2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.exe
Size 262KB
Sample261018-sfe2tses5j
SHA256 2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7
MD5 7aa2d05953f0be44e7c73957dbec708f
SHA1 b6d552e4e96f1a8d56bdbd03015b1d3faa1042ed
SHA512 fc53fdd6dee17476af167b641f29b0ca352b0618f2adc63af052f600fe9121126404b4fcbed16b6a7bcd4348f61de872c185972b4705c504d9f24840cb27dc0d
SSDEEP 3072:13FKK+qOLpWZOpHwOnxjhI1a29nMGkvmUCDzTObdPnF5od1Jc+mTSC/REMz5hMBM:19+qOLoaXjhenMGmmUEebVF+uoi6y6te
TLSH
T1C84427116D918072E1BA1A30E5BC7A7159697FF80B3088DF53B43E2E3F352E29535B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 47 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\burger_client	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ChestFolder	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry = "1"	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MovedFolder	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	icarus.exe
Key opened	\Registry\MACHINE\SOFTWARE\Avast Software\Avast	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ShepherdDebug	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\UpdateVersion	instup.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	instup.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	instup.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\burger_client	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LogFolder	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog = "C:\\ProgramData\\Avast Software\\Persistent Data\\Avast\\Logs\\Setup.log"	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Instup_IgnoredDownloadTypes	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	icarus.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ShepherdDebug	instup.exe
Key opened	\REGISTRY\MACHINE\Software\Avast Software\Avast	icarus.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog = "C:\\ProgramData\\Avast Software\\Persistent Data\\Avast\\Logs\\Setup.log"	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Instup_IgnoredDownloadTypes	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	instup.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
16	1768	jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.exe
47	2488	instup.exe

Writes to the Master Boot Record (MBR) 1 TTPs 8 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_online_x64.exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_online_setup.exe

Executes dropped EXE 8 IoCs

pid	Process
4956	avast_free_antivirus_setup_online_x64.exe
4636	instup.exe
2488	instup.exe
1564	avast_free_antivirus_online_setup.exe
248	icarus.exe
5504	icarus_ui.exe
5392	icarus.exe
5632	icarus.exe

Loads dropped DLL 12 IoCs

pid	Process
1768	jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.exe
4636	instup.exe
4636	instup.exe
4636	instup.exe
4636	instup.exe
2488	instup.exe
2488	instup.exe
2488	instup.exe
2488	instup.exe
1564	avast_free_antivirus_online_setup.exe
5392	icarus.exe
5632	icarus.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 9 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	instup.exe
File opened (read-only)	\??\PhysicalDrive0	instup.exe
File opened (read-only)	\??\PhysicalDrive0	avast_free_antivirus_online_setup.exe
File opened (read-only)	\??\PhysicalDrive0	icarus_ui.exe
File opened (read-only)	\??\PhysicalDrive0	icarus.exe
File opened (read-only)	\??\PhysicalDrive0	icarus.exe
File opened (read-only)	\??\PhysicalDrive0	icarus.exe
File opened (read-only)	\??\PhysicalDrive0	jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.exe
File opened (read-only)	\??\PhysicalDrive0	avast_free_antivirus_setup_online_x64.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	avast_free_antivirus_online_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	avast_free_antivirus_online_setup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avast_free_antivirus_online_setup.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus_ui.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avast_free_antivirus_setup_online_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: avdump_x64_ais-aaf.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Main = "42"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "28"	avast_free_antivirus_setup_online_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "42"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "61"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "98"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "57"	avast_free_antivirus_setup_online_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "100"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "25"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "27"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "32"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: instup.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: sbr.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "0EC03442A4E93B807782D73BF46C389D"	avast_free_antivirus_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "DNS resolving"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "56"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "65"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Updating package: setgui_x64_ais"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "35"	avast_free_antivirus_setup_online_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "6"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "87"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "7"	avast_free_antivirus_setup_online_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "85"	avast_free_antivirus_setup_online_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "40"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "82"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "96"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Main = "57"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: setgui_x64_ais-aaf.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: AvDump.exe"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "10"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "12"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "29"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "59"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "64"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "76"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "49"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: instup_x64_ais-aaf.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Main = "71"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "23"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "38"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "43"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "86"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "95"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: prod-pgm.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "71"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "78"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Main = "0"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "14"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "39"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "45"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "62"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "71"	avast_free_antivirus_setup_online_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "70"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "79"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: avdump_x86_ais-aaf.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Updating package: avdump_x86_ais"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "78"	avast_free_antivirus_setup_online_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "7"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "13"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "50"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "52"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "99"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "100"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "21"	avast_free_antivirus_setup_online_x64.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4956	avast_free_antivirus_setup_online_x64.exe
4956	avast_free_antivirus_setup_online_x64.exe
4956	avast_free_antivirus_setup_online_x64.exe
4956	avast_free_antivirus_setup_online_x64.exe
5504	icarus_ui.exe
5504	icarus_ui.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: 32	4956	avast_free_antivirus_setup_online_x64.exe
Token: SeDebugPrivilege	4956	avast_free_antivirus_setup_online_x64.exe
Token: SeDebugPrivilege	4636	instup.exe
Token: 32	4636	instup.exe
Token: SeDebugPrivilege	2488	instup.exe
Token: 32	2488	instup.exe
Token: SeRestorePrivilege	248	icarus.exe
Token: SeTakeOwnershipPrivilege	248	icarus.exe
Token: SeRestorePrivilege	248	icarus.exe
Token: SeTakeOwnershipPrivilege	248	icarus.exe
Token: SeRestorePrivilege	248	icarus.exe
Token: SeTakeOwnershipPrivilege	248	icarus.exe
Token: SeRestorePrivilege	248	icarus.exe
Token: SeTakeOwnershipPrivilege	248	icarus.exe
Token: SeDebugPrivilege	248	icarus.exe
Token: SeDebugPrivilege	5504	icarus_ui.exe
Token: SeRestorePrivilege	5392	icarus.exe
Token: SeTakeOwnershipPrivilege	5392	icarus.exe
Token: SeRestorePrivilege	5392	icarus.exe
Token: SeTakeOwnershipPrivilege	5392	icarus.exe
Token: SeRestorePrivilege	5392	icarus.exe
Token: SeTakeOwnershipPrivilege	5392	icarus.exe
Token: SeRestorePrivilege	5392	icarus.exe
Token: SeTakeOwnershipPrivilege	5392	icarus.exe
Token: SeRestorePrivilege	5632	icarus.exe
Token: SeTakeOwnershipPrivilege	5632	icarus.exe
Token: SeRestorePrivilege	5632	icarus.exe
Token: SeTakeOwnershipPrivilege	5632	icarus.exe
Token: SeRestorePrivilege	5632	icarus.exe
Token: SeTakeOwnershipPrivilege	5632	icarus.exe
Token: SeRestorePrivilege	5632	icarus.exe
Token: SeTakeOwnershipPrivilege	5632	icarus.exe
Token: SeDebugPrivilege	5392	icarus.exe
Token: SeDebugPrivilege	5632	icarus.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1564	avast_free_antivirus_online_setup.exe
5504	icarus_ui.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4636	instup.exe
2488	instup.exe
5504	icarus_ui.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 4956	1768	jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.exe	88
PID 4956 wrote to memory of 4636	4956	avast_free_antivirus_setup_online_x64.exe	89
PID 4636 wrote to memory of 2488	4636	instup.exe	90
PID 2488 wrote to memory of 1564	2488	instup.exe	92
PID 1564 wrote to memory of 248	1564	avast_free_antivirus_online_setup.exe	93
PID 248 wrote to memory of 5504	248	icarus.exe	94
PID 248 wrote to memory of 5392	248	icarus.exe	95
PID 248 wrote to memory of 5632	248	icarus.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.exe"
1⤵
- Downloads MZ/PE file
- Writes to the Master Boot Record (MBR)
- Loads dropped DLL
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\Temp\asw.e2f197ed1000cbda\avast_free_antivirus_setup_online_x64.exe
  "C:\Windows\Temp\asw.e2f197ed1000cbda\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_mrk_ppi_004_408_q /ga_clientid:1a28b4e8-27c0-44e4-828c-440ade0e6f9a /edat_dir:C:\Windows\Temp\asw.e2f197ed1000cbda
  2⤵
  - Checks for any installed AV software in registry
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\Temp\asw.2e5ee1ff31bef072\instup.exe
    "C:\Windows\Temp\asw.2e5ee1ff31bef072\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.2e5ee1ff31bef072 /edition:1 /prod:ais /stub_context:a7b5ae14-ff45-4a81-9b46-8d4c75890473:12753600 /guid:754a81b4-1af8-4847-93a0-d35a2aaf6c7a /ga_clientid:1a28b4e8-27c0-44e4-828c-440ade0e6f9a /no_delayed_installation /cookie:mmm_mrk_ppi_004_408_q /ga_clientid:1a28b4e8-27c0-44e4-828c-440ade0e6f9a /edat_dir:C:\Windows\Temp\asw.e2f197ed1000cbda
    3⤵
    - Checks for any installed AV software in registry
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - Loads dropped DLL
    - Direct Volume Access: Opens a physical disk for reading
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\Temp\asw.2e5ee1ff31bef072\New_1a0a1856\instup.exe
      "C:\Windows\Temp\asw.2e5ee1ff31bef072\New_1a0a1856\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.2e5ee1ff31bef072 /edition:1 /prod:ais /stub_context:a7b5ae14-ff45-4a81-9b46-8d4c75890473:12753600 /guid:754a81b4-1af8-4847-93a0-d35a2aaf6c7a /ga_clientid:1a28b4e8-27c0-44e4-828c-440ade0e6f9a /no_delayed_installation /cookie:mmm_mrk_ppi_004_408_q /edat_dir:C:\Windows\Temp\asw.e2f197ed1000cbda /online_installer
      4⤵
      Checks for any installed AV software in registry
      Downloads MZ/PE file
      Writes to the Master Boot Record (MBR)
      Executes dropped EXE
      Loads dropped DLL
      Direct Volume Access: Opens a physical disk for reading
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Windows\Temp\asw.2e5ee1ff31bef072\avast_free_antivirus_online_setup.exe
        
        "C:\Windows\Temp\asw.2e5ee1ff31bef072\avast_free_antivirus_online_setup.exe" /cookie:mmm_mrk_ppi_004_408_q /ga_clientid:1a28b4e8-27c0-44e4-828c-440ade0e6f9a /edat_dir:C:\Windows\Temp\asw.e2f197ed1000cbda /ii_reason:SwitchToIcarus
        5⤵
        Writes to the Master Boot Record (MBR)
        Executes dropped EXE
        Loads dropped DLL
        Direct Volume Access: Opens a physical disk for reading
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1564
      - C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\icarus.exe
        
        C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\icarus-info.xml /install /cookie:mmm_mrk_ppi_004_408_q /edat_dir:C:\Windows\Temp\asw.e2f197ed1000cbda /ii_reason:SwitchToIcarus /track-guid:1a28b4e8-27c0-44e4-828c-440ade0e6f9a /sssid:1564
        6⤵
        Writes to the Master Boot Record (MBR)
        Executes dropped EXE
        Direct Volume Access: Opens a physical disk for reading
        Reads the TCP/IP host and domain name from the registry
        Checks processor information in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:248
        
        C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\icarus_ui.exe
        
        C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\icarus_ui.exe /cookie:mmm_mrk_ppi_004_408_q /edat_dir:C:\Windows\Temp\asw.e2f197ed1000cbda /ii_reason:SwitchToIcarus /track-guid:1a28b4e8-27c0-44e4-828c-440ade0e6f9a /sssid:1564 /er_master:master_ep_b0898ceb-4eba-4f03-b198-ea5af8794bfc /er_ui:ui_ep_a759b8a8-8caa-4ae6-8501-126eb686e3bb
        7⤵
        Executes dropped EXE
        Direct Volume Access: Opens a physical disk for reading
        Reads the TCP/IP host and domain name from the registry
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:5504
        
        C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\avast-av-vps\icarus.exe
        
        C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\avast-av-vps\icarus.exe /cookie:mmm_mrk_ppi_004_408_q /edat_dir:C:\Windows\Temp\asw.e2f197ed1000cbda /ii_reason:SwitchToIcarus /track-guid:1a28b4e8-27c0-44e4-828c-440ade0e6f9a /sssid:1564 /er_master:master_ep_b0898ceb-4eba-4f03-b198-ea5af8794bfc /er_ui:ui_ep_a759b8a8-8caa-4ae6-8501-126eb686e3bb /er_slave:avast-av-vps_slave_ep_10a59e57-af6a-48f5-9de8-641a856d9879 /slave:avast-av-vps
        7⤵
        Writes to the Master Boot Record (MBR)
        Executes dropped EXE
        Loads dropped DLL
        Direct Volume Access: Opens a physical disk for reading
        Checks processor information in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:5392
        
        C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\avast-av\icarus.exe
        
        C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\avast-av\icarus.exe /cookie:mmm_mrk_ppi_004_408_q /edat_dir:C:\Windows\Temp\asw.e2f197ed1000cbda /ii_reason:SwitchToIcarus /track-guid:1a28b4e8-27c0-44e4-828c-440ade0e6f9a /sssid:1564 /er_master:master_ep_b0898ceb-4eba-4f03-b198-ea5af8794bfc /er_ui:ui_ep_a759b8a8-8caa-4ae6-8501-126eb686e3bb /er_slave:avast-av_slave_ep_2e966528-4ee9-4ba7-9704-fdf1a4c13a92 /slave:avast-av
        7⤵
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Executes dropped EXE
        Loads dropped DLL
        Direct Volume Access: Opens a physical disk for reading
        Checks processor information in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:5632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 67KB
SHA256 7cb237cf194209db8c8fb493544fbe209e708417b81c915e3a30137fc829ad3b
MD5 c3236bdaeb12d59e185278e514a659e5
SHA1 e1ff7c2fc0fb8b46d232cc75e78491e0a7a9d062
SHA512 421182b24f284c571f9418d1f4782fd6f810020e21990418a3a7e041d76427cfe78f358db858676aceeb2dd3c6b3ff4cb7e284da1fc0bc547a1e3f4015029f2f
SSDEEP 1536:56VatoA0r3FDa9nY4YoQDSIV8qZIYzFyl97L+B1fMV2LEEhZIX6k:5iatoA01a9nY4YoQDSIV8qZIYzFyl97h
TLSH
T1B463EF439F1AF0F711B72208A66E9FE6A63133371B9D84BD736C9358276AF0409CB594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 68KB
SHA256 31199d877df0fcb13c5300f00ba905428f2fc19e4ec2dfd2bca93676ed71ac80
MD5 eb1ce6c188dce0902a2f5693524f41e8
SHA1 3e26040e7b5a8dc4f3f342909ad5d443d954de41
SHA512 bdefa30d8d8fa2bba0139ebd3aa48a2b1b6ea15d0109fd81517e5ec96c046ab993f1912a9ee45220ef4ef5c64a1213a75e9b5f90ef28006a38c9109293629e18
SSDEEP 1536:56VatoA0r3FDa9nY4YoQDSIV8qZIYzFyl97L+B1fMV2LEEhZIX6X:5iatoA01a9nY4YoQDSIV8qZIYzFyl97U
TLSH
T14063EE439F1AF0F711B72204A66E9FE6A63133371B9D84BD73AC9358276AF0409CB594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 78KB
SHA256 6ba3f3a798adffa37ea3200f59f906d5afba4c422d92d48671984d888b0e01f2
MD5 87d8d3e8e0b8ed350ab130427dc8cbfd
SHA1 93fea29dc5f235e0d4704a4b20fc6ee44dd2f3b7
SHA512 f69e085c29cdf30e15f02c412c7f532281212cff6f0fe41e095f2159a46a92a13bf6294e3bed698f05db9f8bd50d14140f1746faedbf4fc6a0785b7b3e8fe76a
SSDEEP 1536:56VatoA0r3FDa9nY4YoQDSIV8qZIYzFyl97L+B1fMV2LEEhZIX6DpSHtQ1C7:5iatoA01a9nY4YoQDSIV8qZIYzFyl97X
TLSH
T19E73EE439F1EF0F712B72208A66D9FDAA67133371B4D84BC73AC9748676AB0409CB594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 13KB
SHA256 ffd75555f0c6ffae4c0ae1b5a3941813296bbad85d06f9a28fbaa29d18a5fa4e
MD5 792cd20caec6f053dce80c7d093acff4
SHA1 d313caa44cb74c846f7dbdecaa7dbd364cdaec46
SHA512 9fd94fab1836ea3dc5f02f75cd94fedf282adf57a3cee2b3dde12b3e21f2fc20fae45bf43ad299c8d88c82a4239fc87304c2bcb3da10ff22de8a9d448bfe27d0
SSDEEP 384:Pm3fsPMoWp5LzC48UoA4IHDt4QP99Z/gG1PVIix2x5x2xkxExxKanj8ZRQ:Pof4W/L246A4IjtZPJHH1M/gWGzgRQ
TLSH
T1CB5242051A1EB4F346F72648EA6C9BBD773031375A6E4878372D73D87369A03964F1A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sui.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sui.log
Size 12KB
SHA256 299e15f6fcd032bcdcdb5d57cb07f3aadcebb541f8b8b7cad64a419bfd4bfed9
MD5 94c0a4dcb5272df25c0d1aabcad00dd0
SHA1 b2cb23150bc69ad36efd2b6cc86442e916fc97c6
SHA512 9dfdca468a9e0d4ba760e0a9a54ec8a530286213aaafb7cdc296fadee95d07baf7006e47c4c86b661ca60afbb55a6134e86b191daec970e46c7162ba35fa39e5
SSDEEP 384:uiVBZ127nOnO+tJQknun/ALninElPyYjYn:mOduOieyYjYn
TLSH
T1F9421D05AA1FF05756BB1F583A5D1B86D3317373025C44BDB76C6E8813DAB4028EFAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temporary_proxy.ini

Path C:\ProgramData\Avast Software\Icarus\settings\temporary_proxy.ini
Size 278B
SHA256 8e511706c04e382e58153c274138e99a298e87e29e12548d39b7f3d3442878b9
MD5 b8853a8e6228549b5d3ad97752d173d4
SHA1 cd471a5d57e0946c19a694a6be8a3959cef30341
SHA512 cf4edd9ee238c1e621501f91a4c3338ec0cb07ca2c2df00aa7c44d3db7c4f3798bc4137c11c15379d0c71fab1c5c61f19be32ba3fc39dc242313d0947461a787
TLSH
T194D05E5307FA0008F1B74A58EBB898F2573378152F4DC02CC0C0121F84F2805892BBE3
MD5 SHA1 SHA512 TLSH

Submit Download

Setup.log

Path C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log
Size 30KB
SHA256 3022a5e60f444abbfb08ba5cf52e4a8e9170a4489f23add555a6758ec91d42df
MD5 f785c53c16d3e87c77a88af49cc426cb
SHA1 99562d6e516bc29461d81100ec342fe2c74c2d80
SHA512 66f1ba08cfb4bac139a6787dd0d4df7bc8e2d440e3ead6a57d3ef7f2f3f63c04c10d98185d7e579d4ab4cf3b316871cfd80b6adce54f12423debaadf108ab6f3
SSDEEP 384:tM/sX6FHAaqZjNroojxPj/jsj7jyjqjTjNdUtDUG0:VQAaqZxrooJDIXWG/RdUtDUl
TLSH
T13EE230A10E19F07742F2E741F448DFAE76A932F3949CC9BC332DA540771EB2A958A4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.log

Path C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log
Size 1KB
SHA256 3d4dc7f40186196ef0dd89fac6ed3afb5b5d677f0922bb6cad2b71c8e4e9e9d3
MD5 48d73a1d63970e548133e43fd8d00380
SHA1 640822bcc4b4e57fd3ac53119374550a9b9a9430
SHA512 8ccb1f4ba421a14013a1eabdd2b8f7dd239e28cb878142392e6a64345152a978bb3614c34d065eb65b9477e39913d9c46b91692a48d40ff0ca0e1eee0b78b88e
TLSH
T1D741BF002B08F27745B26709E4AD9B6E2BA5B3336E49457C7BBCE501372FB1605E7191
MD5 SHA1 SHA512 TLSH

Submit Download

event_manager.log

Path C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\event_manager.log
Size 142B
SHA256 a344a0173261f46f9d5baab2d268f8c6c784edc6b903a970097f63c68ebc69da
MD5 e36a5956c2170aca5f0468fa23eaf3bf
SHA1 94bc03fe51801a4ced1661de86e1eb6f33231cf9
SHA512 447729fe94b036d0d8def8e9d238341faf3d0d252a72dc75c6195e4d7faee59e90e7b2a842addccc5dce1f7e5e83ec15e6fdca4dab45e7959ba3bd9ed5009d7f
TLSH
T1EEC08C92180AF96242BA8321FA20A60A4891A262580CCA083208C908370FA0602900E0
MD5 SHA1 SHA512 TLSH

Submit Download

event_manager.log

Path C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\event_manager.log
Size 281B
SHA256 e775f0de6daf7ab7b5cffda6cca57b435f56a0717383be5743313ad6b9ced3f8
MD5 5b8e6018e03035a557720ca6a8501537
SHA1 7cdcb94eb523a17e8f38552f0377473c3df34815
SHA512 0b6976022d18331a10b6f5d0ce1fcbe0c7b0c001d0a48dcb0f778c036af9bef6dcf25d4bf92ca62c01f2f76576686e227f0d22ff7115e08a86709c154027c1c6
TLSH
T1A7D0C2921E0EFAB241BE8320FB30AA0B4894B2735C0CC708368DC91C770FA0616920E0
MD5 SHA1 SHA512 TLSH

Submit Download

config.def

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\avast-av-vps\config.def
Size 569B
SHA256 200d2bd12f84711868725fc6ada166178be113f3dce0950c45365ff36f954d6f
MD5 65553ad9782bac22f041f0a2fb8fc378
SHA1 40e1fa24787958aa024e8c4c5286db5b81e2f483
SHA512 900895dddd3df6b226be936abbf17ed2f9c34b3590ac6878053d0e3a8f0b16e77c44a2dce9b3a9e41d734203d7107a9784dae5317cef96b80dc769f0479b0abf
TLSH
T187F026B74A14551E5E62CA84003641C5A5D002C44FC4D877C655F74B7FD6D982CDF6BD
MD5 SHA1 SHA512 TLSH

Submit Download

icarus_product.dll

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\avast-av-vps\icarus_product.dll
Size 1.4MB
SHA256 8b51c1aece63f4918e04613aa39ed586f49d45afb5e0ca353f975547bcc40133
MD5 37b34b06963465e81a62c04fb7991781
SHA1 41b6daa76a52fa85143795bc78e39dffbf89363d
SHA512 508270d082fdc4d867449bdad72f38f1ca68a8fcb7e84f278c6fb2b22c47b77f8f630446a5b76e381594023197e0bc0b72ab257b1e270b0cb9c2039e6b87faa0
SSDEEP 24576:NETjdfcoLULC6KaznMbnWvz8D+EfoGdtwQUz1h0lhSMXlsXSRZaf:NSdfcoLCC6LznMbnWvz8D+EfoGdtwiQ6
TLSH
T191657B1A7A5C40F5C2BEC03989939A1EEAB1385543A197DB76EC8E191F17BF41E3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.def

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\avast-av\config.def
Size 983B
SHA256 47588c3dfa785e709ab7acccbae2f0e68b9cc592dbe291dfd783b6b6f7337d8b
MD5 8fbae3abed44e1f960381707aa553ad3
SHA1 342704ea7d9ce3e602a0baa3c5cc299342618491
SHA512 44f2fd14e11fe8b69811c46021ad18d5917a85bad7285ec225c639b2fad10111c90577dd3b3de090d77d8c0ad8215927b1a4053aaebcd388594cd85bd6880d55
TLSH
T174112DA3C600800E1F20D2E4501BE3C0AA9101CA4DD2D89146508A4FEFA2AB069FF4BB
MD5 SHA1 SHA512 TLSH

Submit Download

edition.edat

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\avast-av\edition.edat
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

icarus_product.dll

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\avast-av\icarus_product.dll
Size 7.7MB
SHA256 d7556756e6143410d7f8c321f07edd5bdaeb9b196b1f63114968336ad0983670
MD5 e02ae9727dfaf19a4f512e1635b27e63
SHA1 24da79d1f3dcfcba2c1fb19bd94b21e4368d5023
SHA512 b9e6cf4b6039fe8624507f3b94dd5a4045f2db66c2a7374433d65557ad0a7a81c44ad033fc014bfd1873a00a15d00851e090cc931f2725591fe4ba5b94849e05
SSDEEP 49152:o2dNHxl4Ioyo3UCJREv2vprBrJ2GzVkO+DORBySbLwN5r54OQFbMMMDAYSmFeYJz:fCQlxy3gstHnR8+v7MwzvQQnwL
TLSH
T1DE866B1E7A6C00A9D1BFD1388A57950BEEB178954335A3DB6AE18E550F13BF09E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bug_report.exe

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\bug_report.exe
Size 6.2MB
SHA256 ae8d7c5cc558990d169119110cab6e22d9c8ee63316deefa2ee4396b3a0bbd97
MD5 0f383f5696d0a73b85b11cd89c6ab44b
SHA1 7efa4a07ec88bd29911f41da4aef8b559e6497b7
SHA512 cdfd606ec2c996c0fce6826023bd8b8fc16ccfe9ebfeee26a5fbdeb7e6eda34e01f7831ef917ea9b9fcff9ee670cb14101a39ee62da21827192f5a29f292aeb2
SSDEEP 49152:V2duH/l4gyww7jmxPaDcZvlK7aMWaV+snHrE3ZaZpr3W4sPsmaKXgYP6IuQoLd34:pw7B5rRVVE9/87PQwVV/flyqggzSldN
TLSH
T148667C1E7A2E01E9C1BFE1788A87950BEAB17895433597CB66E18E550F13AF05F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dump_process.exe

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\dump_process.exe
Size 3.9MB
SHA256 0c4a891db19991cb4351e187c2d2b2163aa5ae2a6fa62da192d99bf189455d67
MD5 dbb383b15a96f67de8ad8bd18557ec9c
SHA1 0820e18c55d7d02ee55823b9bb34ccb5f0c3165d
SHA512 8ba1dcb2868285661975895e3ea317ab59f599226994208d0b922345fd940ba2968e48589f5b14336594f440b3ca45c0f3d5182bbd89f81ba76836bb64170983
SSDEEP 49152:dLTZYbKkDVuLu9eu/XGhP9ZzPrS4O1123cX3NKlhtPtMtk+VZ1FTyyFS6IZN8:hecoSzNNN
TLSH
T188167C1E7A1D00EAC1FEE17D8A86550BEA717CA1433557DB66E0AE190F23AF05E7E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.exe

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\icarus.exe
Size 9.4MB
SHA256 b4c91224c06fd252173e5ecf6ea1321af540b136eb996f82199ac496e7949655
MD5 f2c56e20d8b520afa895d0e34e9806f7
SHA1 48d8c6c366c1ccf75b875fb2842c292f031f6191
SHA512 1bc28bbc84a308e97dec6e61ed133f3790193ddc6d5417d194f2386d80a7ad57a5e50298e15cf5c2166a19342b01de06f698fe2b6ea541822b8aef40fcba7166
SSDEEP 98304:X7TG8ExXpT2xJPh9SD81OdvtrZyoU1h0k0X2:X7TG8ExXpKTM81OdvtrZyoaB
TLSH
T1A2A66C1EBA6D01E5C1FED1788647A51BEE717C95033996EB66E08D061F23AF09E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_mod.dll

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\icarus_mod.dll
Size 16KB
SHA256 452cf7f8e5f64bfae85aaf0f70150342b6e1d74f985e96313fc89fe945a85b8c
MD5 cf160d99e24fffb6081ac0cc5f0cc9c5
SHA1 4091408450f9f9475c54f62d694bb2368ef0ad85
SHA512 8d3d694aa1e506107b312237fd6d3e927225b8cd87b99c9de105474ea016aa2a72e7ed645800d2fd5d344392c65fb11668c219e469975bb8d2e16ac071678215
SSDEEP 384:3DkOhUy48pwKNsZqnP3AMwx7bLvxO1uoS:7WZqnUbL0
TLSH
T1B0725A833F203582EFC38D74A4D98BB3AD7173A27F5488DA45748198AC907E13A7816F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_ui.exe

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\icarus_ui.exe
Size 12.4MB
SHA256 e3a4a3dae6db3ed8de3816673a94d73d05cab23a99aea6501956cf55df26a14d
MD5 e6237ebe1ecf906c8c5231d50aa75abe
SHA1 c135d123fc5a96d9a8f77880e13b05770828f2b9
SHA512 47e34ac48ef50d44df93c1342d914bf12be8809dd4588454eebcf260c70995f9931147e73ec4cf615d2d9e1ed5004da07d115bebb1bd94cae87151e99aee709b
SSDEEP 98304:TV9ZQCOW2tZ1fJeBez9FcI+GxHhmihGlmgoFA+aOeShArqNB5:TnazW2tZfeUz9FcI+eHhVyeaSArqNB5
TLSH
T1A3D68E6A76A440D5C1BEC039CA5B950BEBB27895133093CF16F15A5A1F27EF0AE7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\product-def.xml
Size 2.4MB
SHA256 d51bd43858517d0041542efcc2914401b6d303cedb047a2a01a3bf8b9794dc64
MD5 09f8cbacc89e7c6d9a21fbf23a2fdce9
SHA1 0cbe36a597ee3ab0024e2e2b630e1db46abceb78
SHA512 189842718754d972cb679aea9b0bb413c9a931ee42003d69259d7460997e1fb4fdc60e562889dc8774d4381701356d70af501bff8aade6c384d30a81755be03d
SSDEEP 24576:1nBKX9Nn5QqVGcN9lPlfO0RGc/qru4Qd3V7UwaUCu1lThI80BHWR3EUA0m:1nQXPZGcNdf52u7ZBQKTcQRm
TLSH
T1DAB54076759EBC6F714760E7B480BC80628FDD7889E04C6BF1B331409662E729EB1A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-info.xml

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\product-info.xml
Size 12KB
SHA256 183bdc6ac0cb3913305eac2fbf3b9fd2188fdffb1db30d661a9bac97c14ec161
MD5 fc78c3d3752c70467565f84d149b1301
SHA1 845f5d7ccc3947707c223cc6eaf01466dbb4b733
SHA512 4b6b1da85addf9eb3a2a7328fc0f6a729a7411b14765a3b32e3295671a914bd4b1a48ce2ab851da1496d72b6d0d417182c7e3d79de6a3dbeceb4e10b9ffa5878
SSDEEP 192:LVtsvxBAUM5mNma5mYGmJe5JU8wrOCJjyl3Hgb6t4/euNQh1u8WDWZx9aYLyiguG:Lgv0UGmNHQho8yFgToWZvavGDSjB0bC9
TLSH
T13A425272611CFF2B761FA497A1D1B580229FFC3D8BA80C07F1373584A26F578A946974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupui.cont

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\common\setupui.cont
Size 604KB
SHA256 8961658c5c09232d316c4d260c6ffd710d3c1370c01ed24b70c0e5ba64b5c639
MD5 9860e6dd7bd5eff47723322850f94576
SHA1 a704804257a8730d60a010396e86bbc5fb5fa656
SHA512 148127095ab5815b2d6d0bf806c6ea4768442d9b79e096c4d2826d116533a8a3d976fa4b9438e371827d46819ca44190d74ead86ccb9de2551d0b0eeeaeb34c1
SSDEEP 12288:tNNrY15qTBsa1sD/gw9sl3bSDhj2Cmo7iKLJ81EBZIlcy2Orfpgcw8SV83:hrFtLU23bSDFAoZJ83lc0ecw8SV83
TLSH
T11AD423587C86BD18F1E7D3D1D3BD4C46F71A31D3F4E425A8C6AA0332A5A75A886F7006
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpid.edat

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\gpid.edat
Size 7B
SHA256 98b48cc449adda0174b82b5bc4ac9179cb8fff98add04dcc14d0422d5b3908c7
MD5 585c03383897322264239eed29ffb5cf
SHA1 949cbae2ebbfbdb315c4eecff6be0ac8bd83b88f
SHA512 d23ab0becc53c5ce98a45afff600ce178339eac91889b3867baeaea424c7044a80218ea1752f1195d2c397f06e910a5c68ac1e465263598433f03524ba676568
MD5 SHA1 SHA512

Submit Download

gpud.edat

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\gpud.edat
Size 6B
SHA256 3f42931cd0bbebbe3198dd8b8c11305c50a63f9575254c9d44aacc918eb7ae09
MD5 252842cfac83631f3184d7c071b2c26d
SHA1 d27b6cb5675c99421885a51676be9658de336b46
SHA512 b641dc789d6ab8d9c80d11cfce7a639f74641366647a565b29167ceeef055f7df4561bae6b6065e084cc12f3b0618f654f833bf9957d7ab49c15d176551bd6f6
MD5 SHA1 SHA512

Submit Download

icarus-info.xml

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\icarus-info.xml
Size 2KB
SHA256 3d90139f555ba723edc88f4432678fa8c7b39b9ea3d7b2dae69a749bde50d8f3
MD5 48c31b74389ae0b8157edc222c76ab7a
SHA1 10b6666605c139449c19be14360c329caf21fe37
SHA512 0cafbcc4427212662518ea418b05e79839326b731b093fe016c2f6de4e922e19823db020e05600cefb069e3c2e152f9cba549813a11d3ade2beee4d96886a479
TLSH
T12A51A77C623D9F1A3316B5EF7088F8C073EFBC966BE8056311077241EC6A6E62E52120
MD5 SHA1 SHA512 TLSH

Submit Download

package.edat

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\package.edat
Size 2B
SHA256 27a26bca625b223971909dd88fc93faeb050dc5b34d91c0871661740dcfb9d18
MD5 aac1259dfa2c6c5ead508f34e52bb990
SHA1 8ccb8a3f7ac5bd9c4f1ab74cb453f7f32903fb1b
SHA512 2a404c9768dc86190bcc7c98645afa7b6f74488371b974d14da48d7379b2cfae6c8c5bc878ed17d0f9f4c4e62138bfe416cf9a1be31eab07e062c0f5f55ef811
MD5 SHA1 SHA512

Submit Download

skup.edat

Path C:\Windows\Temp\asw-1a28b4e8-27c0-44e4-828c-440ade0e6f9a\skup.edat
Size 8B
SHA256 21e21939386de29943d6a7128d10c9bb4cbab8ca949698394c6d583912e74e4a
MD5 e3d5dd4fa9db9ef78ce048492c97739c
SHA1 e974733d553cf23430023f4b7b770dc7c17378ec
SHA512 678a9776934cecc34ce353bcaf624d5800200e76d01005172ac816d217d9172f8dc590a2f3e6e117144ee56c4746b2d57103d72bfdd19e4b48400f611675a170
MD5 SHA1 SHA512

Submit Download

HTMLayout.dll

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\HTMLayout.dll
Size 4.4MB
SHA256 30893ebc7850700f180fdc1fcae2a4227dea9c8ae145fc3596da700f05892e88
MD5 7aaecf075f6fa43e2b759099045b4b9b
SHA1 61dd0439bdf00cb56a525eca5d2020d3b2ae56d7
SHA512 00505e500bd222963c060b5fee4850774bc5b70a22f3e3b2e1262f5b5f3d62aefaac5860c7bc1d824b98d5d02a61e421b9a0200fb4bb13857a469f48710f53c7
SSDEEP 49152:IQVPS9yXY6QhzR3Qnf/JjSZk9e3oJSu39QnwEuDjuIUdgZlgWnh0Wu5MNPBmxeEi:/LoDouDGNyrqNlUur
TLSH
T1F7267C06796D10A5C6AED038CD67940AEBB1385903F596EB76E08ED95F27BF03E7D200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Instup.dll

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\Instup.dll
Size 24.7MB
SHA256 834becd0a91d28656e4e6da5861106f523de4d58e4779f4668552e7df4fadc05
MD5 9dece4d07e51ae6b646fe3f830a0bc75
SHA1 606b400ccd2ed8886f52f2ddce4f0f3f51c9e430
SHA512 998ff5fe78c25818075f8e3cc1c03610ee43e074291d3cff5bffec42b619a7c7a1a3cdff61363208d1b1851dbdd6252fe0125de262806dad174575eb095c40af
SSDEEP 393216:bfKsPDKcN4qqQSnUD0TS+9PnUiTRtQubFk4vClrQkph1:7ZDv4Rxvc
TLSH
T1F5475B0AAAAC00A4E1FFE278C667550BDB727C91073493DF26A45D591F33BF09A3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Instup.exe

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\Instup.exe
Size 4.3MB
SHA256 eabb5670c386091f930bff968c30a0d9546aeeed1d2c6a2e70c4ba57df335a7b
MD5 724f72c5f296a80ea0aa4204978dfaac
SHA1 a3c68521f91e842e2ca3102c6c1a5079a712a023
SHA512 40776340b5fa11db09478aca01fc336f5eebe98d7199accc09b69d68a2ecb75531c7386c4cd8bf9a70a5d50c887dfd1407c582d5f431f074a4026739b29432b4
SSDEEP 49152:sYaNfgwukmKgbCKJ/HbFrqGG0/jR0ngpW4Rn2jmkAgtMtetr+b1cE0OyDSKYz7F3:kNuJDBq
TLSH
T1D0267D0E7A6D00E9D1FFD13D86A7940AEA717C994335A3EB59E18E540F13AF09E7A700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stats.ini

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\Stats.ini
Size 294B
SHA256 cf8d7dafc9bb6e7a1fa61870fefabee0ff75307d6dd9b3344c5b662d00074c99
MD5 f88fae4f820bc402713be254334b6039
SHA1 20ce460b7eb0aad8d8c678ded0eae4ed576f88e6
SHA512 5cc9c6891869ccd2cb29672d6ac3474164d142c33e9d445912906986954f2b495e0635983b0f0d48605b1618dab56945e5e4a96e8adc4b7d48fbd382d45dddee
TLSH
T121E0420A3A568022F6FB0E0B8839A466761E79C23C38D78C8988784C85E3501C6B29A3
MD5 SHA1 SHA512 TLSH

Submit Download

asw33d3056f8606b4a6.ini

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\asw33d3056f8606b4a6.ini
Size 838B
SHA256 946b3d2b2e577e1f9461b8569751fcf7ff3127f522f57f14475427e91d3e5601
MD5 4d4c3d0874047e7fd8a2bf29d311a31a
SHA1 4edbbc895d6b7b97756d6ec79914c9386039386d
SHA512 b2131c1acde135fad739c3a9cdcb590c7abb0e3d7d14a2fc30966a179a047fa838e2a99ecf285fe9dda91b3252013ca34b05b5044906ae091ec711d38c7d1846
TLSH
T1DD0112C1F23561B9785B8B1E8133E1447F70BF8E27D4C99AA18660C8076F678071B00F
MD5 SHA1 SHA512 TLSH

Submit Download

asw33d3056f8606b4a6.tmp

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\asw33d3056f8606b4a6.tmp
Size 43KB
SHA256 ec3a5c47136ec77d71eada5f9c4ef598340a90ace8282e9e20fc79ecb3d36253
MD5 5fd6655ac283333f9cb2cdd285dfd00c
SHA1 ba92887e0a8a6254dff279fa7864d8b38bf63ebf
SHA512 bea87239b01a5ee309f5784ff84e686bf8c480cc47068aff72f9a760903933e23a375438e142f50b207b36392346ac06fafb166e3b46124dbd14a3e98de9220a
SSDEEP 768:IKbWZbXwcaXoN5MEdWndBxJu/kdX2bqV1IzJjaE6v59GwPPXn8Zm:j+bXZv3GGKIzJj16v59hPPd
TLSH
T192135DA357200A6C8DD5C7DA9E9AE1641CF770CA98C0C4D1CBC0DCDA6EB4783748A36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aswe3c78d18ffa6d9ef.ini

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\aswe3c78d18ffa6d9ef.ini
Size 2KB
SHA256 6980c8170c86774418d19d061ea64c61cad766ca8d4d1d7aa79cb2e8c221c63b
MD5 77969c6668510982f348233d4e6f8d79
SHA1 65aa80906ee6045a1befb2e61169f3d99453c489
SHA512 7dddb598aa504f4935e026aebb5b484101efa6bf01fb24864ca972de5e1c93058a0488dfedc2135146d723fbff7bb155200e16604f586978bbfa064a3e096d9c
TLSH
T1F44144D1D96888B9BD0EDB2FD276B2815AB0CFC712D0499945C6A18C0B5E67E034F06B
MD5 SHA1 SHA512 TLSH

Submit Download

aswe3c78d18ffa6d9ef.tmp

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\aswe3c78d18ffa6d9ef.tmp
Size 49KB
SHA256 e70c477c185078bff7142097e7f05ee0ea0de330420cfcc70e058bac1185daff
MD5 e3fc64cee9946e2267c43e18e3f6f075
SHA1 d996c65d24f935384c6efd547849da8952d1963f
SHA512 1aafcac227a933a67f4aca36d1c0c555613b650e24b311676415bf5119d7ffbacfc088df40f93b79e38713970cfc17d42b82e3d2370ba46019af15653abef794
SSDEEP 768:+93Dy4D1Gtd0UTB76anCSSwcaoXF7rhODSABxJu/kBXabqV1IzJcaE6v59GwPPl4:kD1GoUdjZSZXFHc2pqIzJc16v59hPPm
TLSH
T1D8335CE347510A6C8DE6C6EA9E96E1511CB730CA98C0D0E1CBD1DCD97DB4793B08A36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avast_free_antivirus_online_setup.exe

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\avast_free_antivirus_online_setup.exe
Size 1.7MB
SHA256 1ad33d9b5a2ec1cf2bdce948653928f940c001a7997f0c08ff179f1d67b37c8f
MD5 638b4ffe54514852e3006ac298329690
SHA1 4a7c215f0c826ffcb24e16a8a197b323444fb0ed
SHA512 5714f9a55f672efd81bb217a9000ec3284c202f8046f916e4ac95112ea4aece215694d8108f7bd2829bf5d635986fbe637a19322301e1d43cded7da8e4705e91
SSDEEP 24576:h2mYO+MojhZ9omNAP2mM+GmxDK/rNC01/+Dsh0lhSMXlex0ZeYCIuE:h27O7oj9LmxWzs0d+DRI0Zv
TLSH
T106859D203F46C436E49A51B1992CBFBE862EAE704B7110C763F07E2D6D741D22A36767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avbugreport_x64_ais-aaf.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\avbugreport_x64_ais-aaf.vpx
Size 11.2MB
SHA256 9c834657e4199e38d5f9ca7769e1d2cab1a788ea2f1fbd06ff94935f3ff5b2dc
MD5 3e827f989f92c2b31bea0e3a7e6b5631
SHA1 1389323b78b004a600a2b4666d41087c48ca3c94
SHA512 e50958e244b20bffd201157e549bb908e1c80dad127347821dd2b678dea56c077575bce1124026c929b18a7a2b0af1fbf377061385e75d073797fa47b4188c47
SSDEEP 98304:cI9pbPsKsjcgoKAIFsY3JmA71P8t4vBBgRXmiZn+lWhS4JEqYjk:cInjijRAIFsY3N7St4vBBYWiR6kEqYj
TLSH
T17EC68E5EB67D00E5D4FFD1788786A11BEBB27851037497CB16A08AE90F23AE45E3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avdump_x64_ais-aaf.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\avdump_x64_ais-aaf.vpx
Size 3.9MB
SHA256 65f5fb616cf7766e4ab7ed4c5c4b6f156ffb188d268f91d704565530d7ef10e6
MD5 6f44e4b7741e1b3232111b42a3091d3f
SHA1 4c8b9418e06f3a2594b5f513bcd04926098ab7ac
SHA512 8518cb58ca7ca9389274565bf78d923f7072f3452cc9b865d00e3d9d49b69c98d2adb99476a7f4594f9421883dbe4419761fd9d60f706f8c20a1d884465b5136
SSDEEP 49152:eibKOHu4lyOc/vw2ggLESoV6x6PUNR7NApxz/muKlhtPtJtU+pd0ycTRwJrDehXH:SqwTn6hf
TLSH
T1B3167D0EBA1D00EAC1FEE17D8686550BEA713C95473597CB66E0AE190F23AF15E7E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.def

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\config.def
Size 42KB
SHA256 c37676e7f8ba706e7ed2a212bec107eed882b35b49b1b370df60c8c67460e038
MD5 79a6b2e258fd98b83e508997fa76dd35
SHA1 628559a660a68899502e645ff22ba0273a3556a7
SHA512 ddb81eb12bcc10ab130f54cd9fffc4b916d4bdaad6bc283180df2942482adec980093e8b396e439c5654dfe15154cd45ff841dd353789318a885f9de011387d2
SSDEEP 768:9KbWZbHwcaXoNcbaWnrbxJu/kdYIbqV1IzJjaE6v59GwPPon8PF:w+bHZmmGyhIzJj16v59hPP1
TLSH
T18E135DA357600B6C8DD5C7DA9E9AE1641CF7B08A98C0C8D1CBC1DCD96DB4783748A36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

part-jrog2-1ea2.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\part-jrog2-1ea2.vpx
Size 679B
SHA256 e4328f0cc54685a295eab0737cb54e51729fb4a5473a19c779cf53fb94c0c674
MD5 0e905da2aa4d453ac46676cd46d37870
SHA1 52b6fb2d531906811fa8719eb28d41ce94f1d439
SHA512 e37c4d1544ee7be48f460b90251fd3791b3878965218a7cd79d87594dfa937e0cd3ec7db3f6bd1e08381e2c0fd02dda07f560c9998f7ab01610892f4ea87b299
TLSH
T13E01448F75199E0A4F7019FBC147B7DC4F7175923034553456011E645431F42284F061
MD5 SHA1 SHA512 TLSH

Submit Download

part-prg_ais-1a0a1856.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\part-prg_ais-1a0a1856.vpx
Size 92KB
SHA256 36025021b5b1d386af4d36af657255432435107dcd35a76ef5dddc615ef38247
MD5 de475ecda64e4ed458b2876ac5c7020c
SHA1 8a625740ed267768672fdcae35602ba3ea4bc0d4
SHA512 5c45b4527826b974d0e97e01e7c5d916699bb0d5a203c889f00e12c43ffcc0b9609dc6597d6b469c437ed4c05d8cf599b6049c494c3a5ccf6ea80c28f938b2bf
SSDEEP 1536:/K0+1qLiKJu0QFvamxefJWGL/qnfLLxRRQc2aNCiKTx4R1/OQJ:Lagi02+W2/Affxzv7CiKOH3
TLSH
T1239312ED25B924E9E02A3678C75017B95345D720C8569960807AFC24EECAF790E1ECF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

part-setup_ais-1a0a1856.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\part-setup_ais-1a0a1856.vpx
Size 4KB
SHA256 ddec5db8863e9155f117d5de172dbec596bfc238e4dd1451463bfc6d5469790c
MD5 1262a0980bf50fb0f35eb6a68e1bb332
SHA1 894f2463699250a4826d2679803a317d12757a58
SHA512 d30a46e2db3a287d0db356b0243c309fc2e6671e10ff1646046be19d9d1c47970e9b1396fb9a052b995f9701351be1ffd12a17ce21db8ef357ead2f7ca62ca86
SSDEEP 96:zSKxBMcU9WP9mAx1qQ/BeoOQYYzU4V5p/dojcpiw9s7y6vn:+EBMl92t1RzU4Vz/qjh4s7L
TLSH
T138916B5F6E5714A7392A6CF67945CD180985BA73E1BA49030AE763C3C843E84D398C55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

part-vps_windows-26101800.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\part-vps_windows-26101800.vpx
Size 12KB
SHA256 726d9c3c2b19c6597b262e5dccaa811b84ba75c5c8581e2050a51988a0e97a86
MD5 cdbf599fe537a81073d1cbac30027a03
SHA1 39950b84ad0cad31e8f4ea1b0eab618a93865eb6
SHA512 05fc4d6fa23a971ad81a33633e4e7860ff81852b15617b628a9db0a4333eb8a14531c84a43a7a6efde1d6db04e818ae33351947f1a4e4bd1605bf3e96a1a53c0
SSDEEP 192:4X7CBQPuFVu3rL2mIwrtzefNRtArjKHN5w/4BHlDDaeaqvfreacy:4X7CBDFkawrtib9HN57HJv5vjeacy
TLSH
T18942A00FAEAB74448F2F5A20D4DE92C0A91E94CC96954F43DB9B3F4717D206636092B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prod-pgm.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\prod-pgm.vpx
Size 571B
SHA256 8c78f87d7fcb145366ae43eacd0f7f513312b0379cb47c5cf97e632aeb002085
MD5 df7d6d523cd10c30535c42b70b4153a9
SHA1 a8847fdfd5e0ab72863ed3991b221e79d79c26b3
SHA512 5cf06b0966a2e5265af55441723b66e7d1ecab142582994c3856c0521788d94cdc11221a3a13cd132966a0024773f6780cc9e31614cbdde81d984af6c38f64d9
TLSH
T193F041058EE7823AAD0917484088F211128C8B3660C6A93338EB76F2C0293B3AC02E50
MD5 SHA1 SHA512 TLSH

Submit Download

prod-vps.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\prod-vps.vpx
Size 344B
SHA256 9535ff73cab7de2b703a60aaec54ca0d0268e9345958e0c20cef5d9c12fd938a
MD5 24f624df29548dba5975db892245b5d3
SHA1 02394b0549eeeb4234bae3c2eb8679d815317cc5
SHA512 17fdfde83ce4217914cac4da0b4ff13f02b6926de326760f4399969d71903178a16e202df4437b85b861b7ec9d93341042358913950977f6b5b2e0a1736af9a6
TLSH
T1FAE0C051C40F6F4A9F040057CD0EB4F8D4D8079A3112005BDC0548BF8BA67A5136917E
MD5 SHA1 SHA512 TLSH

Submit Download

prod-vps.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\prod-vps.vpx
Size 344B
SHA256 71fce1e3c5b5c359e7ad0a17039ded35038f9601b9d9e5c86bd43e0ffa44d9cb
MD5 6f9c1bfb085a5e959a435b28e5e6704e
SHA1 e867f50403bbdb0358ecd4f37ed6e7832771b463
SHA512 fab3302915124d352d7d6314e5c7f39135ee184394084a98dec27154e525b15ddf99d12c17a6c82c3360d54228514b3a49bc8767b8d54498af1516bd10dfbbe7
TLSH
T114E0C6EA8B8B7F1BECCA18920CD694C89D58001BEDADE00283B4DD9650C9AF10092662
MD5 SHA1 SHA512 TLSH

Submit Download

sbr_x64_ais-aaf.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\sbr_x64_ais-aaf.vpx
Size 21KB
SHA256 2ac721aaf54b29c7792e8a642479d634ed31c9414512c58e3924ef5971c06ad0
MD5 96e911fd2b25a02e4a0c9ade142f2eab
SHA1 160ef8cb35147ef9d0f0bc9dea6e0fdd1bd69fee
SHA512 adad3c418616f98f4b287f9507b50967a10d363655e4b6351d448f5ffaacd21addfad15b84b64d6304827cddc22bb928d05b54dc68a3fe342306a901963b934f
SSDEEP 384:1cwPA8Oncmn6LDcAV8pwKNsZqnWabnMwx7bLYY9:1cwPA8/DcMpZqnpbL9
TLSH
T11FA26C437B302585FF8689F0B0E58A579C70B3616F1497EF1460C1ADAF60BC27A2922F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servers.def

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\servers.def
Size 29KB
SHA256 fb446d61e6826c3a24098271165e105dbbcfba3170678775c458e3d17f658f6e
MD5 31ddf16c98730a03a090aa7ec782c3f5
SHA1 187d96fe5f6c53184c417cb4c263f645839849f5
SHA512 7b46605b4bf3782591f1f20e7bb6bc9bf9f64f236f1219063189de7f70d70fdc198636d38e57967253938c49d7c92841c9921a01f840fea2248f34dcf75cf024
SSDEEP 768:ZUF1L1K1v1u151i1p14191b1i1h1o151i1v1k1V1G1+1H1Y1J181V1u171G1Z:A9otwD4X63hwryPIBWrMYhOv+n8Z4j
TLSH
T1EBD2F5DA879A668E8D84DDCCA5A6DDF4ED9320D081C2F1E1801EDCCDAD06F1778F8294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servers.def.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\servers.def.vpx
Size 2KB
SHA256 a9dbd48a3b1675a8e74fd46c72628f5dba71692e04f8d92c26a38c5a1272b930
MD5 5adaae937eba0ae8355bd1a172067dcd
SHA1 8679c0bf374886b4b132908ac87068b830481f20
SHA512 9474d8fb580a6d07d8a6786a77fe9e75762727d892d7a2927036e37361204dd4b7f9050c50e3d49d11e659567e5283d0bbc133767a5e0ce20e68a47ab341bebb
TLSH
T16C515DC5ABF6350D5FD07476B3EEC5968EF1B253A9028ED802657EF5A5140C785C90E0
MD5 SHA1 SHA512 TLSH

Submit Download

setup.def

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\setup.def
Size 33KB
SHA256 f28f14a601b01b40ecf3d6f60924bd10b9d6c133e9723cdc3fbb0c6fa59863bb
MD5 67aac5b9c722a9f9e9f4fed650821522
SHA1 eaeb146f6805ed39b44d665c81cb471fe727374a
SHA512 4ede43598ff7a12dec931f9fe2e55903b411ebbddc9cb44d15c61c44d78f3b7faed9c2f7976a8f29abf778b1707b053cd95fadf067af1cde3406241657eec245
SSDEEP 384:KbiCslju7t/Zo4QdvLNQkn4tMxTEYeafKVuB04vI:t3w
TLSH
T14AF2981268CFCD6261FBC1679E50A20DEF3661A3816C78853A9C67735F379E0CA0F169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uat64.dll

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\uat64.dll
Size 31KB
SHA256 5db0a2f04d2a2d095be6f51aacff29b61f2048a2a35f43faa2f6c9051afbe914
MD5 ee4bce3b4d2d6c5212e789cd2c986c0e
SHA1 b8f7bba5e5b3279d14393ae8ce03250a772e259b
SHA512 f3625f206f3b61ea2077850ef12c78335a6dc4c4e74dd36395ae6232e6a400206c77335acdccc4306f1bea3e616e15945abcce8397d150b29ec8db26d31214fa
SSDEEP 768:0PekOCBFdun8aDZgqsQMSZLFDZqn8PbL6:5Iu8FvQMS/DZC8Pi
TLSH
T11AE24B433B50D092EE8F8B74E1F74A67FB707A35AB03A8EF15F1445D2A41B81261E627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uat64.vpx

Path C:\Windows\Temp\asw.2e5ee1ff31bef072\uat64.vpx
Size 17KB
SHA256 ea12058c6d965c2b748360e455fcecaca0254dc5bdc04779c02b751e1be78cbe
MD5 96f25f3dbc30c96d76db1e15fa7cb867
SHA1 bbec111f927f6bf19ccdfcfc98a6f4705b0e56ae
SHA512 f48c65202034fc233dbe5f11d8923da097fbcd0017d7ac424226f53e5b782c97c63ed1154f5371cf109896821fd262d6af27adc613b7a65e2b09ba683c863494
SSDEEP 384:5CN08UJJHMYDnMVPKE2oICAinr4dAk61UPbEBIp8M2+Vy/Ds:5CeJJsUYyEjBAhCaIeKM2HY
TLSH
T1B982F13C490EEC60414C97F5883FCA6756DFB86383EAAC8518106574B61BB6E1CCFE85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avast_free_antivirus_setup_online_x64.exe

Path C:\Windows\Temp\asw.e2f197ed1000cbda\avast_free_antivirus_setup_online_x64.exe
Size 12.2MB
SHA256 4e3335efbc7fc0b88e1cabe7725ac3592733b4f332067edf4f5b568dd1bc8b6e
MD5 a7d313e9e8cf048f7afdf680b259462f
SHA1 2cd22375feecc0d4b7d145f088378eb523b7bc6a
SHA512 f4be8b4f1b84bf89d6c959613a92ad522ab21709976a3be3414c0b1db8ff0711c1b9199ca1ccf23603cf251d03a5f9992ecf621d2803d5098a81c053c872a117
SSDEEP 196608:0r0Far7Mzpv/a1wHnCIKOy4y8IUsagGJLEyZMoEvEGrlx:LMr7MZS1ICyy/UU+MoEHrl
TLSH
T192D6121A7E6C10E4C1BED038C55B650AEA713CE5033496DB26F0AE592F27AF15EBD702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecoo.edat

Path C:\Windows\Temp\asw.e2f197ed1000cbda\ecoo.edat
Size 21B
SHA256 0e4ea49efdf256f8408515b82144602705853e09895d6b8cbb2c338d1c6f7260
MD5 d27d312a70c6eae22e2ab12fa0c1b42d
SHA1 697ba432ae7bec89c1a7978a5bcc73626ba7f100
SHA512 d3d140d601150797f2c7ad5b6a39ecbfea5dda105daf56a948a785eb5af2a0da4aa401798bc0a7f38e07cd6f8957a6cba956fe3fa01f5c51130235b50d3fabf8
MD5 SHA1 SHA512

Submit Download