD5

    868b5c92cbd5394800f72ed7e843a1c0

    SHA1

    4292711d86c2f87f813a17ac3cd606fc2d6db305

    SHA256

    e46f6295acd6d09164a8c2e196f02786338c54ebab0056b7e430b50a2c49f481

    SHA512

    3203c12e050a9225d838cdb79ba6348f1b1d381974c44b1c275b713e214d2839c6523d1ee8784b45c76bb5dd33ce70a13c8e621c460171d2d951e6af39cf1694

  • C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\asw43d0274504cd54e9.tmp

    Filesize

    4.5MB

    MD5

    bbb61ad0f20d3fe17a5227c13f09e82d

    SHA1

    01700413fc5470aa0ba29aa1a962d7a719a92a82

    SHA256

    39154701a5a844eacf6aa1ccc70297c66bda6e27450fd1043778cead49da859e

    SHA512

    c614246263664268970562908c63e933ddda0a7f1c2f06b63eab9a06a2d8253356636cac948f709c37e66929d5d8b57663bf5f0d34fcf591ac7461c2af5b63e4

  • C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\asw8746d13ce531ca84.tmp

    Filesize

    831KB

    MD5

    ce4d45d0b684f591d5a83fdbd99bd306

    SHA1

    e89637b905c37033950afadaca2161bd5b09fb5e

    SHA256

    907e054fef8297e3cd31d083299ff0ac495775eaa928e3e10e7000fdf6baaed7

    SHA512

    af0aefc20b9c9c91f63f34fcd70c27e9e304073d51cc9ec45113ab360dd5ba4ad104b5c752e022b8b153f435527b56f6bfbb6022dd4bca98f8d1778e2bfc97d1

  • C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\asw95917d6162316ea7.tmp

    Filesize

    19.1MB

    MD5

    917a284494cbe4a4ec85e1ec768339c9

    SHA1

    47ccc0a04ecc7c3c1ff79bf42d424cfda356137c

    SHA256

    57cb03fbc4750eefba0079c3fcdfc1b077e4347e0438f41e13b8614e7f11b772

    SHA512

    90849e580c9da697689c664b126ed97b085bd2fd6016ac9193afd7a7ac625c76db84c9bf55a4bd0308da889a16b27832383738de5ecbec7e97bbd5b7962999d8

  • C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\aswabc0d3ac78a1ec2d.tmp

    Filesize

    3.8MB

    MD5

    0b830444a6ef848fb85bfbb173bb6076

    SHA1

    27964cc1673ddb68ca3da8018f0e13e9a141605e

    SHA256

    63f361195a989491b2c10499d626ab3306edc36fbcb21a9cd832c4c4c059bb8f

    SHA512

    31655204bfb16d1902bb70a603a47f6bf111c0f36962fea01e15193d72cc1fffcead1f1a7884d2929ceb77ac47c640ca8039a93b4648747496d462ffe6a05e65

  • C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\aswbefdf197aad5c3f3.tmp

    Filesize

    3.1MB

    MD5

    c545527e69a46359a4a45f58794a0fe5

    SHA1

    e233e5837bfe5d1429300fb33f12f5b54689781b

    SHA256

    8d86976b5ecd432772d4ac5965ff86bff6da04318f231b3e7ea64818de6211f9

    SHA512

    754c891b4f582948ba5dd776a87edba35f96453a540c20c5dd78f2d816bc83161e0d3f8a0f6052b5d0835f5a0b4eeb6d7a871aa611bd74e61ca25ea7046837e0

  • C:\Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\aswd6c60e343e7023fe.tmp

    Filesize

    907KB

    MD5

    43dc9e69f1e9db4059cf49a5e825cfda

    SHA1

    519298f8a681b41d2d70db2670cc7543f1ee6da4

    SHA256

    98efeee831a7984d94cf13800aeb1de68e79bea0bb5d95ff7adcbb43b648ed4d

    SHA512

    d0c07cb1e251f2135fdb21893e6ca70efc019a8b759274c87266fb5a2c48ebc0126aecee0020bd48cfd65ef2f794b81b1e417000c91db18e2ac128c86eac4079

  • C:\Windows\Temp\asw.aeea441ad5de6f11\config.def

    Filesize

    18KB

    MD5

    b287ff221fcc9ed0834d24809fe35b97

    SHA1

    8bc09ba498c1a33f3226e6e55eb769e7d017cf9c

    SHA256

    292369211d5a83d0a54c28afcb396cc6f9a8626e0ad109c8ddac19742deb5aff

    SHA512

    3da3c73c074b417e4478c8a9e52c9f1debcfe4d5fe58467ca07b6c7a362b5705ad707f7af89af1eead8b699454f77cba364eba3d3759fcaa6c03e971b2b7a056

  • C:\Windows\Temp\asw.aeea441ad5de6f11\config.def

    Filesize

    19KB

    MD5

    04066ffcc36a979b7faf3597d72fb4d0

    SHA1

    5381164681d5cf88d92edf4524046915c5ff05cc

    SHA256

    4c222ebc30e8f0c716536b4677366fdf5f836b0e53cc6da7a4113c9850a2b83e

    SHA512

    a1e5a90ba0244bd0f8ace34c982d25b68ce69f87655bdf7b0d030f79c0657dfbf6634c9aa98dd223ba6e501054f34f2658858da740ed95001c73f027a1434c5d

  • C:\Windows\Temp\asw.aeea441ad5de6f11\config.def

    Filesize

    23KB

    MD5

    3952f549ce78ae50fd3e3c057584ee21

    SHA1

    6085e105beaf3213f8c460bf98e83e7c58783795

    SHA256

    5aeb5e788eb782399710ebc36539cb358abfa26808c15d482a649337e830efac

    SHA512

    2c4e4898a31d7f4e176d1108d768d77af4aa9c9273e99e217a523bc7ac814322c2afed8858d6d908adf7bcca0f40dc711e83f759d2305412422f902d3453509d

  • C:\Windows\Temp\asw.aeea441ad5de6f11\config.ini

    Filesize

    719B

    MD5

    e7a7f06c018407215154b1e3df4e38cf

    SHA1

    ccf07702d132d4d2f6246ada187b80e37e6a9e6e

    SHA256

    adfd3085c07154e30e5a43c14fd2bd7c3b91486db6e1c8ddf24cee3ec2526bfe

    SHA512

    e4c5ae7c00c37b3a4807f900abf8cdc728f9d2db98cd647308e67272a5e02ab80d7dcfd3766fb8393f89d0d77aed0f12f5ec81e9c9e973fd725b2497e90d9410

  • C:\Windows\Temp\asw.aeea441ad5de6f11\part-jrog2-155e.vpx

    Filesize

    706B

    MD5

    7410e610a02b87e7f6f828f2604b6a47

    SHA1

    8bb34043915e657a74c2a2b35db4aed2da3d2152

    SHA256

    0f8d65ba00223c47d1aca87e5e07ff316a80c37d3a2e9b7239ce403ad9ab7c5a

    SHA512

    e14ce73c40d02ffd563e83c03547facc050b1fd23e60c2a37623d251efa5a4dc5004da988e4907c666b12327c6b238d4da9f881851d24a771c6c8397e998698e

  • C:\Windows\Temp\asw.aeea441ad5de6f11\part-prg_ais-15020c62.vpx

    Filesize

    175KB

    MD5

    29b9bfd25fabf42939e3a6877f9b3ece

    SHA1

    c30d865bc2d680311c68eb0bed0e356845f700f9

    SHA256

    ed586b6ceb3e9dcc7dd21dd7dc7addd89e71a2b90039fe15b751b367e402d475

    SHA512

    a22827a2f9bc3de3c6c0ed5a4e36c383b5f8d4989fc543aa1a4852034c84055925df7456c1f9466ff3923de81f9d58a6f12d8f24e782bb2e805b908ef814a90e

  • C:\Windows\Temp\asw.aeea441ad5de6f11\part-setup_ais-15020c62.vpx

    Filesize

    5KB

    MD5

    d5b798d8816b252e7d718195dfeb8a8c

    SHA1

    860c5807fd491aeeb12d661d8cf2ecca4ca1639b

    SHA256

    75176962c8691f84eb299a555d4c82796b53a12161f1e6616ec50cf97393b499

    SHA512

    16cd2e8f57c05ba2bae79de39867cc35178a6d99cd035d7d20efd8788076360a408affa9b6caf3ea09daf5c32834b995e47b1ab4ec29fcc1fdfddcf0ba96cce5

  • C:\Windows\Temp\asw.aeea441ad5de6f11\part-vps_windows-24110904.vpx

    Filesize

    11KB

    MD5

    b531b59b0edcc190460c9271500c1fbe

    SHA1

    a6b9a80e4a52e10055f9d8a041580eb64ebd5d03

    SHA256

    2bc92796a760c7c54f6ad713ee394e118b5e3d7d772ec1c7790b18f5f809912e

    SHA512

    2bf11cb7ab338c8f4753f30acfe54b3a791b4e0469ace1c3c6818a5512b33942eb4418228af2aa7b944e60abe64ab8eb5e5ef9f2b72ab4e5cc4135eb6a37a99a

  • C:\Windows\Temp\asw.aeea441ad5de6f11\prod-pgm.vpx

    Filesize

    570B

    MD5

    6c1d9e1205004626b884438704c0631a

    SHA1

    00b5fd840f4fdcab41cc89da9fc1141c7594870b

    SHA256

    067a441767c324abf5e72729e70ae1edff257611232c08e5181ccac83f10ebec

    SHA512

    443c896b88520013cd43093ea6f934e179e7a64ce4d3443ab531798ce73298c5eb5dff22a554fbfd1a141daad9344fa69d170e5f727ec61652b3e297a878316e

  • C:\Windows\Temp\asw.aeea441ad5de6f11\prod-vps.vpx

    Filesize

    343B

    MD5

    3db64dd18a9c8b5f30520cb1e4dd1a97

    SHA1

    d52b3cb5111366c8571d545b5c527a0bb339eaf1

    SHA256

    5a6d11525163362dcf13d6557917c4f4af912d9f3de7d9ace9ffa3ca5c01a76b

    SHA512

    92ff3730244782f51fd5ed03534ec87df5c04ccc8d3add3fbb6d30a82898cd69a03cfb628f6f0d210d9d900a7b3a140e4868749ed8270aa35cde52108f6b6077

  • C:\Windows\Temp\asw.aeea441ad5de6f11\prod-vps.vpx

    Filesize

    344B

    MD5

    1d3d34248a26b3ac42c0c047cac520c5

    SHA1

    a361f70160d12b48956324670b1744bb10db31f1

    SHA256

    9a46532b783dff58c60d6a34d4a3c777ebb8cac618f8c0fad445dad5328b9a08

    SHA512

    9bcff30abab1678ec010afa7327e1b749988d75a2549f4a620d73b7b9e16d7103292e1b55861d32868a24d5d09d24d906850d1d66de87e675075b7764432c38d

  • C:\Windows\Temp\asw.aeea441ad5de6f11\servers.def

    Filesize

    27KB

    MD5

    c7e6e4e24e5ab4f8a02a45faa0b0d488

    SHA1

    2f07929c3d89cee87b9215b544a853254e0b0954

    SHA256

    f9cb6948ee78d3250299f811168348e554419d70cc33ac0cfd8c7258678fdb7c

    SHA512

    fb988fffa9b8b2c6aab74b605e0d24642042a614094bb35b3a51f80f0dee6bbae365a8fad71af1f004bf405f7ce6396794f9850125ee3a2a293a5e7d9f056a04

  • C:\Windows\Temp\asw.aeea441ad5de6f11\servers.def.vpx

    Filesize

    1KB

    MD5

    a5f4c9bc6ea5c71f763b215ded1298d2

    SHA1

    87e4f4be5dd37ddb13d220ccef88ae9091d0b452

    SHA256

    057585349fc3568979e1d5ef62c32b801ac23835c2f224464a7300875b9f28c7

    SHA512

    65f625ed27187c68c8d376626b5df38a96869fc1794a956f4fb87b3753dbfd0c1bec9e824a026c363bd0f5f1fbc55dfd37a26dc23f7af17254cf4e4a771f5244

  • C:\Windows\Temp\asw.aeea441ad5de6f11\servers.def.vpx

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Windows\Temp\asw.aeea441ad5de6f11\setup.def

    Filesize

    37KB

    MD5

    3fc9d055795a4c01893e5661f300c513

    SHA1

    29c64165afecea436a2dcb57dd5b54163a002df4

    SHA256

    425eb69377f5ab3508bca26402d48377ab0362840ef0c77852236f45efc597e0

    SHA512

    e1622c0390a66dba328f5c699b10b32c66aec8a20474a6b5d49c2e0faf3a9997620db0f2162d6763976d70159e53363e9217d372cb19f982241f66ec8761c902

  • C:\Windows\Temp\asw.aeea441ad5de6f11\uat64.vpx

    Filesize

    16KB

    MD5

    65102de34e58a65be304b144659b8647

    SHA1

    062183fa6bfc38f64a9ba59ba3c6d642ff19e553

    SHA256

    5b94dc186cb9a01363a4c4220d4ad9940ba5294a354a5013ffb445e94f4eb09d

    SHA512

    b33431c4f0afc0528080505609c5c6efe6b9ac9a71c30380723fec14bcccc56056baede824b105231793e40e0d5342ce8863d4c4d75611cf7ac1b315c534b766

  • C:\Windows\Temp\asw.e2ee3950eba1850e\ecoo.edat

    Filesize

    38B

    MD5

    aaa8f0ca4acc800e63ec0cc3f9598380

    SHA1

    ba82445e4b1eae5bed00d6e5a78411b05700d88d

    SHA256

    9fa614083ebc934b52510cc41eb3246e1b0d199329ab1fd3aea08a5bce62bcdf

    SHA512

    cffec5401f95e8ddfd9edf6c2ea072114d3be913fd48f874938524046f08dea246823ce042fb9d452692c90c50a215c3dcaa19c02270d93534b6ff2da0d88dc0

  • \Windows\Temp\asw.aeea441ad5de6f11\Instup.exe

    Filesize

    3.7MB

    MD5

    023c18dc05f673644d0b2cce3cd63b8c

    SHA1

    c87b13de1ba7613d5b24dc1b092c810bdb30b608

    SHA256

    66a1b91e2023773c79bd9c3d9d3828b468fcdbc0f3f568619745628ca5a76004

    SHA512

    8229c569e9b909b3e04ce3eab4b3560539df88de6899ec1fc953f1481c25f48f5323aa9ec42e95acc64d9e5a1f09c6514339a654e54c56061e0485664cfdc017

  • \Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\asw56fa03059b963ba6.tmp

    Filesize

    15KB

    MD5

    e38cc92cd980a55d811316ac62883e14

    SHA1

    fa83737abe11ee825c3da6843cc4d8e3b459729a

    SHA256

    be4d8a5dc335ca8446c0dbba4ee4ef07553a5c242bed560f11aaef4793855e87

    SHA512

    1422c8f94556ff0409a3cd1ff581f6c4ea56b01be36ba5b2c0e72465f4dad38391eb85bae28b079aa2f1204615d32a17b7e73e92ffcc9964f39c79626b7afe16

  • \Windows\Temp\asw.aeea441ad5de6f11\New_15020c62\gcapi_17311890962908.dll

    Filesize

    348KB

    MD5

    2973af8515effd0a3bfc7a43b03b3fcc

    SHA1

    4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

    SHA256

    d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

    SHA512

    b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

  • \Windows\Temp\asw.aeea441ad5de6f11\uat64.dll

    Filesize

    29KB

    MD5

    5c3a0ff89b572f0a54bdc16bc480527f

    SHA1

    917800855ab584ffe8433dd54d2b4de116d29b2e

    SHA256

    fdb1dc6d11fbe94ccce0efe751db6f034cd20741131572411cffb75d9b1f4b34

    SHA512

    0264af292eca657858a015c5848bbaa831e6b55fcfe2be98a12411511f3a5f8b8071e51ea1f83a800a30349da4e32357374ed0b984ad6fe00e1aaf29540adaf9

  • \Windows\Temp\asw.e2ee3950eba1850e\avg_antivirus_free_setup_x64.exe

    Filesize

    10.7MB

    MD5

    67337e485e2bc58d16b78674194ccf5e

    SHA1

    d9d53590ee45868f5e993e28407d11da18915a49

    SHA256

    2f17ecd381dbb368379d274fc0783a912c6d0e1c1870a741f940d2c71e3f6bef

    SHA512

    bd34d0e4bd321256b7923dffd817923584b99a68bb9b69f30d249f991be2fb0bdc637ca747b2b38c439d8e31dd6ea1b8e1dda742c8df55632c5961b7bdfd306f

  • memory/1644-357-0x000007FEF36F0000-0x000007FEF3ACA000-memory.dmp

    Filesize

    3.9MB

  • memory/1644-356-0x000007FEF3AD0000-0x000007FEF4DF6000-memory.dmp

    Filesize

    19.1MB

  • memory/1644-368-0x000007FEF3AD0000-0x000007FEF4DF6000-memory.dmp

    Filesize

    19.1MB

  • memory/1644-370-0x000007FEF3AD0000-0x000007FEF4DF6000-memory.dmp

    Filesize

    19.1MB