Overview

overview

8

Static

static

1

avira_en_v...st.exe

windows10-ltsc_2021-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    900s
  • max time network
    845s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    09/08/2026, 03:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    avira_en_vpnb0_ae4071f8c940a201__pvpnwws-spotlightvpnadw-test.exe
  • Size 6.5MB
  • Sample260809-eara1sgr3z
  • SHA256 98103ff3f7ac475b6d51384c82613633683101fc7b189649b7be72c9b47201ed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 10 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Executes dropped EXE 25 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 15 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 13 IoCs

    Inno Setup installer

    installer
  • NSIS installer 2 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 23 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\avira_en_vpnb0_ae4071f8c940a201__pvpnwws-spotlightvpnadw-test.exe
    "C:\Users\Admin\AppData\Local\Temp\avira_en_vpnb0_ae4071f8c940a201__pvpnwws-spotlightvpnadw-test.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /Xml "C:\Users\Admin\AppData\Local\Temp\.CR.32162\Avira_Security_Installation.xml" /F /TN "Avira_Security_Installation"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:752
    • C:\Users\Admin\AppData\Local\Temp\.CR.29181\Avira.Spotlight.Bootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\.CR.29181\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.29181\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira_en_vpnb0_ae4071f8c940a201__pvpnwws-spotlightvpnadw-test.exe
      2⤵
      • Checks for any installed AV software in registry
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Users\Admin\AppData\Local\Temp\.CR.29181\ACSSignedIC.exe
        "C:\Users\Admin\AppData\Local\Temp\.CR.29181\ACSSignedIC.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3316
      • C:\Users\Admin\AppData\Local\Temp\.CR.29181\e88d734b-7257-4563-b95f-de72fe43c252\avira_spotlight_setup_pvpnwws.exe
        "C:\Users\Admin\AppData\Local\Temp\.CR.29181\e88d734b-7257-4563-b95f-de72fe43c252\avira_spotlight_setup_pvpnwws.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20260809044627408.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP /LANGUAGE=en-us /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V4
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2908
        • C:\Users\Admin\AppData\Local\Temp\is-B8H75.tmp\avira_spotlight_setup_pvpnwws.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-B8H75.tmp\avira_spotlight_setup_pvpnwws.tmp" /SL5="$A0212,37779838,960512,C:\Users\Admin\AppData\Local\Temp\.CR.29181\e88d734b-7257-4563-b95f-de72fe43c252\avira_spotlight_setup_pvpnwws.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20260809044627408.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP /LANGUAGE=en-us /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V4
          4⤵
          • Checks for any installed AV software in registry
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4008
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" create AviraSecurityUpdater DisplayName= "Avira Security Updater" binPath= "\"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe\"" start= delayed-auto
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1148
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" description AviraSecurityUpdater "Avira Security Updater"
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2568
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Update /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-MNJCS.tmp\UpdateFallbackTask.xml"
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:3460
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Service_SCM_Watchdog /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-MNJCS.tmp\WatchdogServiceControlManagerTimeout.xml"
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:4196
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Systray /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-MNJCS.tmp\SystrayAutostart.xml"
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2532
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Maintenance /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-MNJCS.tmp\MaintenanceTask.xml"
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:4368
      • C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\avira_en_vpnb0_ae4071f8c940a201__pvpnwws-spotlightvpnadw-test.exe
        "C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\avira_en_vpnb0_ae4071f8c940a201__pvpnwws-spotlightvpnadw-test.exe" Action=RegisterFallbackUpdater AllowMultipleInstances=true UnpackInCurrentDirectory=true
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:988
        • C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\.CR.19916\Avira.Spotlight.Bootstrapper.exe
          "C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\.CR.19916\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\.CR.19916\Avira.Spotlight.Bootstrapper.exe" Action=RegisterFallbackUpdater AllowMultipleInstances=true OriginalFileName=avira_en_vpnb0_ae4071f8c940a201__pvpnwws-spotlightvpnadw-test.exe
          4⤵
          • Checks for any installed AV software in registry
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4788
          • C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\.CR.19916\ACSSignedIC.exe
            "C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\.CR.19916\ACSSignedIC.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:444
        • C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\.CR.19916\Avira.Spotlight.Bootstrapper.ReportingTool.exe
          "C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\.CR.19916\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackUnsentEvents
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3848
        • C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\.CR.19916\Avira.Spotlight.Bootstrapper.ReportingTool.exe
          "C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\.CR.19916\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackPresetupEvents C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\.CR.19916\ "Spotlight Presetup Start@134307208111467046:Process ID=988;Os Language=en-US;Action=RegisterFallbackUpdater;Reboot Pending=true;Reboot Count Valid=true;$os=Windows;$os_version=10.0.19044;Bootstrapper Version=1.0.55.984;Os Platform=x64;RunMode=Default;Execute From Temp=false;" "Spotlight Presetup End@134307208147183929:$os_version=10.0.19044;ExitCode=0;$os=Windows;Process ID=988;Os Language=en-US;Action=RegisterFallbackUpdater;Bootstrapper Version=1.0.55.984;Os Platform=x64;RunMode=Default;Execute From Temp=false;"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1160
      • C:\Users\Admin\AppData\Local\Temp\.CR.29181\90400953-2d7e-4012-86ed-f74e3b197094\avira_system_speedup.exe
        "C:\Users\Admin\AppData\Local\Temp\.CR.29181\90400953-2d7e-4012-86ed-f74e3b197094\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG="C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20260809044657905.log" /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=en-us /NOSTART /NORESTART /bundle=vpnb0 /download=pvpnwws /Spotlight
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5024
        • C:\Users\Admin\AppData\Local\Temp\is-STMIJ.tmp\avira_system_speedup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-STMIJ.tmp\avira_system_speedup.tmp" /SL5="$8021A,35953336,916992,C:\Users\Admin\AppData\Local\Temp\.CR.29181\90400953-2d7e-4012-86ed-f74e3b197094\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG="C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20260809044657905.log" /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=en-us /NOSTART /NORESTART /bundle=vpnb0 /download=pvpnwws /Spotlight
          4⤵
          • Checks for any installed AV software in registry
          • Checks computer location settings
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2200
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Delete /F /TN AviraSystemSpeedupRemoval
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2872
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:756
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo
            5⤵
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:3220
          • C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe
            "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe" -umh
            5⤵
            • Drops desktop.ini file(s)
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4496
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\.CR.29181\90400953-2d7e-4012-86ed-f74e3b197094\avira_system_speedup.exe" "C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe"
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:2240
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR "\"C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe\" /VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:3464
          • C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe
            "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -validatelicense
            5⤵
            • Checks for any installed AV software in registry
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4304
          • C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe
            "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -initbootoptimizer
            5⤵
            • Checks for any installed AV software in registry
            • Enumerates connected drives
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3888
          • C:\Users\Admin\AppData\Local\Temp\is-RO99N.tmp\Avira_Optimizer_Host.exe
            "C:\Users\Admin\AppData\Local\Temp\is-RO99N.tmp\Avira_Optimizer_Host.exe" /VERYSILENT
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2556
            • C:\Users\Admin\AppData\Local\Temp\is-T6A18.tmp\Avira_Optimizer_Host.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-T6A18.tmp\Avira_Optimizer_Host.tmp" /SL5="$20280,1552217,832512,C:\Users\Admin\AppData\Local\Temp\is-RO99N.tmp\Avira_Optimizer_Host.exe" /VERYSILENT
              6⤵
              • Checks for any installed AV software in registry
              • Drops file in Program Files directory
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:4292
              • C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe
                "C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe" /Install /Silent
                7⤵
                • Sets service image path in registry
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2072
  • C:\Users\Admin\AppData\Local\Temp\.CR.1563\Avira.Spotlight.Bootstrapper.Runner.exe
    C:\Users\Admin\AppData\Local\Temp\.CR.1563\Avira.Spotlight.Bootstrapper.Runner.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1744
  • C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe
    "C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4820
  • C:\Windows\system32\net.exe
    C:\Windows\system32\net.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4120
    • C:\Windows\system32\net1.exe
      C:\Windows\system32\net1
      2⤵
        PID:2080
    • C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe
      "C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"
      1⤵
      • Checks for any installed AV software in registry
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:2736
    • C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe
      "C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe"
      1⤵
      • Checks for any installed AV software in registry
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1480
    • C:\Program Files (x86)\Avira\Fallback Updater\Avira.Spotlight.FallbackUpdater.exe
      "C:\Program Files (x86)\Avira\Fallback Updater\Avira.Spotlight.FallbackUpdater.exe" FallbackUpdater=true
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3240
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe
      1⤵
      • Launches sc.exe
      PID:4180
    • C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe
      "C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Users\Admin\AppData\Local\Temp\is-026RK.tmp\avira_speedup_setup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-026RK.tmp\avira_speedup_setup.tmp" /SL5="$302A8,35953336,916992,C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe"
        2⤵
        • Checks for any installed AV software in registry
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4804
    • C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe
      "C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"
      1⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1952
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /0
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2272

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Modify Registry

          2
          T1112

          Subvert Trust Controls

          2
          T1553

          Install Root Certificate

          2
          T1553.004

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          4
          T1012

          Software Discovery

          1
          T1518

          Security Software Discovery

          1
          T1518.001

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Antivirus.ContextMenu.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Antivirus.ContextMenu.dll
          • Size 172KB
          • SHA256 7c19378f1975fc35f34660b7961c41b51a927572949b776bd2a9bc0f54a48c86
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SharpShell.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\SharpShell.dll
          • Size 456KB
          • SHA256 c19058158159a62317889eb8ca68114c50ba7cdcaa2064aef279c09894c1c02b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.CompilerServices.Unsafe.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\System.Runtime.CompilerServices.Unsafe.dll
          • Size 19KB
          • SHA256 dfa3261bf8f2ab36b3e9fcdbcc8e0fdc368c0bbc7cc79f1e1e1dcf4ce17b431e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.Tasks.Extensions.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\System.Threading.Tasks.Extensions.dll
          • Size 28KB
          • SHA256 47525b20304398dceaff1aff46801df003f89aa04170b366cbddb07eea5c2a1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\de-DE\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 aaa9213c8fc0abca8f9ecc803e7269f9a9d94ac13f654ce130002d85ebf79db9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\en-US\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 4dc783f5d7429a8a0e6ca88801bb88782d4ac6883e7dec4b1d95bc3822c94342
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\es-ES\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 c2e340f35b85f4cd27245aec374b6396f59cabd698fac6a67c7a637f3b742786
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\fr-FR\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 2c873995e4bb4b6e3c999117bbf0dc3bab5ac57d82973ba7c396b516e71950b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\it-IT\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 96126514bc77b8b5bd026df97f826e74408833e33371ad06a05ae6ecdefb56e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\ja-JP\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 a05cdc8f9a04fa7ba5c3dbc7c03ee1404de90a78a1b5bf92f53974d2298722ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\nl-NL\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 0c4d8882ac33c9e71f0c8e69df695b72916f5b3caa219b596b7224b3016ea55c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\pt-BR\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 56589bbbd5f888f7d6a7c7c390fc056e1fdc3a3b783d1f303c4d8d43aac0b72b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\ru-RU\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 2862f1743f5cd9023799e10345b00bdd4d54db994a741127f7fff15f931d3c6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\tr-TR\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 fb0bbe3475716b2e9e8f3b0579181ec28df5d0509992f605440afcce6b15622b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\zh-CN\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 24cd5983a9d8256b3d23a703e41c92c52a412e316712e35bc691fc5c78b181f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Antivirus.ContextMenu.resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\zh-TW\Antivirus.ContextMenu.resources.dll
          • Size 16KB
          • SHA256 4ce8a3b524b49931c814524ba6866003eaa0bd3048d453a8729987442b53558f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Acp.Common.dll
          • Path C:\Program Files (x86)\Avira\Security\Avira.Acp.Common.dll
          • Size 17KB
          • SHA256 b738ee32b11a58b74686ccd551d0d33b58c3b335d9ba8998ba291c805340c455
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Acp.Resources.dll
          • Path C:\Program Files (x86)\Avira\Security\Avira.Acp.Resources.dll
          • Size 55KB
          • SHA256 294dbf57e56ed4e859addca6dbda81dd401fc0dd9857e38025b655f8d13f87fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Common.Guards.dll
          • Path C:\Program Files (x86)\Avira\Security\Avira.Common.Guards.dll
          • Size 18KB
          • SHA256 d4831973c91f3dc3177b6d18efbc1153f2815103b31d86a2914f0a27f3f1f16c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Common.Mixpanel.dll
          • Path C:\Program Files (x86)\Avira\Security\Avira.Common.Mixpanel.dll
          • Size 70KB
          • SHA256 1dd6bca10ab17546959c3f24b3ce55e19a0f3c591123d83ed41f6fe1cf7eacca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Functional.dll
          • Path C:\Program Files (x86)\Avira\Security\Avira.Functional.dll
          • Size 31KB
          • SHA256 d6c709b267138aab2a15b727d225ea29992e76e3cd72db53553a8a43c47394e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Spotlight.Common.Updater.exe
          • Path C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe
          • Size 295KB
          • SHA256 0e1e2d1ebd63f61f728649333dff329702d81af8cdd73366c21babf16bd8c14f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Spotlight.Common.Updater.exe.config
          • Path C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe.config
          • Size 19KB
          • SHA256 637ecf804a4d062bab18077806679f82434dfe540a03c8e37707eaf211e2ca62
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Spotlight.UI.Application.exe
          • Path C:\Program Files (x86)\Avira\Security\Avira.Spotlight.UI.Application.exe
          • Size 226KB
          • SHA256 ca6d5c3dd9e3983d25ae7bb97688fbe6198acdf3ad1ac996aed0131397314569
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Backends.dll
          • Path C:\Program Files (x86)\Avira\Security\Backends.dll
          • Size 56KB
          • SHA256 138abdf7e7bd33a016f127897febf92f242a27184ffdfb5300da49faf3fb7739
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Common.Interface.dll
          • Path C:\Program Files (x86)\Avira\Security\Common.Interface.dll
          • Size 205KB
          • SHA256 c3ff95eae40c5c8dbff77813063eea629fa04a6fa9aef6a943bb88174fa3d4de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Common.ProductLabel.dll
          • Path C:\Program Files (x86)\Avira\Security\Common.ProductLabel.dll
          • Size 48KB
          • SHA256 bd87acc71613273743c7a12516aa05b3a3e239a6d56a182ec37b15bf92f8293c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Common.Telemetry.dll
          • Path C:\Program Files (x86)\Avira\Security\Common.Telemetry.dll
          • Size 31KB
          • SHA256 4246dbc23a326255127f80dbe1330ad19560d81a234d09e979f3fc3e3e4b6d74
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Common.Utils.dll
          • Path C:\Program Files (x86)\Avira\Security\Common.Utils.dll
          • Size 450KB
          • SHA256 92587d4680bd3f4b4643b843b3e3320a5e84eaea1d594eced611d7a2e08d1fda
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DryIoc.MefAttributedModel.dll
          • Path C:\Program Files (x86)\Avira\Security\DryIoc.MefAttributedModel.dll
          • Size 75KB
          • SHA256 5498f4b296bb687bacc5ecb97dc8afec46f1b745ef53daa38b9b8cddf324874b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DryIoc.dll
          • Path C:\Program Files (x86)\Avira\Security\DryIoc.dll
          • Size 744KB
          • SHA256 a4bf67d37990e05a4b5ce6ff0fb916a167024f3e1902119faaeb3691f5c060ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DryIocAttributes.dll
          • Path C:\Program Files (x86)\Avira\Security\DryIocAttributes.dll
          • Size 32KB
          • SHA256 e9f8959ee6766f7a57c269849f2619899201e46aadc229da7b8fa5faff370048
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Bcl.AsyncInterfaces.dll
          • Path C:\Program Files (x86)\Avira\Security\Microsoft.Bcl.AsyncInterfaces.dll
          • Size 23KB
          • SHA256 03369914fe930dad2890d2e374299df84c589b94efdd7c68d136f01ff60adbe2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Win32.TaskScheduler.dll
          • Path C:\Program Files (x86)\Avira\Security\Microsoft.Win32.TaskScheduler.dll
          • Size 341KB
          • SHA256 4ea3fc5a56e260a54fdfcb02129262f406db79317ed729089a38a3c5bf37d2ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Program Files (x86)\Avira\Security\Newtonsoft.Json.dll
          • Size 701KB
          • SHA256 8f517fa1b57176d3cfc4bb52ccf02c8bd0ee5250e54a0095c259c78d4115401d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProductLabel.dll
          • Path C:\Program Files (x86)\Avira\Security\ProductLabel.dll
          • Size 39KB
          • SHA256 97ff866ea17e47431f241d70565a4234486be23614b32be0f424359f2e878f3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Sentry.dll
          • Path C:\Program Files (x86)\Avira\Security\Sentry.dll
          • Size 594KB
          • SHA256 be437640da3dcb512de2b1028200b9a38740d14719b22cf979e8d5498acce583
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Service.Plugin.Antivirus.Legacy.dll
          • Path C:\Program Files (x86)\Avira\Security\Service.Plugin.Antivirus.Legacy.dll
          • Size 57KB
          • SHA256 cf5f971249a4969fe2d3e97123fa1aa427b138890394b16417ae2fc7705360a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.OptimizerHostClientLibrary.dll
          • Path C:\Program Files (x86)\Avira\System Speedup\Avira.OptimizerHostClientLibrary.dll
          • Size 1.1MB
          • SHA256 6cb71057135bdce45bae960b94777c9deb9d0f9a0132895d7bb8a8b242671a7e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.SystemSpeedup.Core.Common.Starter.exe
          • Path C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe
          • Size 327KB
          • SHA256 604d3e41c4dfd148490de70f87bf08a7411bf940ea42990bfb250d211a97435a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.SystemSpeedup.Maintenance.exe
          • Path C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe
          • Size 351KB
          • SHA256 02218536631fe12a26379227716d96360c1ce263b43f9d76cc9e0e9b4ea223e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Spotlight.Bootstrapper.Runner.exe
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.1563\Avira.Spotlight.Bootstrapper.Runner.exe
          • Size 179KB
          • SHA256 6ea9d61e1de1ae565afa330d7cccd8bbde5e87e88282d17b96fbc5c4ebc52eb2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          avira_en_vpnb0_ae4071f8c940a201__pvpnwws-spotlightvpnadw-test.exe
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\3a2c0258-1a0c-41c4-bc3a-c99a9bdb848f\avira_en_vpnb0_ae4071f8c940a201__pvpnwws-spotlightvpnadw-test.exe
          • Size 6.5MB
          • SHA256 98103ff3f7ac475b6d51384c82613633683101fc7b189649b7be72c9b47201ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          avira_system_speedup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\90400953-2d7e-4012-86ed-f74e3b197094\avira_system_speedup.exe
          • Size 35.4MB
          • SHA256 3729f29c8c79dbece6b7d8e5979bce534194bd4cd3ba4c384c45f9501e5b1f45
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VpnInstaller.exe
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\956deee3-9e30-4ac3-ac4a-684c14c8b4f9\VpnInstaller.exe
          • Size 7.4MB
          • SHA256 84e7c2d32cbb0b1546c14fe3f7fbceb36ca143dbae8f19fb03f91f7a4a42d8ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ACSSIGNEDIC.EXE
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\ACSSIGNEDIC.EXE
          • Size 202KB
          • SHA256 7fbac7f635533ed207d3479cb8a4e5e96fefae5c1ddbdd5f52780ce6c3ddc6c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AVIRA.COMMON.GUARDS.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\AVIRA.COMMON.GUARDS.DLL
          • Size 18KB
          • SHA256 d198614b14efe53a30632926d1147c820ba3d621069e5376be7ceea1cfc4656f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AVIRA.COMMON.MIXPANEL.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\AVIRA.COMMON.MIXPANEL.DLL
          • Size 70KB
          • SHA256 ea184ddc1c0b538fc623ba441b92d0e971c6f8837c82331acc96ea193ddd3775
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AVIRA.FILEDOWNLOADER.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\AVIRA.FILEDOWNLOADER.DLL
          • Size 49KB
          • SHA256 723ec149a22a48b60d156809ff2712c34ff3a715f09e2afff8c646452beba81d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AVIRA.FUNCTIONAL.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\AVIRA.FUNCTIONAL.DLL
          • Size 30KB
          • SHA256 1e76393947abbed9a3124aa5a28298e565516f60a4150062457eea4d7658ed81
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AVIRA.SPOTLIGHT.BOOTSTRAPPER.CORE.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\AVIRA.SPOTLIGHT.BOOTSTRAPPER.CORE.DLL
          • Size 432KB
          • SHA256 86e4b48f2c0445a842e5b2d5e28e320b4919e7ac7d00191ce3f6bde8ca7a7c8f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AVIRA.SPOTLIGHT.BOOTSTRAPPER.ENGINE.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\AVIRA.SPOTLIGHT.BOOTSTRAPPER.ENGINE.DLL
          • Size 373KB
          • SHA256 9c43170724c34412dc22980b87d10002e811a2056ee99ed100ceb665089e15dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
          • Size 1.6MB
          • SHA256 a3958c615d1093345eedf5737f7531b09969145d8b5efa957c61a695c09f5a0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AVIRA.SPOTLIGHT.BOOTSTRAPPER.LOGGING.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\AVIRA.SPOTLIGHT.BOOTSTRAPPER.LOGGING.DLL
          • Size 168KB
          • SHA256 f380f15932eef8470b3f64d3c8762e664cffb7b80f6c6de70a7dcc9b78444e6b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AVIRA.SPOTLIGHT.BOOTSTRAPPER.REACTIVE.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\AVIRA.SPOTLIGHT.BOOTSTRAPPER.REACTIVE.DLL
          • Size 208KB
          • SHA256 5b86d342b8360e6bd31c5a3a8cfc2a92bb6c0de6efa36c795bf26ce5c84ec771
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DRYIOC.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\DRYIOC.DLL
          • Size 441KB
          • SHA256 e11f58cad4c16d6fa8f062b51bf4905d10b0660c58a716e8c087bd0ea3c75391
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DRYIOC.MEFATTRIBUTEDMODEL.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\DRYIOC.MEFATTRIBUTEDMODEL.DLL
          • Size 71KB
          • SHA256 b0f668fadcc77f5f9849c595b4c4e4723aafc1238d7bc4fc74e78e1c04e3de31
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DRYIOCATTRIBUTES.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\DRYIOCATTRIBUTES.DLL
          • Size 34KB
          • SHA256 397e43ac08876c20073ce86d684fb316ee1c287a2c3c7aa0804c00147e164e03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AVIRA.SPOTLIGHT.BOOTSTRAPPER.RESOURCES.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\EN-US\AVIRA.SPOTLIGHT.BOOTSTRAPPER.RESOURCES.DLL
          • Size 31KB
          • SHA256 647aa508add95bc195cf9d7791c1556d4ed794a47f75b0e515b3970a414e251e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MICROSOFT.WINDOWS.SHELL.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\MICROSOFT.WINDOWS.SHELL.DLL
          • Size 162KB
          • SHA256 f83541c793345f6d656355e91f87c66353f80e6932a720367da915b4e41f4f02
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PRODUCTLABEL.COMMON.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\PRODUCTLABEL.COMMON.DLL
          • Size 182KB
          • SHA256 d1fae6cbd78bbda91707df719364a23eb01b87d17935e53e67f88710655f7e3f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PRODUCTLABEL.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\PRODUCTLABEL.DLL
          • Size 258KB
          • SHA256 70865023c6788ba95ad85149f2bc8d06340d15b48a31391bb2f4be459d7755b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          avira_spotlight_setup_pvpnwws.exe
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.29181\e88d734b-7257-4563-b95f-de72fe43c252\avira_spotlight_setup_pvpnwws.exe
          • Size 37.1MB
          • SHA256 4885ced4356263023996b5d29ca0c295440c645dd0f4d97b3dcac1e71b03ee28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira_Security_Installation.xml
          • Path C:\Users\Admin\AppData\Local\Temp\.CR.32162\Avira_Security_Installation.xml
          • Size 1KB
          • SHA256 c4455a4bc78c202efa8a8d98110cb115f56ad6291fe12a22194fc76015cb0bec
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          avira_speedup_setup.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-026RK.tmp\avira_speedup_setup.tmp
          • Size 3.1MB
          • SHA256 56b9020d978ca430602c0b8b0e3ccc868b04bf6aafbe50ff1486a8fb931e857c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          avira_spotlight_setup_pvpnwws.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-B8H75.tmp\avira_spotlight_setup_pvpnwws.tmp
          • Size 3.5MB
          • SHA256 2e909016e41ceab137aa6ed40768e4a1f064e14a97560c2617db5fc4e650f2fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateFallbackTask.xml
          • Path C:\Users\Admin\AppData\Local\Temp\is-MNJCS.tmp\UpdateFallbackTask.xml
          • Size 1KB
          • SHA256 6c3173d55e8d167e8a5bfa6d9b79f4d4690ad8572d360a98fe70fd6eaabd5edd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Avira.Optimizer.Common.Native.Library.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-RO99N.tmp\Avira.Optimizer.Common.Native.Library.dll
          • Size 4.3MB
          • SHA256 1ffbe30a177463c76d6b48d92a0f4c87144d01d7a159463012e1377c36f69280
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira_Optimizer_Host.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-RO99N.tmp\Avira_Optimizer_Host.exe
          • Size 2.3MB
          • SHA256 ecc78f79182ce9ce75efb8a2ff9a7fb3fa9d76290837771dc286154fc2d7bc07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          desktop.ini
          • Path C:\Users\Admin\Desktop\desktop.ini
          • Size 282B
          • SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/756-1190-0x0000000004D50000-0x0000000004D78000-memory.dmp
          Download

          memory/756-1191-0x0000000004E00000-0x0000000004E74000-memory.dmp
          Download

          memory/756-1189-0x00000000003E0000-0x00000000003F2000-memory.dmp
          Download

          memory/1744-55-0x0000000000310000-0x0000000000340000-memory.dmp
          Download

          memory/1952-1321-0x0000000000400000-0x00000000006E1000-memory.dmp
          Download

          memory/1952-1524-0x0000000000400000-0x00000000006E1000-memory.dmp
          Download

          memory/1952-1499-0x0000000000400000-0x00000000006E1000-memory.dmp
          Download

          memory/1952-1409-0x0000000000400000-0x00000000006E1000-memory.dmp
          Download

          memory/2072-1289-0x0000000000400000-0x00000000006E1000-memory.dmp
          Download

          memory/2200-911-0x0000000004AC0000-0x0000000004F66000-memory.dmp
          Download

          memory/2200-1315-0x0000000000400000-0x0000000000728000-memory.dmp
          Download

          memory/2200-1317-0x0000000007770000-0x0000000007892000-memory.dmp
          Download

          memory/2200-1316-0x0000000004AC0000-0x0000000004F66000-memory.dmp
          Download

          memory/2200-915-0x0000000007770000-0x0000000007892000-memory.dmp
          Download

          memory/2272-1615-0x000002B551660000-0x000002B551661000-memory.dmp
          Download

          memory/2272-1616-0x000002B551660000-0x000002B551661000-memory.dmp
          Download

          memory/2272-1609-0x000002B551660000-0x000002B551661000-memory.dmp
          Download

          memory/2272-1611-0x000002B551660000-0x000002B551661000-memory.dmp
          Download

          memory/2272-1610-0x000002B551660000-0x000002B551661000-memory.dmp
          Download

          memory/2272-1621-0x000002B551660000-0x000002B551661000-memory.dmp
          Download

          memory/2272-1620-0x000002B551660000-0x000002B551661000-memory.dmp
          Download

          memory/2272-1619-0x000002B551660000-0x000002B551661000-memory.dmp
          Download

          memory/2272-1618-0x000002B551660000-0x000002B551661000-memory.dmp
          Download

          memory/2272-1617-0x000002B551660000-0x000002B551661000-memory.dmp
          Download

          memory/2504-19-0x0000000006110000-0x0000000006120000-memory.dmp
          Download

          memory/2504-68-0x0000000007B90000-0x0000000007BF6000-memory.dmp
          Download

          memory/2504-46-0x0000000006200000-0x0000000006222000-memory.dmp
          Download

          memory/2504-45-0x00000000061A0000-0x00000000061AA000-memory.dmp
          Download

          memory/2504-42-0x00000000061B0000-0x00000000061C4000-memory.dmp
          Download

          memory/2504-33-0x00000000066D0000-0x0000000006C76000-memory.dmp
          Download

          memory/2504-30-0x0000000006070000-0x00000000060B4000-memory.dmp
          Download

          memory/2504-50-0x0000000006280000-0x0000000006288000-memory.dmp
          Download

          memory/2504-25-0x0000000005FF0000-0x0000000006020000-memory.dmp
          Download

          memory/2504-36-0x0000000006120000-0x000000000614C000-memory.dmp
          Download

          memory/2504-15-0x0000000005F60000-0x0000000005FC0000-memory.dmp
          Download

          memory/2504-12-0x0000000005EF0000-0x0000000005F5E000-memory.dmp
          Download

          memory/2504-53-0x00000000063A0000-0x00000000063AC000-memory.dmp
          Download

          memory/2504-58-0x0000000007B10000-0x0000000007B60000-memory.dmp
          Download

          memory/2504-59-0x0000000007D20000-0x0000000007D5C000-memory.dmp
          Download

          memory/2504-9-0x0000000005E50000-0x0000000005E7C000-memory.dmp
          Download

          memory/2504-67-0x0000000007C00000-0x0000000007C92000-memory.dmp
          Download

          memory/2504-60-0x0000000008670000-0x0000000008678000-memory.dmp
          Download

          memory/2504-39-0x0000000006150000-0x0000000006186000-memory.dmp
          Download

          memory/2504-62-0x000000000A9C0000-0x000000000A9CE000-memory.dmp
          Download

          memory/2504-61-0x000000000BE70000-0x000000000BEA8000-memory.dmp
          Download

          memory/2504-63-0x0000000006110000-0x0000000006120000-memory.dmp
          Download

          memory/2504-6-0x0000000005AE0000-0x0000000005B50000-memory.dmp
          Download

          memory/2504-22-0x0000000005EE0000-0x0000000005EEC000-memory.dmp
          Download

          memory/2504-3-0x0000000000F60000-0x00000000010F2000-memory.dmp
          Download

          memory/2504-47-0x0000000006250000-0x0000000006262000-memory.dmp
          Download

          memory/2504-66-0x0000000006670000-0x0000000006680000-memory.dmp
          Download

          memory/2504-18-0x0000000005EB0000-0x0000000005EC6000-memory.dmp
          Download

          memory/2556-1253-0x0000000000400000-0x00000000004D8000-memory.dmp
          Download

          memory/2556-1297-0x0000000000400000-0x00000000004D8000-memory.dmp
          Download

          memory/2736-888-0x0000000000DA0000-0x0000000000DE2000-memory.dmp
          Download

          memory/2736-895-0x0000000005D80000-0x0000000005D88000-memory.dmp
          Download

          memory/2908-107-0x00000000009B0000-0x0000000000AAA000-memory.dmp
          Download

          memory/2908-94-0x00000000009B0000-0x0000000000AAA000-memory.dmp
          Download

          memory/2908-884-0x00000000009B0000-0x0000000000AAA000-memory.dmp
          Download

          memory/3220-1193-0x000001EB2A140000-0x000001EB2A150000-memory.dmp
          Download

          memory/3220-1196-0x000001EB44550000-0x000001EB4459A000-memory.dmp
          Download

          memory/3220-1195-0x000001EB445D0000-0x000001EB44644000-memory.dmp
          Download

          memory/3220-1194-0x000001EB44520000-0x000001EB44548000-memory.dmp
          Download

          memory/3848-900-0x0000000000C10000-0x0000000000C40000-memory.dmp
          Download

          memory/3888-1341-0x0000000000400000-0x00000000008A6000-memory.dmp
          Download

          memory/3980-1383-0x0000000000400000-0x00000000004ED000-memory.dmp
          Download

          memory/3980-1320-0x0000000000400000-0x00000000004ED000-memory.dmp
          Download

          memory/3980-1290-0x0000000000400000-0x00000000004ED000-memory.dmp
          Download

          memory/4008-705-0x0000000000890000-0x0000000000C16000-memory.dmp
          Download

          memory/4008-108-0x0000000000890000-0x0000000000C16000-memory.dmp
          Download

          memory/4008-883-0x0000000000890000-0x0000000000C16000-memory.dmp
          Download

          memory/4292-1295-0x0000000000400000-0x000000000071B000-memory.dmp
          Download

          memory/4304-1277-0x0000000007B00000-0x0000000007B34000-memory.dmp
          Download

          memory/4304-1274-0x0000000007950000-0x000000000795A000-memory.dmp
          Download

          memory/4304-1276-0x0000000007A90000-0x0000000007ABA000-memory.dmp
          Download

          memory/4304-1275-0x0000000007A30000-0x0000000007A88000-memory.dmp
          Download

          memory/4304-1271-0x0000000007500000-0x000000000753C000-memory.dmp
          Download

          memory/4304-1273-0x0000000007940000-0x000000000794C000-memory.dmp
          Download

          memory/4304-1272-0x00000000074C0000-0x00000000074E1000-memory.dmp
          Download

          memory/4304-1265-0x0000000005E20000-0x0000000005E2C000-memory.dmp
          Download

          memory/4304-1266-0x0000000005FD0000-0x0000000006032000-memory.dmp
          Download

          memory/4304-1233-0x0000000000F80000-0x0000000000FDA000-memory.dmp
          Download

          memory/4304-1267-0x0000000006040000-0x0000000006397000-memory.dmp
          Download

          memory/4304-1268-0x0000000005F70000-0x0000000005FBC000-memory.dmp
          Download

          memory/4304-1260-0x0000000005E60000-0x0000000005EFA000-memory.dmp
          Download

          memory/4304-1259-0x0000000005D90000-0x0000000005DBA000-memory.dmp
          Download

          memory/4304-1258-0x0000000005D20000-0x0000000005D28000-memory.dmp
          Download

          memory/4304-1257-0x0000000005D40000-0x0000000005D58000-memory.dmp
          Download

          memory/4304-1256-0x0000000005CF0000-0x0000000005D1E000-memory.dmp
          Download

          memory/4304-1255-0x0000000005CC0000-0x0000000005CE2000-memory.dmp
          Download

          memory/4304-1264-0x0000000005E00000-0x0000000005E0E000-memory.dmp
          Download

          memory/4304-1262-0x0000000005DD0000-0x0000000005DDE000-memory.dmp
          Download

          memory/4304-1261-0x0000000005D80000-0x0000000005D8A000-memory.dmp
          Download

          memory/4496-1221-0x0000000005030000-0x000000000508E000-memory.dmp
          Download

          memory/4496-1213-0x0000000000640000-0x0000000000694000-memory.dmp
          Download

          memory/4496-1214-0x0000000004FB0000-0x0000000004FC4000-memory.dmp
          Download

          memory/4788-893-0x00000000067C0000-0x0000000006816000-memory.dmp
          Download

          memory/4788-892-0x0000000006660000-0x000000000667A000-memory.dmp
          Download

          memory/4804-1382-0x0000000000400000-0x0000000000728000-memory.dmp
          Download

          memory/4804-1345-0x0000000004A60000-0x0000000004F06000-memory.dmp
          Download

          memory/4804-1322-0x0000000000400000-0x0000000000728000-memory.dmp
          Download

          memory/4804-1323-0x0000000004A60000-0x0000000004F06000-memory.dmp
          Download

          memory/4804-1300-0x0000000004A60000-0x0000000004F06000-memory.dmp
          Download

          memory/4820-871-0x0000000006160000-0x0000000006172000-memory.dmp
          Download

          memory/4820-886-0x0000000006B00000-0x0000000006B22000-memory.dmp
          Download

          memory/4820-877-0x00000000062E0000-0x00000000062F2000-memory.dmp
          Download

          memory/4820-875-0x0000000006530000-0x0000000006698000-memory.dmp
          Download

          memory/4820-876-0x00000000062A0000-0x00000000062BA000-memory.dmp
          Download

          memory/4820-874-0x0000000006300000-0x00000000063B2000-memory.dmp
          Download

          memory/4820-882-0x0000000006430000-0x0000000006444000-memory.dmp
          Download

          memory/4820-873-0x00000000061D0000-0x00000000061DC000-memory.dmp
          Download

          memory/4820-831-0x00000000007E0000-0x000000000082C000-memory.dmp
          Download

          memory/4820-872-0x0000000006150000-0x000000000615C000-memory.dmp
          Download

          memory/4820-881-0x0000000006400000-0x000000000640A000-memory.dmp
          Download

          memory/4820-870-0x0000000006180000-0x00000000061CA000-memory.dmp
          Download

          memory/4820-868-0x0000000006120000-0x000000000612C000-memory.dmp
          Download

          memory/4820-889-0x0000000007540000-0x0000000007B58000-memory.dmp
          Download

          memory/4820-887-0x0000000006B30000-0x0000000006E87000-memory.dmp
          Download

          memory/4820-867-0x00000000060E0000-0x00000000060EA000-memory.dmp
          Download

          memory/4820-865-0x00000000058B0000-0x00000000058BA000-memory.dmp
          Download

          memory/4820-853-0x0000000005700000-0x0000000005772000-memory.dmp
          Download

          memory/4820-866-0x0000000005FA0000-0x0000000005FD2000-memory.dmp
          Download

          memory/4820-880-0x0000000006450000-0x00000000064A8000-memory.dmp
          Download

          memory/4820-864-0x00000000058A0000-0x00000000058AA000-memory.dmp
          Download

          memory/4820-863-0x00000000057F0000-0x00000000057FA000-memory.dmp
          Download

          memory/4820-862-0x0000000005970000-0x0000000005A06000-memory.dmp
          Download

          memory/4820-858-0x00000000057A0000-0x00000000057B6000-memory.dmp
          Download

          memory/4820-861-0x0000000005790000-0x000000000579E000-memory.dmp
          Download

          memory/4820-859-0x0000000005800000-0x0000000005836000-memory.dmp
          Download

          memory/4820-854-0x00000000055C0000-0x00000000055E8000-memory.dmp
          Download

          memory/4820-857-0x0000000005620000-0x000000000562E000-memory.dmp
          Download

          memory/4820-856-0x0000000005610000-0x0000000005620000-memory.dmp
          Download

          memory/4820-855-0x00000000055F0000-0x0000000005606000-memory.dmp
          Download

          memory/4820-852-0x0000000005640000-0x00000000056FC000-memory.dmp
          Download

          memory/5024-904-0x0000000000400000-0x00000000004ED000-memory.dmp
          Download

          memory/5024-1314-0x0000000000400000-0x00000000004ED000-memory.dmp
          Download