Edit tour

Windows Analysis Report
MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip

Overview

General Information

Sample Name:	MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip
Analysis ID:	1342832
MD5:	5e6ccbae7e98529febf929d16266987f
SHA1:	5f70c4d02eeb8c2ccfc1e55bb1c20561f4a99dd2
SHA256:	f5efe4bd130acb6905088afb7ebfa1ec3de6aa4f2bcd6cb6605abf4484956634
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Writes to foreign memory regions

Query firmware table information (likely to detect VMs)

Drops executable to a common third party application directory

Allocates memory in foreign processes

Writes many files with high entropy

Writes a notice file (html or txt) to demand a ransom

Tries to harvest and steal browser information (history, passwords, etc)

Queries the volume information (name, serial number etc) of a device

Drops certificate files (DER)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Creates files inside the system directory

Queries the installation date of Windows

Stores large binary data to the registry

Stores files to the Windows start menu directory

Found dropped PE file which has not been started or loaded

query blbeacon for getting browser version

Downloads executable code via HTTP

Enables debug privileges

Drops files with a non-matching file extension (content does not match file extension)

Queries information about the installed CPU (vendor, model number etc)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Drops PE files

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates or modifies windows services

Queries disk information (often used to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64_ra

mozilla-firefox_qK5-VP1.exe (PID: 2068 cmdline: "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe" MD5: E0CB873B4ABC6E0650EBFCF9B7A328FF)

mozilla-firefox_qK5-VP1.tmp (PID: 1344 cmdline: "C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp" /SL5="$2038A,831488,831488,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe" MD5: C2A9A21C0C0BD341958033EA11684FEA)

mozilla-firefox_qK5-VP1.exe (PID: 5448 cmdline: "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe" /SPAWNWND=$20390 /NOTIFYWND=$2038A MD5: E0CB873B4ABC6E0650EBFCF9B7A328FF)

mozilla-firefox_qK5-VP1.tmp (PID: 6524 cmdline: "C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp" /SL5="$D0078,831488,831488,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe" /SPAWNWND=$20390 /NOTIFYWND=$2038A MD5: C2A9A21C0C0BD341958033EA11684FEA)

file_qK5-VP1.exe (PID: 6980 cmdline: "C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe" /LANG=en /NA=Rh85hR64 MD5: F709593FF1FB625B1D073724961F0956)

file_qK5-VP1.tmp (PID: 1840 cmdline: "C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp" /SL5="$203F8,1611420,832512,C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe" /LANG=en /NA=Rh85hR64 MD5: 1968CA694D9B1FB54EDF2A8380F1E0FE)

saBSI.exe (PID: 4172 cmdline: "C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US MD5: BB7CF61C4E671FF05649BDA83B85FA3D)

installer.exe (PID: 1568 cmdline: "C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade MD5: 58EB889F91B5133D5DB88612CA6E5887)

installer.exe (PID: 4108 cmdline: "C:\Program Files\McAfee\Temp2863637682\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade MD5: 38F970B5919FA4F8174F559A91003924)

avg_antivirus_free_setup.exe (PID: 4916 cmdline: "C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 MD5: 26816AF65F2A3F1C61FB44C682510C97)

avg_antivirus_free_online_setup.exe (PID: 4744 cmdline: "C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /ga_clientid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3 MD5: 3771842CBB051810EA827C3855934A32)

icarus.exe (PID: 6704 cmdline: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\icarus-info.xml /install /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3 MD5: 00F3158AA3CAC845A8DDBCE86CF20560)

icarus.exe (PID: 6724 cmdline: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av-vps_slave_ep_ab8b7bb3-1f02-4903-a419-1d553e034ddd /slave:avg-av-vps MD5: 00F3158AA3CAC845A8DDBCE86CF20560)

icarus.exe (PID: 6356 cmdline: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av_slave_ep_8b7017fa-856f-4c37-a8f5-998cf2feee77 /slave:avg-av MD5: 00F3158AA3CAC845A8DDBCE86CF20560)

mozilla-firefox.exe (PID: 4400 cmdline: "C:\Users\user\Downloads\mozilla-firefox.exe" MD5: 8F4A7771AE6B62234B08572A6863CEDC)

setup-stub.exe (PID: 2224 cmdline: .\setup-stub.exe MD5: A30EDC877E77C0A5CE37D5F93BC949DE)

chrome.exe (PID: 6004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.fileplanet.com/windows MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6636 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1928,i,10801690335675068171,112558321772065651,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 15 Nov 2023 07:22:05 GMTContent-Type: application/octet-streamContent-Length: 398800Last-Modified: Wed, 19 Apr 2023 12:54:58 GMTConnection: keep-aliveETag: "643fe4a2-615d0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6b 8d c8 e6 2f ec a6 b5 2f ec a6 b5 2f ec a6 b5 64 94 a5 b4 23 ec a6 b5 64 94 a3 b4 bd ec a6 b5 90 90 a2 b4 3d ec a6 b5 90 90 a5 b4 3a ec a6 b5 64 94 a2 b4 3a ec a6 b5 64 94 a7 b4 2c ec a6 b5 2f ec a7 b5 89 ec a6 b5 90 90 a3 b4 1f ec a6 b5 f8 91 ae b4 7d ec a6 b5 f8 91 59 b5 2e ec a6 b5 f8 91 a4 b4 2e ec a6 b5 52 69 63 68 2f ec a6 b5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 92 e9 ff 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 23 00 c0 01 00 00 00 01 00 00 40 03 00 c0 0c 05 00 00 50 03 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 06 00 00 10 00 00 06 36 06 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 0b 06 00 88 00 00 00 00 10 05 00 4c fb 00 00 00 00 00 00 00 00 00 00 20 e5 05 00 b0 30 00 00 d4 0b 06 00 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 0e 05 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 4d 03 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 40 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 c0 01 00 00 50 03 00 00 c0 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 00 01 00 00 10 05 00 00 fc 00 00 00 c4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

HTTP traffic detected: POST /cgi-bin/iavsevents.cgi HTTP/1.1Connection: Keep-AliveContent-Type: iavs4/statsUser-Agent: AVG Microstub/2.1Content-Length: 268Host: v7event.stats.avast.com

Source: unknown

DNS traffic detected: queries for: d2nko69k18f2wb.cloudfront.net

Source: global traffic

HTTP traffic detected: GET /US/mozilla-firefox.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: dl.jalecdn.com

Source: unknown	HTTPS traffic detected: 3.163.178.91:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.37.179:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.37.179:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.27.203.89:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.37.179:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.37.179:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.37.179:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.37.179:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.37.179:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.190.8.5:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.37.179:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.37.179:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.16:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.16:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.16:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.16:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.16:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.16:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.16:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.240.196.74:443 -> 192.168.2.16:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.240.196.74:443 -> 192.168.2.16:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.235.221.40:443 -> 192.168.2.16:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.235.221.40:443 -> 192.168.2.16:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.235.221.40:443 -> 192.168.2.16:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.188.206.57:443 -> 192.168.2.16:50014 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe

File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	File created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe entropy: 7.99261107729	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\35629e3b-c85e-4581-a75c-9aa7dbcac5d5 entropy: 7.99963634506	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\f7598da6-300b-4836-84a4-2e66e663877a entropy: 7.99986103887	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\b1a48d96-62d9-4a02-9e4e-df840d3f50e8 entropy: 7.99993035713	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\54887df2-d3ac-45fc-9c02-400e5761c668 entropy: 7.99994842041	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\cd423ba8-8e08-4b9d-bb30-e4dbda938cd2 entropy: 7.99857728039	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\setupui.cont entropy: 7.99946982031	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\b6c2f478-64f6-4ffb-a288-1ee9a291a6ff entropy: 7.99938086549	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\analyticsmanager.cab entropy: 7.99961438969	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\browserhost.cab entropy: 7.99953579752	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\browserplugin.cab entropy: 7.99922249191	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\downloadscan.cab entropy: 7.99976400125	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\eventmanager.cab entropy: 7.99956598882	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\logicmodule.cab entropy: 7.99960093777	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\lookupmanager.cab entropy: 7.99852985626	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\mfw-webadvisor.cab entropy: 7.99735105928	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\mfw.cab entropy: 7.99508058214	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\servicehost.cab entropy: 7.99608701279	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\settingmanager.cab entropy: 7.9994274548	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\taskmanager.cab entropy: 7.99954412419	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\uihost.cab entropy: 7.99651369261	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\uimanager.cab entropy: 7.99959504638	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\uninstaller.cab entropy: 7.99935092903	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\updater.cab entropy: 7.99930681513	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\wataskmanager.cab entropy: 7.99983539171	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\wssdep.cab entropy: 7.99865937314	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus_product.dll.lzma entropy: 7.99940731604	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus_rvrt.exe.lzma entropy: 7.99377130708	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus_product.dll.lzma entropy: 7.99989570564	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\aswOfferTool.exe.lzma entropy: 7.99980181862	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\ProgramData\AVG\Antivirus\gaming_mode\dnddetection.dat.ipending.0699c975 entropy: 7.9996461815	Jump to dropped file

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe

File dropped: C:\Program Files\McAfee\Temp2863637682\jslang\eula-en-US.txt -> encryption key for your account secure because without them you may lose access to your data. you are solely responsible and liable for any activity that occurs under your account, including by anyone who uses your account. if there is any unauthorized use or access to your account, you must let us know immediately. we are not responsible for any loss caused by unauthorized use of or access to your account; however, you may be liable for any losses we or others suffer because of the unauthorized use. we do not have access to master passwords and cannot recover your encrypted data if you forget the master password for any password management feature or product. we offer both free and premium versions of our password and identity management software, and the free versions limit the maximum number of unique accounts (such as a website or application login) that you can store. if you have downloaded a premium version of the software at no cost during a promotion, then when the promotional period ends you will not

Jump to dropped file

Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe

File created: C:\Windows\system32\icarus_rvrt.exe

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp

Key value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon version

Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe

Section loaded: sfc.dll

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe

File read: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe

Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe"
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp "C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp" /SL5="$2038A,831488,831488,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe"
Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp	Process created: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe" /SPAWNWND=$20390 /NOTIFYWND=$2038A
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp "C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp" /SL5="$D0078,831488,831488,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe" /SPAWNWND=$20390 /NOTIFYWND=$2038A
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe "C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe" /LANG=en /NA=Rh85hR64
Source: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp "C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp" /SL5="$203F8,1611420,832512,C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe" /LANG=en /NA=Rh85hR64
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe "C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe" /LANG=en /NA=Rh85hR64
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp "C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp" /SL5="$2038A,831488,831488,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe"
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp "C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp" /SL5="$D0078,831488,831488,C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe" /SPAWNWND=$20390 /NOTIFYWND=$2038A
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe	Process created: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /ga_clientid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Users\user\Downloads\mozilla-firefox.exe "C:\Users\user\Downloads\mozilla-firefox.exe"
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.fileplanet.com/windows
Source: C:\Users\user\Downloads\mozilla-firefox.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe .\setup-stub.exe
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1928,i,10801690335675068171,112558321772065651,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Process created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe "C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Source: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp "C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp" /SL5="$203F8,1611420,832512,C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe" /LANG=en /NA=Rh85hR64
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Users\user\Downloads\mozilla-firefox.exe "C:\Users\user\Downloads\mozilla-firefox.exe"
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.fileplanet.com/windows
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\icarus-info.xml /install /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1928,i,10801690335675068171,112558321772065651,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Process created: C:\Program Files\McAfee\Temp2863637682\installer.exe "C:\Program Files\McAfee\Temp2863637682\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av-vps_slave_ep_ab8b7bb3-1f02-4903-a419-1d553e034ddd /slave:avg-av-vps
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av_slave_ep_8b7017fa-856f-4c37-a8f5-998cf2feee77 /slave:avg-av
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av-vps_slave_ep_ab8b7bb3-1f02-4903-a419-1d553e034ddd /slave:avg-av-vps
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av_slave_ep_8b7017fa-856f-4c37-a8f5-998cf2feee77 /slave:avg-av
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Process created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe "C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe	Process created: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /ga_clientid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3
Source: C:\Users\user\Downloads\mozilla-firefox.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe .\setup-stub.exe
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Process created: C:\Program Files\McAfee\Temp2863637682\installer.exe "C:\Program Files\McAfee\Temp2863637682\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade

Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Program Files\McAfee\Temp2863637682\installer.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : select Architecture from Win32_processor where Architecture=5 or Architecture=12
Source: C:\Program Files\McAfee\Temp2863637682\installer.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : select Architecture from Win32_processor where Architecture=5 or Architecture=12
Source: C:\Program Files\McAfee\Temp2863637682\installer.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : select Architecture from Win32_processor where Architecture=5 or Architecture=12

Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp

File created: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp

Source: classification engine

Classification label: mal84.rans.spyw.evad.winZIP@43/229@69/112

Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Key opened: Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Mutant created: \Sessions\1\BaseNamedObjects\Global\{1f6554c2-d7a7-40d9-b3be-1de5d37df66d}Installer
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\3ab359ed30100228a64e9a58c74e8c4e
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Mutant created: \Sessions\1\BaseNamedObjects\Global\{0e71c6a0-3828-42ba-8e37-07180bcc1157}suy
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\3ab359ed30100228a64e9a58c74e8c4e
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Mutant created: \Sessions\1\BaseNamedObjects\{0e71c6a0-3828-42ba-8e37-07180bcc1157}suy
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\75373c9551467e2da6e910632669e725
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\de5f6207c352f8b0cce60f84cc0d84cf
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{32B25EF2-80FD-4C66-97E1-0890D9E9F87B}
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Mutant created: \Sessions\1\BaseNamedObjects\{1f6554c2-d7a7-40d9-b3be-1de5d37df66d}Installer
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\95bab6178d88c1c69a998a8e0beeaa03

Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe

File created: C:\Program Files\Mozilla Firefox\nsy855C.tmp

Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe

File written: C:\ProgramData\AVG\Icarus\settings\proxy.ini

Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp

Window found: window name: TSelectLanguageForm

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Window detected: HYPERLINK "https://cassinilabs.com/privacy-policy/" End User License AgreementHYPERLINK "https://cassinilabs.com/privacy-policy/" Privacy PolicyThis will download Mozilla Firefox to your computer click "Next" to continue.Popular and widely used internet browser softwareWelcome to Mozilla Firefox Download Manager&NextCancel
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Window detected: HYPERLINK "https://cassinilabs.com/privacy-policy/" End User License AgreementHYPERLINK "https://cassinilabs.com/privacy-policy/" Privacy PolicyThis will download Mozilla Firefox to your computer click "Next" to continue.Popular and widely used internet browser softwareWelcome to Mozilla Firefox Download Manager&NextCancel

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip

Static file information: File size 1192377 > 1048576

Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Directory created: C:\Program Files\Mozilla Firefox\nsy855C.tmp
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Directory created: C:\Program Files\Mozilla Firefox\nsy855C.tmp
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Directory created: C:\Program Files\Mozilla Firefox\nso856D.tmp
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Directory created: C:\Program Files\Mozilla Firefox\nso856E.tmp
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Directory created: C:\Program Files\Mozilla Firefox\nso856E.tmp
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Directory created: C:\Program Files\Mozilla Firefox\nso856F.tmp
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\analyticsmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\analyticstelemetry.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\balloon_safe_annotation.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\browserhost.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\browserplugin.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\downloadscan.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\eventmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\icon_complete.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\icon_failed.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\icon_laptop.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\installer.exe
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jquery-1.9.0.min.js
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\l10n.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\logicmodule.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\logicscripts.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\lookupmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\main_close_large.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\mcafeecerts.xml
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\mcafee_pc_install_icon.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\mcafee_pc_install_icon2.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\mfw-mwb.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\mfw-nps.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\mfw-webadvisor.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\mfw.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\resource.dll
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\resourcedll.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\servicehost.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\settingmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\taskmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\telemetry.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\uihost.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\uimanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\uninstaller.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\updater.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa-common.css
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa-core.js
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa-install.css
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa-install.html
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa-ui-install.js
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa-utils.js
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wataskmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa_install_check.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa_install_check2.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa_install_close.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa_install_close2.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa_install_error.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa_logo.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wa_logo2.png
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\webadvisor.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\webadvisor.ico
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\wssdep.cab
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-cs-CZ.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-da-DK.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-de-DE.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-el-GR.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-en-US.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-es-ES.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-es-MX.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-fi-FI.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-fr-CA.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-fr-FR.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-hr-HR.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-hu-HU.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-it-IT.txt
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\Common Files\AVG
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\Common Files\AVG\Icarus
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\Common Files\AVG\Icarus\avg-av
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\setup
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\Common Files\AVG\Overseer
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\setup\aswd2a3a6766f965e6a.tmp
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\setup\config.def.ipending.0699c975
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\BrowserCleanup.ini.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\TuneupSmartScan.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\dnd_helper.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\gaming_hook.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gaming_hook.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\dnd_helper.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\hns_tools.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\aswhook.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsdriver.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswidpm.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswidsagent.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswhook.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk\background.png.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk\background-loading.png.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk\waikamd64.mst.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk\aswShMin.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPEShell.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPEAntivirus.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk\aswRegLib.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPEBrowser.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPECommander.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk\wxbase315u_vc.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RescueDisk\wxmsw315u_core_vc.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\shred.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\snxhk.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\snxhk.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgSnx.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\asulaunch.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\1033
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\1033\aswClnTg.htm.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\1033\aswClnTg.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\1033\aswInfTg.htm.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\1033\aswInfTg.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\1033\Base.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\1033\Boot.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\1033\uiLangRes.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgArDisk.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgArPot.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\BreachGuardSdk.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\aswProperty.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\aswPropertyAv.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\AavmRpch.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\ashShell.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\dll_loader.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\aswCmnOS.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\aswCmnIS.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\aswCmnBS.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\firefox_pass.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\aswBrowser.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\Boost.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\brotli.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\bsdiff.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\bzip2.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\c-ares.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\cef.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\Crypto++.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\cURL.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\Detours.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\dnscrypt-proxy.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\GSL.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\ICU.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\intel_asm.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\jansson.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\JsonCpp.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\lexbor.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\libevent.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\libPNG.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\libsodium.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\LUA.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\lzfse.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\LZMA.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\mbedTLS.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\mhook.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\nanopb.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\nghttp2.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\OpenSSL.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\PCRE.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\protobuf.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\pugixml.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\rapidjson.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\sqlite.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\unrar.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\vxWidgets.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\Xerces.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\xmlParser.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\xxHash.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\yara.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\zlib.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Licenses\EULA.txt.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswCmnBS.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswCmnOS.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswCmnIS.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\ashBase.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\ashServ.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswAv.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\ashShell.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\ashTask.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\ashQuick.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\ashUpd.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswAux.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswDld.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\CommChannel.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\streamback.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\ntp_time.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\sched.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswEngLdr.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswEngSrv.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswLog.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswProperty.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswPropertyAv.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswW8ntf.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\anen.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\perfstats.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\CommonRes.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswSqLt.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\VisthAux.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswChLic.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswIP.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswRvrt.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\log.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\burger_client.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\tasks_core.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\task_performance_logger.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\process_monitor.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\serialization.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\event_routing.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\event_routing_rpc.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\event_manager.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\event_manager_burger.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\event_manager_ga.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\event_manager_er.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\ffl2.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\browser_pass.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\vaarclient.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\module_lifetime.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\dll_loader.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\shepherdsync.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\fltlib_wrapper.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\AVGSvc.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\AavmRpch.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgBoot.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\wsc.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\firefox_pass.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswAMSI.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswBrowser.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\wsc_proxy.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\wsc_proxy.exe.manifest.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\AvEmUpdate.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\SupportTool.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\nos.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswAvBootTimeScanShMin.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\mfc140u.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\mfcm140u.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\crts.cat.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\avg.local_vc142.crt.manifest.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-console-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-console-l1-2-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-datetime-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-debug-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-errorhandling-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-fibers-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l1-2-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l2-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-interlocked-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-libraryloader-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-louserzation-l1-2-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-memory-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-namedpipe-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processenvironment-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-1.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-string-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-synch-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-sysinfo-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-conio-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-convert-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-environment-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-filesystem-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-locale-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-math-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-multibyte-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-private-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-process-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-stdio-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-string-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-time-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\concrt140.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_1.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_2.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_atomic_wait.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_codecvt_ids.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\ucrtbase.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vccorlib140.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vcruntime140.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vcruntime140_1.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\avg.local_vc142.crt.manifest.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-console-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-console-l1-2-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-datetime-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-debug-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-errorhandling-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-fibers-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l1-2-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l2-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-interlocked-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-libraryloader-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-louserzation-l1-2-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-memory-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-namedpipe-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processenvironment-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-1.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-string-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-synch-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-sysinfo-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\API-MS-Win-core-xstate-l2-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-conio-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-convert-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-environment-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-filesystem-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-locale-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-math-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-multibyte-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-private-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-process-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-stdio-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-string-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-time-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\concrt140.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_1.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_2.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_atomic_wait.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_codecvt_ids.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\ucrtbase.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\vccorlib140.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\vcruntime140.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\HTMLayout.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\AvLaunch.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\AVGUI.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\AvConsent.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\jsbridge.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgKbd.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgNetHub.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\libssl-3-x64.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\libcrypto-3-x64.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\protobuf.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgRdr2.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgMonFlt.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgSP.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgRvrt.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgElam.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsh.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgbuniv.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswavdetection.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswcomm.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswdetallocator.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswntsqlite.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswpsic.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswremoval.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswsecapi.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswwinamapi.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgStm.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\RegSvr.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\aswRunDll.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\x86\AvDump.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswRunDll.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\RegSvr.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\AvBugReport.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\AvDump.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\SetupInf.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\overseer.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\avgToolsSvc.exe.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\aswVmm.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\Inf\x64\avgVmm.sys.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\chrome_100_percent.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\chrome_200_percent.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\resources.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\icudtl.dat.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\am.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\ar.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\bg.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\bn.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\ca.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\cs.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\da.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\de.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\el.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\en-GB.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\en-US.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\es-419.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\es.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\et.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\fa.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\fi.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\fil.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\fr.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\gu.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\he.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\hi.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\hr.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\hu.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\id.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\it.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\ja.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\kn.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\ko.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\lt.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\lv.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\ml.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\mr.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\ms.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\nb.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\nl.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\pl.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\pt-BR.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\pt-PT.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\ro.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\ru.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\sk.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\sl.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\sr.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\sv.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\sw.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\ta.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\te.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\th.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\tr.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\uk.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\vi.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\zh-CN.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\locales\zh-TW.pak.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\swiftshader
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\swiftshader\libEGL.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\swiftshader\libGLESv2.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\chrome_elf.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\libcef.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\d3dcompiler_47.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\libEGL.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\libGLESv2.dll.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\snapshot_blob.bin.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\v8_context_snapshot.bin.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\about.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\antiRansomware.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\ask.ogg.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\browserDetection.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\browserDetectionWindow.html.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\browserExtensions.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\core.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\darkWebMonitor.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\dashboard.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\dataShredder.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\done.ogg.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\doNotDisturb.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\driverUpdater.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\feedbackForm.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\firewall.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\help.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\i18n.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\kin.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\libs.js.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-cs.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-da.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-de.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-en.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-en_GB.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-es_ES.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-fi.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-fr.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-hu.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-id.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-it.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-ja.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-ko.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-ms.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-nb.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-nl.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-pl.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-pt_BR.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-pt_PT.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-ru.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-sk.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-sr_CS.json.ipending.0699c975.lzma
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Directory created: C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-sv_SE.json.ipending.0699c975.lzma

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp

File written: C:\Users\user\Downloads\mozilla-firefox.exe

Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\TuneupSmartScan.dll.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\x86\dnd_helper.dll.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\x86\gaming_hook.exe.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\gaming_hook.exe.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\dnd_helper.dll.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\hns_tools.dll.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\x86\aswhook.dll.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsdriver.sys.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\aswidpm.dll.ipending.0699c975	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	File created: C:\Users\user\AppData\Local\Temp\nsd852C.tmp\UAC.dll	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\dnd_helper.dll.ipending.0699c975	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	File created: C:\Users\user\AppData\Local\Temp\nsd852C.tmp\CityHash.dll	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\setupui.cont (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\x86\dnd_helper.dll.ipending.0699c975	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	File created: C:\Users\user\AppData\Local\Temp\nsd852C.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe	File created: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\hns_tools.dll.ipending.0699c975	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	File created: C:\Users\user\AppData\Local\Temp\nsd852C.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	File created: C:\Users\user\AppData\Local\Temp\nsd852C.tmp\InetBgDL.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\bug_report.exe	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\gaming_hook.exe.ipending.0699c975	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\resource.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\botva2.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\dump_process.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\installer.exe	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\TuneupSmartScan.dll.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\x86\aswhook.dll.ipending.0699c975	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\Helper.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\is-O1UUD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	File created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus_product.dll	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsdriver.sys.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\aswOfferTool.exe	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Windows\System32\icarus_rvrt.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	File created: C:\Users\user\AppData\Local\Temp\nsd852C.tmp\WebBrowser.dll	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\x86\gaming_hook.exe.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Program Files\AVG\Antivirus\aswidpm.dll.ipending.0699c975	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus_ui.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe	File created: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\is-EOSUU.tmp	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus_product.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	File created: (copy)	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus_mod.dll	Jump to dropped file
Source: C:\Users\user\Downloads\mozilla-firefox.exe	File created: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Jump to dropped file

Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\setupui.cont (copy)	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus_product.dll	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\aswOfferTool.exe	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	File created: C:\Windows\System32\icarus_rvrt.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\bug_report.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus_ui.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe	File created: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\dump_process.exe	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus_product.dll	Jump to dropped file
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus_mod.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-cs-CZ.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-da-DK.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-de-DE.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-el-GR.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-en-US.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-es-ES.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-es-MX.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-fi-FI.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-fr-CA.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-fr-FR.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-hr-HR.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-hu-HU.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-it-IT.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-ko-KR.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-nb-NO.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-nl-NL.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-pl-PL.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-pt-BR.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-pt-PT.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-ru-RU.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-sk-SK.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-sr-Latn-CS.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-sv-SE.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-tr-TR.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-zh-CN.txt
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	File created: C:\Program Files\McAfee\Temp2863637682\jslang\eula-zh-TW.txt

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\partmgr

Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\McAfee\Temp2863637682\installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	System information queried: FirmwareTableInformation

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp TID: 7080	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp TID: 6952	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp TID: 6952	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp TID: 6680	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp TID: 7108	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe TID: 4732	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe TID: 3036	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe TID: 3480	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe TID: 3036	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Dropped PE file which has not been started: C:\Program Files\AVG\Antivirus\aswidpm.dll.ipending.0699c975	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\Temp2863637682\resource.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\botva2.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Memory allocated: 3D00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Memory allocated: 47F0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Memory allocated: 54B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Memory allocated: 5260000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Memory allocated: 51F0000 memory commit \| memory reserve \| memory write watch

Source: C:\Program Files\McAfee\Temp2863637682\installer.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : select Architecture from Win32_processor where Architecture=5 or Architecture=12
Source: C:\Program Files\McAfee\Temp2863637682\installer.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : select Architecture from Win32_processor where Architecture=5 or Architecture=12
Source: C:\Program Files\McAfee\Temp2863637682\installer.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : select Architecture from Win32_processor where Architecture=5 or Architecture=12

Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File Volume queried: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File Volume queried: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp FullSizeInformation
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	File Volume queried: C:\Program Files\Mozilla Firefox FullSizeInformation
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	File opened: C:\Users\user\AppData\Local

Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	Memory written: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe base: 20C75060000
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	Memory written: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe base: 45A1B822D8

Allocates memory in foreign processes

Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe

Memory allocated: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe base: 20C75060000 protect: page read and write

Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp "c:\users\user\appdata\local\temp\is-616ik.tmp\mozilla-firefox_qk5-vp1.tmp" /sl5="$d0078,831488,831488,c:\users\user\appdata\local\temp\temp1_mde_file_sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qk5-vp1.exe" /spawnwnd=$20390 /notifywnd=$2038a
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qK5-VP1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp "c:\users\user\appdata\local\temp\is-616ik.tmp\mozilla-firefox_qk5-vp1.tmp" /sl5="$d0078,831488,831488,c:\users\user\appdata\local\temp\temp1_mde_file_sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip\mozilla-firefox_qk5-vp1.exe" /spawnwnd=$20390 /notifywnd=$2038a
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe	Process created: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe "c:\windows\temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pttvrlpuzzckt41o5wwkxvsl1qio7wvt8kwts0pbscyo5jmhu09aak2iqjparxmbpkyedrykg9h8 /cookie:mmm_irs_ppi_902_451_o /ga_clientid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:c:\windows\temp\asw.bde788a01c0620e3
Source: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe c:\windows\temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe /icarus-info-path:c:\windows\temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\icarus-info.xml /install /silent /ws /psh:92pttvrlpuzzckt41o5wwkxvsl1qio7wvt8kwts0pbscyo5jmhu09aak2iqjparxmbpkyedrykg9h8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:c:\windows\temp\asw.bde788a01c0620e3
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe c:\windows\temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe /silent /ws /psh:92pttvrlpuzzckt41o5wwkxvsl1qio7wvt8kwts0pbscyo5jmhu09aak2iqjparxmbpkyedrykg9h8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:c:\windows\temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av-vps_slave_ep_ab8b7bb3-1f02-4903-a419-1d553e034ddd /slave:avg-av-vps
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe c:\windows\temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe /silent /ws /psh:92pttvrlpuzzckt41o5wwkxvsl1qio7wvt8kwts0pbscyo5jmhu09aak2iqjparxmbpkyedrykg9h8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:c:\windows\temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av_slave_ep_8b7017fa-856f-4c37-a8f5-998cf2feee77 /slave:avg-av
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe c:\windows\temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe /silent /ws /psh:92pttvrlpuzzckt41o5wwkxvsl1qio7wvt8kwts0pbscyo5jmhu09aak2iqjparxmbpkyedrykg9h8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:c:\windows\temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av-vps_slave_ep_ab8b7bb3-1f02-4903-a419-1d553e034ddd /slave:avg-av-vps
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe c:\windows\temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe /silent /ws /psh:92pttvrlpuzzckt41o5wwkxvsl1qio7wvt8kwts0pbscyo5jmhu09aak2iqjparxmbpkyedrykg9h8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:c:\windows\temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av_slave_ep_8b7017fa-856f-4c37-a8f5-998cf2feee77 /slave:avg-av
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe	Process created: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe "c:\windows\temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pttvrlpuzzckt41o5wwkxvsl1qio7wvt8kwts0pbscyo5jmhu09aak2iqjparxmbpkyedrykg9h8 /cookie:mmm_irs_ppi_902_451_o /ga_clientid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:c:\windows\temp\asw.bde788a01c0620e3

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Users\user\Downloads\mozilla-firefox.exe "C:\Users\user\Downloads\mozilla-firefox.exe"
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.fileplanet.com/windows
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av-vps_slave_ep_ab8b7bb3-1f02-4903-a419-1d553e034ddd /slave:avg-av-vps
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	Process created: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /track-guid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3 /er_master:master_ep_738ca827-da74-4562-9ba1-e9f652c54ede /er_ui:ui_ep_6f29ae36-8495-4fed-b4d0-9942d8f28919 /er_slave:avg-av_slave_ep_8b7017fa-856f-4c37-a8f5-998cf2feee77 /slave:avg-av
Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe	Process created: C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTtVrLPUzzCKt41O5WwKXVSl1QIo7WVt8kWTS0pBScYo5jMhU09AAK2IqjParxmbPKyeDRYKg9H8 /cookie:mmm_irs_ppi_902_451_o /ga_clientid:40b3861a-5115-475b-998d-cf8c430d8b96 /edat_dir:C:\Windows\Temp\asw.bde788a01c0620e3

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\mainlogo.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\WebAdvisor.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\AVG_AV.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\finish.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe	Queries volume information: C:\ProgramData\AVG\Icarus\Logs\icarus.log VolumeInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus.exe	Queries volume information: C:\ProgramData\AVG\Icarus\Logs\icarus.log VolumeInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Queries volume information: C:\ProgramData\AVG\Icarus\Logs\icarus.log VolumeInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Queries volume information: C:\ProgramData\AVG\Icarus\Logs\icarus.log VolumeInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Queries volume information: C:\ProgramData\AVG\Icarus\Logs\event_manager.log VolumeInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Queries volume information: C:\ProgramData\AVG\Icarus\Logs\event_manager.log VolumeInformation
Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe	Queries volume information: C:\ProgramData\AVG\Icarus\Logs\event_manager.log VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-3IJB9.tmp\mozilla-firefox_qK5-VP1.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe

File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\compatibility.ini

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Data from Local System	Exfiltration Over Other Network Medium	11 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 Data Encrypted for Impact	Acquire Infrastructure	1 Software
Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 DLL Side-Loading	LSASS Memory	44 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	1 Registry Run Keys / Startup Folder	211 Process Injection	133 Masquerading	Security Account Manager	22 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 Modify Registry	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	Traffic Duplication	14 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	14 Virtualization/Sandbox Evasion	LSA Secrets	14 Virtualization/Sandbox Evasion	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	211 Process Injection	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\is-EOSUU.tmp	100%	Avira	PUA/OfferCore.Gen
(copy)	29%	ReversingLabs	Win32.PUA.OfferCore
(copy)	25%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\_isetup\_setup64.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\Helper.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\Helper.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\botva2.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\botva2.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\is-EOSUU.tmp	100%	Avira	PUA/OfferCore.Gen
C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\is-O1UUD.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\is-O1UUD.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\is-EOSUU.tmp	100%	Avira	PUA/OfferCore.Gen
C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\CityHash.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\CityHash.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\InetBgDL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\InetBgDL.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\System.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\UAC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\UAC.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\UserInfo.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\UserInfo.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\WebBrowser.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd852C.tmp\WebBrowser.dll	0%	Virustotal		Browse
C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\bug_report.exe	0%	ReversingLabs
C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\bug_report.exe	0%	Virustotal		Browse
C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\dump_process.exe	0%	ReversingLabs
C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\dump_process.exe	0%	Virustotal		Browse
C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	0%	ReversingLabs
C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\is-EOSUU.tmp	100%	Avira	PUA/OfferCore.Gen

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
dl.jalecdn.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://dl.jalecdn.com/US/mozilla-firefox.exe	0%	Avira URL Cloud	safe
http://dl.jalecdn.com/US/mozilla-firefox.exe	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.fileplanet.com	104.27.203.89	true	false		high
a.nel.cloudflare.com	35.190.80.1	true	false		high
accounts.google.com	172.217.14.205	true	false		high
secure.statcounter.com	104.20.219.77	true	false		high
c.statcounter.com	104.20.219.77	true	false		high
cmp.quantcast.com	108.138.94.40	true	false		high
nlb-home-mcafee-7e003388d1151bba.elb.us-west-2.amazonaws.com	44.240.196.74	true	false		high
d2nko69k18f2wb.cloudfront.net	3.163.178.91	true	false		high
dl.jalecdn.com	162.210.197.141	true	false	1%, Virustotal, Browse	unknown
mosaic-nova.apis.mcafee.com	54.190.8.5	true	false		high
analytics-prod-gcp.ff.avast.com	34.117.223.223	true	false		high
cdn.fileplanet.com	104.27.203.89	true	false		high
shepherd-gcp.ff.avast.com	34.160.176.28	true	false		high
www.google.com	142.251.33.100	true	false		high
clients.l.google.com	142.250.217.110	true	false		high
d1i3c1dyhuowa7.cloudfront.net	99.86.37.179	true	false		high
d23sp3kzv1t6m5.cloudfront.net	18.65.229.6	true	false		high
clients1.google.com	unknown	unknown	false		high
analytics.apis.mcafee.com	unknown	unknown	false		high
shepherd.ff.avast.com	unknown	unknown	false		high
sadownload.mcafee.com	unknown	unknown	false		high
v7event.stats.avast.com	unknown	unknown	false		high
clients2.google.com	unknown	unknown	false		high
home.mcafee.com	unknown	unknown	false		high
product-details.mozilla.org	unknown	unknown	false		high
cmp.inmobi.com	unknown	unknown	false		high
analytics.avcdn.net	unknown	unknown	false		high
honzik.avcdn.net	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.fileplanet.com/windows	false		high
about:blank	false		low
http://dl.jalecdn.com/US/mozilla-firefox.exe	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.14.205	accounts.google.com	United States	15169	GOOGLEUS	false
142.251.33.110	unknown	United States	15169	GOOGLEUS	false
142.251.211.234	unknown	United States	15169	GOOGLEUS	false
142.251.211.238	unknown	United States	15169	GOOGLEUS	false
108.138.94.40	cmp.quantcast.com	United States	16509	AMAZON-02US	false
23.192.209.23	unknown	United States	16625	AKAMAI-ASUS	false
99.86.37.179	d1i3c1dyhuowa7.cloudfront.net	United States	16509	AMAZON-02US	false
104.20.218.77	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.215.227	unknown	United States	15169	GOOGLEUS	false
18.65.229.6	d23sp3kzv1t6m5.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.86.183.41	unknown	United States	20940	AKAMAI-ASN1EU	false
104.27.203.89	www.fileplanet.com	United States	13335	CLOUDFLARENETUS	false
142.251.33.100	www.google.com	United States	15169	GOOGLEUS	false
52.84.162.68	unknown	United States	16509	AMAZON-02US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
54.190.8.5	mosaic-nova.apis.mcafee.com	United States	16509	AMAZON-02US	false
34.160.176.28	shepherd-gcp.ff.avast.com	United States	2686	ATGS-MMD-ASUS	false
162.210.197.141	dl.jalecdn.com	United States	30633	LEASEWEB-USA-WDCUS	false
34.117.223.223	analytics-prod-gcp.ff.avast.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.217.110	clients.l.google.com	United States	15169	GOOGLEUS	false
104.86.183.33	unknown	United States	20940	AKAMAI-ASN1EU	false
142.251.33.72	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.20.219.77	secure.statcounter.com	United States	13335	CLOUDFLARENETUS	false
142.251.33.74	unknown	United States	15169	GOOGLEUS	false
142.251.33.99	unknown	United States	15169	GOOGLEUS	false
104.18.20.226	unknown	United States	13335	CLOUDFLARENETUS	false
3.163.178.91	d2nko69k18f2wb.cloudfront.net	United States	16509	AMAZON-02US	false
104.27.204.89	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1342832
Start date and time:	2023-11-15 08:20:51 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample file name:	MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip
Detection:	MAL
Classification:	mal84.rans.spyw.evad.winZIP@43/229@69/112
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, rundll32.exe
Excluded IPs from analysis (whitelisted): 142.251.33.110, 23.192.209.23, 104.86.183.41, 104.86.183.33, 142.251.33.99, 52.84.162.68, 52.84.162.20, 52.84.162.70, 52.84.162.16, 34.104.35.123, 142.250.217.110, 52.13.240.171, 44.240.42.210, 18.236.60.85, 142.251.211.238, 142.251.33.74, 142.250.217.74, 142.250.217.106, 172.217.14.234, 142.250.69.202, 142.251.215.234, 142.251.211.234, 172.217.14.202, 142.251.33.106, 142.251.33.72, 104.18.20.226, 104.18.21.226
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Created / dropped Files

(copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2541680
Entropy (8bit):	7.670383335074764
Encrypted:	false
SSDEEP:
MD5:	F709593FF1FB625B1D073724961F0956
SHA1:	90DDD0F3E846AD6C858A264578AB5055412ED5FD
SHA-256:	EDDE07449DFE986670DD3F7DE55293E2A3AE2509F8C118791D419B6139E59876
SHA-512:	C0F70072E1C8FCA793CD4876EA83952DBBD9E953B99C6D1621070A5DCCB8B3D30CB3C9B69F577C4CA77A1E77F7E672F3E54CFF525F017A3C4BC284D00CD0DF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29% Antivirus: Virustotal, Detection: 25%, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@.................................h.'...@......@...................@....... .......p..............x.&..-...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

C:\Program Files\AVG\Antivirus\BrowserCleanup.ini.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.624111172624227
Encrypted:	false
SSDEEP:
MD5:	4957ED73D5E5E303E351C8F8B7B53E1C
SHA1:	E61238F49E44237C56D4D5B41AEB150160880B74
SHA-256:	59727F7A256B7A70971F2E62B43B0A923937F85689FC3AA4AE50E4FBFBF83499
SHA-512:	DB4854667285BB1CD8D07AB189607EC5BC489AFB2D0A5B5A3388F91CEFD012FECA689787452901E0EB1DE6E8792E69C0097C38B89BBA0D977D0B29E5E5EF2FEB
Malicious:	false
Reputation:	low
Preview:	[App]..ServerURL=http://bcu.ff.avast.com..

C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsdriver.sys.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	modified
Size (bytes):	394048
Entropy (8bit):	5.997290409927169
Encrypted:	false
SSDEEP:
MD5:	C6BF60ED8158BCEF1657E3F1419BDAB4
SHA1:	4CA0D8083B9ED312F52E1857C437BF028D08A354
SHA-256:	9B4A2DF74BB10890DBA6833F74734FAC9025ABC74477E181743CCC513C843E59
SHA-512:	9E6E306AD4F1D5D1CBEB5FAFA1DC0AE1F29F0F926A6EC6D444A73E60C4C4EA9866D41D2CE6B54B368E5F23DA9BB09758ED7E51B329C843C63D483ED2A19F1BB7
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,._.h.1.h.1.h.1...4.i.1...7.o.1...2.n.1...5.o.1...0.o.1.h.0.C.1...2.i.1...4.i.1...8...1....i.1...3.i.1.Richh.1.........PE..d...C(Ke.........." .....F...........k....................................... ......&......A....................................................P.......X.......,.......@]..............T........................... ...8............ ...............................text...\........................... ..h.rdata....... ......................@..H.data...)W...@....... ..............@....pdata..,............:..............@..HPAGE............. ...X.............. ..`INIT....D............x..............@..B.rsrc...X...........................@..B.reloc..............................@..B........................................................................................................................................................................

C:\Program Files\AVG\Antivirus\TuneupSmartScan.dll.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11757504
Entropy (8bit):	6.332893165029533
Encrypted:	false
SSDEEP:
MD5:	68467EAFA5A40C36046080A1727C78B0
SHA1:	17F459A3CAD27DE26F09A315B90A1C3CD5AB5772
SHA-256:	318ABD45345BE81E8B5509C48322BEF70E7434EC87B3AE4A4D29FF538B666CA0
SHA-512:	E598D7B025AFA1E6A649E3936A493CE4FEF76CB1D69505FC458BA44F64C26078FBC6BB01245755E3225995B80212752472D8D2D2303C72D2F543FFA09D0EF48F
Malicious:	true
Reputation:	low
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$............................. .......]......].......].......]..............c...........g.........................].............................*...........P......................................Rich............PE..d....aKe.........." ...$.rj..hI.....0.T...................................... ......#D....`A.........................................g..8....j...........!.....t...H>..x)......T.....{.......................{.(.....n.@.............j.X&...Z..@....................text....pj......rj................. ..`.rdata..2.....j......vj.............@..@.data........0......................@....pdata..t............>..............@..@.didat..............................@....rsrc.....!......!.................@..@.reloc..T...........................@..B................................................................................................................

C:\Program Files\AVG\Antivirus\aswidpm.dll.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	795064
Entropy (8bit):	6.549527054249054
Encrypted:	false
SSDEEP:
MD5:	7322EDB910EC9FF233A8D2FEBD62F22D
SHA1:	F4F1027A752BE19BAA5180CD4135EC335A8DF44F
SHA-256:	AA830B67137E1AC6A5AB6DEC3D3529334B56098080B29F97AA697955FD2890C1
SHA-512:	6F5DBB435473EF30DCD1E55E0CAEDC25693A784601B2D2C74D272545A47169605DB65C95058DAC1A2D5D6E4680EAC40D9EC5A24E799875336D2BD10828605392
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............a.F.a.F.a.FO.!F.a.FO..G.a.FO..G.a.FO..G.a.FO..G.a.F..OF.a.F.a.F.a.F8..G.a.F.a.FEc.F...G.`.F...G.a.F..#F.a.F.aKF.a.F...G.a.FRich.a.F................PE..d...\|cKe.........." ...$............`.....................................................`A........................................pL.......L.......`...........[..H...p)...p..h....".......................#..(....!..@............................................text...\........................... ..`.rdata..............................@..@.data...D~.......*...^..............@....pdata...[.......\..................@..@.rsrc........`......................@..@.reloc..h....p......................@..B........................................................................................................................................................................................................................

C:\Program Files\AVG\Antivirus\dnd_helper.dll.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	892856
Entropy (8bit):	5.798688758663174
Encrypted:	false
SSDEEP:
MD5:	F6CCD922A806D338EA451E193094C117
SHA1:	AC1730A830E2D513A1EDEF7C8FF2882A6677D82E
SHA-256:	08992B01B11A1463DD5C8183DFF4691CFF693F907D34D6A09681359FFA78C558
SHA-512:	D81A37781A68532D5B78D63562FCD1469F8DAD6D1C53DB09AF457BF05A731655F9BAC6FBABAE40FD50E524AF7669C202B6C11F79FF61C13DDF6B598B4D677209
Malicious:	true
Reputation:	low
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........HMK.&.K.&.K.&.....I.&...".C.&...%.I.&...'.M.&...%.I.&...".I.&.B..Y.&._.'.C.&...#.T.&...#.J.&...".H.&...'.^.&.K.'.L.&._./...&._.&.J.&._...J.&.K...I.&._.$.J.&.RichK.&.................PE..d....bKe.........." ...$.x..........................................................[.....`A................................................P...........X....P...L..Hv..p)......X...x...........................(.......@...................L...`....................text....w.......x.................. ..`.rdata..............\|..............@..@.data...P....0......................@....pdata...L...P...N..................@..@.didat..0............`..............@....rsrc...X............b..............@..@.reloc..X............j..............@..B................................................................................................................................................

C:\Program Files\AVG\Antivirus\gaming_hook.exe.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	483776
Entropy (8bit):	6.789472107809079
Encrypted:	false
SSDEEP:
MD5:	D65A30E49AB30099C979518AAD62CD5E
SHA1:	944F6BB9287C94C00DABDC4556E3B9EE24730709
SHA-256:	904AB5C97B23B37D72B41F328E673F65BD065E04797DF89F3095CF1ED64BAE8D
SHA-512:	D59CAEFEA0AEBA6DE064DAEF0BE20AFEBA6F123FF0A48B38180C79A825BD28AE427CF5D7EBA33F33EB7AB6BF6603E9DF752153837B426120B363E63C2E4DD1FD
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A.X. ... ... ..n^x.. ..n^... ..n^... ..n^... ..n^... ... ... ...X... ...R... ... ..."..._... ..._... ..._z.. ... ... ..._... ..Rich. ..................PE..d...zbKe.........."....$.....d.......Z.........@..........................................`.........................................0...........T....`.......0..$-..H8..x)...p..L....e.......................f..(....d..@............................................text............................... ..`.rdata..............................@..@.data....-..........................@....pdata..$-...0......................@..@.rsrc........`.......,..............@..@.reloc..L....p.......4..............@..B........................................................................................................................................................................................................................

C:\Program Files\AVG\Antivirus\hns_tools.dll.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	731584
Entropy (8bit):	6.612231827190502
Encrypted:	false
SSDEEP:
MD5:	60F1660B4FD7F9BCBA8EEB220761DB4B
SHA1:	9E107DAFC294C5996EFE461B8485CF532167309D
SHA-256:	604BF8BCD4E6EB7AA0F498592B930A08D74E3B749D1E0E5AC0555218AE6D81FB
SHA-512:	F0AB65E441FC1EE1CF338E28B81801EDA2848C83F3766AE690A6FE8FB2F5BD67AC660216F53873AF5181D658225D41836CFD5234138E2DA375F821C00E3D869E
Malicious:	true
Reputation:	low
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........\..W=.W=.W=..C..V=..C.._=..C.U=..C.Q=.O.U=.O..U=.^Ea.G=.O.[=..C..H=..H..T=.CB.\=.W=..<.CB...=.CB.V=.CB..V=.W=e.V=.CB..V=.RichW=.................PE..d....bKe.........." ...$.V...................................................`............`A........................................p...X.......h....@..8.......`W..H...x)...P..$...............................(....a..@............p......$........................text....U.......V.................. ..`.rdata.......p.......Z..............@..@.data....... ......................@....pdata..`W.......X..................@..@.didat..p....0......................@....rsrc...8....@......................@..@.reloc..$....P......................@..B........................................................................................................................................................

C:\Program Files\AVG\Antivirus\setup\aswd2a3a6766f965e6a.tmp (copy)

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	ASCII text, with very long lines (2194), with CRLF line terminators
Category:	dropped
Size (bytes):	18271
Entropy (8bit):	5.645258877192454
Encrypted:	false
SSDEEP:
MD5:	40E291A25D7EBE5AB93ED33947A6DA45
SHA1:	1E5790FFC68A8FC699D5204EB12996F27CB16F33
SHA-256:	1D5E26D0BBC8486E987F53CC5E6BAE5CABC5EF470C3949246C4AB4467C3ECE0A
SHA-512:	67B2CBDBD34BF37A61FBB436E4582270C75F965D12AA5C662DF868EFF743EF6054D68D059EDAAB28D8B06F6CD9A25BA064DDE31A227ED88FAE575D0C9C04EB6E
Malicious:	false
Reputation:	low
Preview:	[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[Settings.UserInterface]..ShellExtensionFileName=0..[WebmailSignature]..GmailEnabled=0..MaxRequestSize=16384..OutlookEnabled=0..YahooEnabled=0..[WebShield.NXRedirect]..Redirect=0..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=2..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=1..[Settings.{D93EF81A-B92F-27FE-AF54-9278EA8BF910}.const]..ScanAreas=*RTK-SUPERQUICK;QuickStartup;QuickMemory..[AntiTrack]..Enabled=0..[FileSystemShield.FileSystem]..EngineLdrModuleFlags=0..[Fmwlite]..License_check_interval=16..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_fw=2..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicensed_period=3600..LicensedClean=1..UseGF1License=1..[StreamFilter.HttpPlugin]..ATisON=0..DohMode=3..Pinning=0..[OPM]..def_base=e

C:\Program Files\AVG\Antivirus\setup\config.def.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	ASCII text, with very long lines (2194), with CRLF line terminators
Category:	dropped
Size (bytes):	19825
Entropy (8bit):	5.653373186828192
Encrypted:	false
SSDEEP:
MD5:	1CB1E54F0C727AEC4C4C6E38ACC39959
SHA1:	8953DF91C8CCF4720B10219029A414018A992501
SHA-256:	6AEFF21F8593CA092466244AC3AF0D20215C290ADB279946B2A7DD8435CFD02D
SHA-512:	B1B36D6A581D787C3C11D65675AFFF9757421230D1690C0FDF3D0F115911F04834144FE7D23FEF81771B68703EECF3AEAEA4737072163BFBC91BDF73CD1D659B
Malicious:	false
Reputation:	low
Preview:	[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[WebShield.WebSocket]..Enabled=1..[Settings.UserInterface]..ShellExtensionFileName=0..[WebmailSignature]..GmailEnabled=1..MaxRequestSize=16384..OutlookEnabled=1..YahooEnabled=1..[WebShield.NXRedirect]..Redirect=0..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=0..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=1..[Offers.SecureBrowser]..ShowInIntro=1..[Settings.{D93EF81A-B92F-27FE-AF54-9278EA8BF910}.const]..ScanAreas=*RTK-SUPERQUICK;QuickStartup;QuickMemory..[AntiTrack]..Enabled=0..[FileSystemShield.FileSystem]..EngineLdrModuleFlags=24..[Fmwlite]..License_check_interval=16..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_fw=2..ais_cmp_safeprice=0..ais_cmp_safeprice_chrome=0..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicensed_

C:\Program Files\AVG\Antivirus\x86\aswhook.dll.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	PE32 executable (DLL) (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72120
Entropy (8bit):	6.53220071471375
Encrypted:	false
SSDEEP:
MD5:	9B4C25E323EE1033CA98D9760DEE7A50
SHA1:	23B7E5CD9C033E18DBA806E3FEE2CB1335AD02C5
SHA-256:	E185CBBF0AF5B8C38FE153E7C918655D3EEC40558BDBDB21BA85EA30369D196D
SHA-512:	6C125AC583657B1A11D8A4498EA9145E800492A6E1C947E96E3BDBCC17C59BDA16D4386BCBFCA72821A62A8B0EE1A9219B08DAF5609384D0EFD01E7A6E785FFE
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Hq..)...)...)..y[...)...)...)...V...)...V...)...V...)...)...)...V...)..Rich.)..........................PE..L....bKe...........!...$.....P...............................................@.......u....@.....................................(...................H...p)... ..4...D...p............................................................................text............................... ..`.rdata..............................@..@.data...x...........................@....detourcH...........................@..@.detourd............................@....rsrc...............................@..B.reloc..4.... ......................@..B................................................................................................................................................................................................................................................

C:\Program Files\AVG\Antivirus\x86\dnd_helper.dll.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	819648
Entropy (8bit):	6.025263396172885
Encrypted:	false
SSDEEP:
MD5:	095069FC09B64199803EC10427D215E0
SHA1:	6BDB3EA004F607C2978B374F2D18AF603B389D8D
SHA-256:	F38707991564F984717081487E27659FA61186328DF3ED32FE8CBAD01BE73E33
SHA-512:	B94AECDC1404218EA93013787C017394D01CCDCDD9ED7502491208D8052F60DF6F6B140EF422B187B9AC5614E562A1BBFC143CBD7C6FF4AD20E6BFBF7491B0DC
Malicious:	true
Reputation:	low
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........u.J...J...J.....H......@......M......N.......H...C...X...^...B......V.......K.......I......._...J...N...^.......^...K...^..K...J...H...^...K...RichJ...........................PE..L...:bKe...........!...$.....N...............0......................................vB....@A.........................7......h8.......0..X...........HX..x)...@...]..P................................!..@............0.......5..`....................text............................... ..`.rdata...7...0...8..................@..@.data...`....p.......R..............@....didat....... ......................@....rsrc...X....0......................@..@.reloc...]...@...^..................@..B........................................................................................................................................................................................................

C:\Program Files\AVG\Antivirus\x86\gaming_hook.exe.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	441792
Entropy (8bit):	6.931909412365317
Encrypted:	false
SSDEEP:
MD5:	5121E3C8D4F4E75991962195486731DB
SHA1:	187B788324367908F0B4AACA32C5593441E4E28D
SHA-256:	8D9EF9EDF52F431E2A9232A61D9DE9F847724F828204012BAE89B64E7C5B5A97
SHA-512:	1F5A0BEFD9FEDB94A42329A25CA7B7B131EA36C2B0B89BE1464EC1DD01DD07E617A33EF9BAE448F858C7BD01E412F888E1D13A19A383A7C0779E20259F1709DE
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6N..W ..W ..W .f)..W .f)$..W .f)#..W .f)%..W .f)!..W ..W ..W ../...W ..%!..W ..W!..U ..()..W ..( ..W ..(..W ..W...W ..("..W .Rich.W .................PE..L...7bKe...............$............`I............@..................................G....@..........................G.......H..,...................H...x)......p(..................................0...@...............H............................text.............................. ..`.rdata..............................@..@.data....%...p.......T..............@....rsrc................b..............@..@.reloc..p(.......*...j..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\McAfee\Temp2863637682\analyticsmanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 2099641 bytes, 2 files, at 0x44 +A "\analyticsmanager.dll" +A "\analyticsmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 196 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2121641
Entropy (8bit):	7.999614389693623
Encrypted:	true
SSDEEP:
MD5:	8C6A1B32C46ED6CC385D4384918BEDA8
SHA1:	C37196217D13F69B00783CBC3CC5B53AB40A2D57
SHA-256:	2087DEEC000E114B8C631DB391E270E8F4D7BB14B8FAD1143FB0843E952F4C90
SHA-512:	8982BF336454596B8C61AA3955C85F99E50D5A7C67A3D0E3DC4230DA9E083A106B4D6D7B7EAD334DAAF815744CD4FF5EC6FC08C8B2F6DA04A41C75594EA455E6
Malicious:	true
Reputation:	low
Preview:	MSCF...... .....D............................. ..U....................a.......SW.^ .\analyticsmanager.dll.......a...SW._ .\analyticsmanager.manifest.(E.../..[...9 .....0..4.....?.ek.ina.X...:.L.....a.0Z.:..#.-;..s..0....2b...9_..)l.D..f...........}.o.s.........".M.....u.K..6..f..=..>v.=.[..d...'....+..c.8w.m...d...u.k...j..,.....O8......K......./.@.0....B...43g4.g.U~>...n..H.w.q$.I..T.j..V.`\@.Q. .P...UxG..3....\|....c.k.....?..(k.+.m...U.. .=.....@.....-.R..$..o.....y'.U...z.,.g{um.o...v.M^......g.r.O.G.{........t..}...W>{..\|G..'..t>q.......gt..=..........z..y$..ME./..._._..%{i8......w?...7.....]..].'x.b..{..n...K..C..^.^d$..v....r.Yo...q...W._.+.E...hs-7..cA...ww....V<B...]...7.......<...L\|.....*....\....hy?~[.!........p$......=..7..Z....E>.{.+.r..%`...V?.7.v...%.+.Ry..........{......6.Nt..7......~..[..?...w....L......bw=i/....6.....V...-..s.7...._...k..!.j....~.Y]......J.$^.k.6.=....v.w...9.{.O\|....V..........y{....S...oW.S.~.y.8v...

C:\Program Files\McAfee\Temp2863637682\analyticstelemetry.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 35375 bytes, 52 files, at 0x44 +A "\analyticstelemetry.manifest" +A "\context\analyticscontextconfig.luc", flags 0x4, number 1, extra bytes 20 in head, 4 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	57375
Entropy (8bit):	7.8993776004131115
Encrypted:	false
SSDEEP:
MD5:	C5543A43770BCCF5AAD50078EB72FAF2
SHA1:	876E0256C7F1CED62E0C984F25ECA0D47B3630D7
SHA-256:	C764EDC24E78CB8213E78D5900FDED23D47523FC022C4B13DDDBF4AA98290846
SHA-512:	4CEC08E3B6573772BCC246845A40711B5858EA28C74C4FDE543C090E376672196D904BC419BD1367BFFB032195CC89FC06FD29B6008AABFE677A03EC7C9FD9F9
Malicious:	false
Reputation:	low
Preview:	MSCF..../.......D...........4.............../....U..................Z.........SW._ .\analyticstelemetry.manifest.....Z.....SW.[ .\context\analyticscontextconfig.luc.....y.....SW.[ .\context\analyticswpssetting.luc.....z.....SW.[ .\context\analyticswsswps.luc.?.........SW.[ .\context\browserinformation.luc.0....-....SW.[ .\context\browserversion.luc......2....SW.[ .\context\contexthandler.luc......3....SW.[ .\context\externalutilityfunction.luc.....,7....SW.[ .\context\featuretrackingfeature.luc......V....SW.[ .\context\hashedmachineid.luc.O...VZ....SW.[ .\context\samrecoverable.luc......]....SW.[ .\context\sequencenumber.luc.R...._....SW.[ .\context\subscriptionexpirydate.luc.@....a....SW.[ .\context\subscriptionstatus.luc.....?f....SW.[ .\context\subscriptiontype.luc.Y...Yh....SW.[ .\context\suitestatus.luc......k....SW.[ .\context\wpssubscriptionexpirydate.luc......m....SW.[ .\context\wpssubscriptionstatus.luc.....\|o....SW.[ .\context\wpssubscriptiontype.luc.....hq....SW.[ .\context\

C:\Program Files\McAfee\Temp2863637682\balloon_safe_annotation.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3166
Entropy (8bit):	7.890916051269147
Encrypted:	false
SSDEEP:
MD5:	2048DF489A12C4C9E2341BEF42883205
SHA1:	281863D9F8B8D4D0DAD62E66E35F5C96CA0155FD
SHA-256:	DDA74B071B5869A22B327633D9641F1340EC5B913359BB389C34C44A6DB579A5
SHA-512:	815FC1E3A2E623FEA3B13AA2BCB3895FF9DDB2A7A05E1633C83D3F647EC4A4050AF0670ED01CABA47F02A920BF6AD84191B0B03EAD1E45105DD20D302D00CCE2
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files\McAfee\Temp2863637682\browserhost.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1275038 bytes, 8 files, at 0x44 +A "\browserhost.exe" +A "\browserhost.manifest", flags 0x4, number 1, extra bytes 20 in head, 120 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1297038
Entropy (8bit):	7.999535797522869
Encrypted:	true
SSDEEP:
MD5:	584AB80418F1C11004F22E3FB5E24A6F
SHA1:	89FC4A69DB3FFF3AE159482331F7E7B0C53D50BA
SHA-256:	88183FC9E74DE5CB8C8BCA95DF3025789101527DF2FEC5C0DDE751620065AE21
SHA-512:	0724A03036C9C0695D4B78337F702EE4AFC3BCF0B7349DE41F921EBE45124F89C5B9942FF541296E2FD9C21FA072B2D2EEF6A56FB4945C4C12E5A70643DD911F
Malicious:	true
Reputation:	low
Preview:	MSCF.....t......D............................t...U..............x.....;.......SW._ .\browserhost.exe.0....;...SW._ .\browserhost.manifest.f.....;...SW.Z .\edge.com.mcafee.webadvisor.json.e...V.;...SW.Z .\edge.com.mcafee.webadvisor_v2.json.......;...SW.Z .\webadvisor.mcafee.chrome.extension.json.L..._.;...SW.Z .\webadvisor.mcafee.firefox.extension.json.......;...SW.Z .\webadvisor_v2.mcafee.chrome.extension.json.K...N.;...SW.Z .\webadvisor_v2.mcafee.firefox.extension.json.........[...M W].M.0..D.........p.-.<..n8..np.W.p.......2u.......2....n.bLnpr2...+...u.bYD$UDU..x.W.\|.~.....w.{....R.._ p....]... .LfN.Ffe.H]W..-%.:..d.,.....T...c....p..1!..3P$A.N.`.....~#,...@....#.G....#\|.....@........G3..0.3AG.s...:R."._Y;D.4...V...z........W....../.]...M../...c...yr..W/....,.3/..h.}...r.TK..:.#..9.=.>..K.._?..q..s...I{q.f......:{[..\.......q.>.C..h`.n.Q......c..P.W.4.>..~......k..#.Yu/.........k_;.........y..Y.'.m.R6......T..{.o.~...+...z.a.q.......-z.0..k.^.J&....

C:\Program Files\McAfee\Temp2863637682\browserplugin.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 5067637 bytes, 2 files, at 0x44 +A "\browserplugin.manifest" +A "\e10ssaffplg.xpi", flags 0x4, number 1, extra bytes 20 in head, 183 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	5089637
Entropy (8bit):	7.999222491911646
Encrypted:	true
SSDEEP:
MD5:	A66217E0ACD56C1106B0FFB1B4C913A0
SHA1:	F06E7646CACC7F1589960ECA83557383182B076F
SHA-256:	8B9A70EB79B02FC03576F87AF1F253876E2EA71E0F2A58CA55C7BF8FE4F066B6
SHA-512:	51C78A21F2041537C34E17046A37DA56E5FCEF7C1D0F7F7E0E71D96D3E77158A4CFC559FF995E20D61D4A88E27D1D05002C556C4B3BC1D079B38CFF8C40E2FD0
Malicious:	true
Reputation:	low
Preview:	MSCF....uSM.....D...........................uSM..U............................SW._ .\browserplugin.manifest.xU[.......SW.^ .\e10ssaffplg.xpi.....Z..[...............D..]..qwwwwwpw.P.....Apw.ww#p43VE.....`.;7...... v..H.&.. .g...k.S..c..N&l.h\|.H.~.u.....F.b...S..b..R..7...S.9..7.r..IR+@.(/.....A......".......K..zUe`.....A..M(uA..$...@.It?.....aii.......e5.....Q!%..?d.1.JY...y.a......q.}.hquMqq9.d.m....PQ.$L...KL...c..._....k.?.+.l...s..c.._......G...8...S.3../,A)&..,0...M.sEX..p.........k..:...>..B.V.r..f?....... b....N.~.e...P........L.q..+..h..Z........'Q..@..../.`h......?+g.....o'..?m.B...>).......rUq)\j(Xj]]cg&^go.`Z..%a.....t............cm..o._...5/..I..\...v..D...\l.....[_...\|...k>)..>.4...........i.s.....$.O4"..?..F..Y.X......Fo..}.....Vd.M.?......zr.x.\|.........?UB..ZW.?.^<]b][_Z..Z_\\.`e..s......7.....x.\\|.Y.f_......4.GG.Jt.EF..e.6..e2.0},}.1.,-~.q.......?Q.....3..,..4D.qfc`b.z..........>..............[..V.......Eb....).ai_q.........`..

C:\Program Files\McAfee\Temp2863637682\downloadscan.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 2395565 bytes, 3 files, at 0x44 +A "\downloadscan.manifest" +A "\win32\downloadscan.dll", flags 0x4, number 1, extra bytes 20 in head, 213 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2417565
Entropy (8bit):	7.999764001251247
Encrypted:	true
SSDEEP:
MD5:	D619BD1E0A50524FE833742F9C2B62A6
SHA1:	3C13CEAA6F6C8303A5945249B31C605A14E863B0
SHA-256:	740ACD01C211B91A87C7D68D317FB838EE2BC3EBC4543D4915167A0B38D18EDA
SHA-512:	68D0E386FD33FC24481CB05DC6894B3C88DFD96EEA680A559030A234D291BF885A792539929096620ECAEB16748131FE8526E9CA068ECD0FABBC87F71855E8E2
Malicious:	true
Reputation:	low
Preview:	MSCF......$.....D.............................$..U..................C.........SW._ .\downloadscan.manifest...1.C.....SW.^ .\win32\downloadscan.dll..&9...1...SW._ .\x64\downloadscan.dll..k..D...[...L. ..."B.5.._.o{.Z.Z.r....).L]hW:...j...U.f"l./.P.ym..8..<;.].w........H..\.'=...a.tVcCfF".h.......~.~..v.C..u...''....f..y........0t./.....2....TW..[.K].s)u-^I.L..b.b-x.@.)..Z(..X.k..v.l...!.:..3sI.\|.......a..+C+,.....}.?..s....5.......L.....swWJ.].....jJ.(F...PB.3.R....]..1.....=.........l.S>.....6.aw.....o.._...3ok....z<.....9..v.6.8....O.6....0.l.F(......K.M.7/....6l......l..l.^.(=4.t"...".3}........ri.....(.G\lK.ze.....n.pPll.,..4..lwBP..R..}.B..Tls/...F.k.....:c..K..n...x....X..O..P......X.....O..B?b...4.ik.i?...i.Vn.\|Fq.hGx5..I..t%N(E....]..r...U..IE....y4UHy.%_o..`...m..KY..}ikw.8q..qq..u....l..1.O..t_*C....1..c..1lhPbj....`X\oj!.h.?z.7..~.s..y.....`.y..F..a..&U....>a........]..'.K..P..B..+J.S.Z..j...S.j...S....2..c5L.9..8...LY...c..4k..

C:\Program Files\McAfee\Temp2863637682\eventmanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1587095 bytes, 2 files, at 0x44 +A "\eventmanager.dll" +A "\eventmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 141 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1609095
Entropy (8bit):	7.999565988817059
Encrypted:	true
SSDEEP:
MD5:	AD1EBB7A0F1AC27E2255AB4EB989EA76
SHA1:	16907E09E9C0DD96655589056E384C5F56438146
SHA-256:	CCC065FD9CAA190E633B5548189D2FE1F91C5DDEC242A73700D1466E27777F5F
SHA-512:	2BD1BEA80BBF13D0C9F5E6CA33FEB0E4BED30793054061AF34AF4BBCA19AB19E54581AEABD9CA793B42D14282F97AC03DAD472679966680FCE33A20205D2083C
Malicious:	true
Reputation:	low
Preview:	MSCF.....7......D............................7...U..................0 F.......SW._ .\eventmanager.dll.....0 F...SW._ .\eventmanager.manifest....C.+..[........."sP$..n...^..^ ..Pj..T..f...4r>...."sW.)s-..... .c...&.d.....d@...iP?..$D;....%....3.4#..u........H.G..m..:...$$0..z.'.Q5nH....m/v`h..^..%P.[..!.....7.....E....P[...H4i~.....H.......@..].m.......G..P.... .._.q......9.q<...#...lM<p.0...>+...NS..@...V..i..c.{.;S..z.o....1...5.w.TT.6,.%..v...k....w..Q...[[Je.q.L.R..W&%..fru..{b-...}.n.(#.u....J.......,.'{n\|....~.....m....jq.\]e..yKAQ~..."Y.........-K.&..6.I.t.h.......Sl......$........dN....k.{'.....j.Sr...}.mk9..>x:....\|......J0...eM.i.].=V.W........K...}.m.d...`.!_......!~.......;......:,..#p.u....#.X..S..B.N....4{Z.{M&.pk0Ti.v.........q.K..y..a...\|.Z...{.#...T.].EX..7....C.u.@)../..f..zzzyg&P...!..(6B.F..od,..Z7..5...\..A$j+.F.+s...(*..2%X.......B..@=.@q..2.p.....<..D.....f...o......)a..;I.0.....Y-.....G.F7..F...'....m1.....3...q%.\|

C:\Program Files\McAfee\Temp2863637682\icon_complete.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3219
Entropy (8bit):	7.7127647052020425
Encrypted:	false
SSDEEP:
MD5:	4A09448B224F83F4E6D36AEC9FF4DA1E
SHA1:	CC42250CAF610210EFF2904B1A08630A0888AB2F
SHA-256:	911215D1ADA8D78A33F6ED9A3740A0652BE74EFA34ED22AE569D143F9B3B5040
SHA-512:	390587FA96D17112CA7EC1ADFE2BA103FE39E980A35A2D4C7A3B6BCF4DE9E95B200DDCEE3C4B6C34899DE51F20F9635D41259558C77CF24279D26264DA953E2B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...d...d.....p.T....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:013EDEF9F71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:013EDEFAF71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEF7F71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDEF8F71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>d.8.....IDATx..kL.W.....Z(....h5>J....T,...4U...h.I..&~...`..hc......"h.. X.....m...Q....%...........'..ta.

C:\Program Files\McAfee\Temp2863637682\icon_failed.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3390
Entropy (8bit):	7.74331289225542
Encrypted:	false
SSDEEP:
MD5:	AEE9C26A50511C3E4196C28662BCE665
SHA1:	ADF6DA6EE3EAAD88E8EF1C9C07505AEFFDE89B57
SHA-256:	0E2904A557F79BCE71A47BFB03E49FA9C5B54C7855017B54143EA2214501BFE6
SHA-512:	F90AA520FD9308C502B857C4425BF6CF6E12C401EA4B538534E58655448232CF797AA9A9BA60B0932DBAFC28EE925D22BED6740DF82BB02C5C99EF851389F783
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...d...d.....p.T....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:013EDEFDF71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:013EDEFEF71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEFBF71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDEFCF71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..*.....IDATx..klTU...v..--/5.<.J...."F.aD.HQ4..(...j.P.a...?T ..F...........5..... ..jU..Q#.V(.]g...w.g.n.$.m

C:\Program Files\McAfee\Temp2863637682\icon_laptop.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 100 x 73, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.072392857408681
Encrypted:	false
SSDEEP:
MD5:	4D3A0258CF71A406CB7669FBE3FBEB2E
SHA1:	0811273369EADF2604DB3C53426F85FE74B785E4
SHA-256:	C156050A5D788BAD7D8F36482072B44A23F502F23C5F9198F6EB1EB066765DEE
SHA-512:	837A275BC63DD19F5F8553E056C5EAF257D530A54E0EC386BB28B0A515CA58929E3464612C30D9E7034ACF7473119E03B00EBAB26B220391330FEF12BC087973
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...d...I............tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:3EBDD818F71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:3EBDD819F71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEFFF71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDF00F71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..}....UIDATx..K.Q..sj-HT...X..t.Z.P.A$...v...._.-]DAkG....#.B....dr.(..@.*......-y.......<H.......{..^.\NA\|h..

C:\Program Files\McAfee\Temp2863637682\installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2526888
Entropy (8bit):	6.436289639902748
Encrypted:	false
SSDEEP:
MD5:	38F970B5919FA4F8174F559A91003924
SHA1:	564CEE5FA95AD4B0661E33691855A5902874EA97
SHA-256:	1F112268AC780C3603BA62B926A7BED84FF0931D56C884AA37A12057E2DF6900
SHA-512:	DD7FF9B89C5DAAAF503BC47511CADDA048A4FD638F440AAF8C15921FB12D4396982CB84C44EE18AF6FCF3FDD36419DE5123F541DB2C84856F1917042778E55BB
Malicious:	true
Reputation:	low
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......>c!.z.O.z.O.z.O.!jL.w.O.!jJ..O.(wK.i.O.(wL.p.O..m..x.O.(wJ...O.!jK.e.O.sz..r.O.wJ.{.O.!jI.x.O.niN.x.O.!jN.a.O..lJ.p.O.z.O.{.O..lK.:.O.z.N..O.wF...O.w..{.O.z...{.O.wM.{.O.Richz.O.........PE..d...]h1e.........."................. ..........@..............................&.......&...`.................................................p...h................A....%.......%.D,......p.......................(...@...8...............0............................text.............................. ..`.rdata...R.......T..................@..@.data...DT... ...&..................@....pdata...A.......B...,..............@..@.didat...............n..............@..._RDATA...............p..............@..@.rsrc................r..............@..@.reloc..D,....%......`%.............@..B................................................................................................

C:\Program Files\McAfee\Temp2863637682\jquery-1.9.0.min.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	ASCII text, with very long lines (32132), with CRLF line terminators
Category:	dropped
Size (bytes):	93205
Entropy (8bit):	5.288294476087405
Encrypted:	false
SSDEEP:
MD5:	45E7897161CD82804BD66A16670F8D1F
SHA1:	8E2FCE3B5F804300D507E6D0C22A327A7FB7F086
SHA-256:	402D866371F707BE1B03D85B03DB3667CCE0DAEDCBAAA599F30E0E502C1E7CDF
SHA-512:	2737DCFBAEAAE3DA996AB2649B7BC46165AB93F9A37369FD48C1A5473F7311F4850AFE96E7AAECC057CC1D35AE2C7DC14CA0076594C02098FAD194683D83AA74
Malicious:	false
Reputation:	low
Preview:	/! jQuery v1.9.0 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license /(function(e,t){"use strict";function n(e){var t=e.length,n=st.type(e);return st.isWindow(e)?!1:1===e.nodeType&&t?!0:"array"===n\|\|"function"!==n&&(0===t\|\|"number"==typeof t&&t>0&&t-1 in e)}function r(e){var t=Tt[e]={};return st.each(e.match(lt)\|\|[],function(e,n){t[n]=!0}),t}function i(e,n,r,i){if(st.acceptData(e)){var o,a,s=st.expando,u="string"==typeof n,l=e.nodeType,c=l?st.cache:e,f=l?e[s]:e[s]&&s;if(f&&c[f]&&(i\|\|c[f].data)\|\|!u\|\|r!==t)return f\|\|(l?e[s]=f=K.pop()\|\|st.guid++:f=s),c[f]\|\|(c[f]={},l\|\|(c[f].toJSON=st.noop)),("object"==typeof n\|\|"function"==typeof n)&&(i?c[f]=st.extend(c[f],n):c[f].data=st.extend(c[f].data,n)),o=c[f],i\|\|(o.data\|\|(o.data={}),o=o.data),r!==t&&(o[st.camelCase(n)]=r),u?(a=o[n],null==a&&(a=o[st.camelCase(n)])):a=o,a}}function o(e,t,n){if(st.acceptData(e)){var r,i,o,a=e.nodeType,u=a?st.cache:e,l=a?e[st.expando]:st.expando;if(u[l]){if(t&&(r=n?u[l]:u[l].data)){st.isArray(t)?t=t.concat(

C:\Program Files\McAfee\Temp2863637682\jslang\eula-cs-CZ.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2374), with CRLF line terminators
Category:	dropped
Size (bytes):	74892
Entropy (8bit):	3.8107150696128875
Encrypted:	false
SSDEEP:
MD5:	C9C65B331403A8109A8EA3943247D09A
SHA1:	18724C42E5342E7362D16FD1C8F6B5BB60DB2C25
SHA-256:	C8A5DDFDF5F5A01269EC5C125355C84F80C1228C2D578FB89B795719CB9076C8
SHA-512:	C2D53CFAF55A6B7F058C97DCB0AC2695B4B44383C268E6197222F533E4DDDBCC9600066453E5DCAA1ED21CFEBA2289842A8CF986C68D9FADBF671C2D4FE9F5CF
Malicious:	false
Reputation:	low
Preview:	..L.i.c.e.n...n... .s.m.l.o.u.v.a. .n.a. .b.e.z.p.e...n.o.s.t.n... .s.o.f.t.w.a.r.e. .I.n.t.e.l.........D...k.u.j.e.m.e. .z.a. .v.y.u.~.i.t... .b.e.z.p.e...n.o.s.t.n...h.o. .s.o.f.t.w.a.r.u. .a. .s.l.u.~.e.b. .s.p.o.l.e...n.o.s.t.i. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .(.d...l.e. .j.e.n. .. S.o.f.t.w.a.r.e.. ).,. .k.t.e.r... .p.o.s.k.y.t.u.j.e. .j.e.j... .s.t.o.p.r.o.c.e.n.t.n... .v.l.a.s.t.n...n... .d.c.e.Y.i.n... .s.p.o.l.e...n.o.s.t. .M.c.A.f.e.e... .T.o.t.o. .j.e. .p.r...v.n... .u.j.e.d.n...n... .m.e.z.i. .v...m.i. .a. .n.a.a... .s.p.o.l.e...n.o.s.t..... .I.n.s.t.a.l.a.c... .n.e.b.o. .p.o.u.~.i.t...m. .S.o.f.t.w.a.r.u. .v.y.j.a.d.Y.u.j.e.t.e. .s.o.u.h.l.a.s. .s. .p.o.d.m...n.k.a.m.i. .u.j.e.d.n...n...,. .p.r.o.t.o. .s.i. .j.e. .p.e...l.i.v... .p.Y.e...t...t.e... .........T.a.t.o. .s.m.l.o.u.v.a. .n.a. .b.e.z.p.e...n.o.s.t.n... .S.o.f.t.w.a.r.e. .I.n.t.e.l. .(.d...l.e. .j.e.n. .. S.m.l.o.u.v.a.. ). .u.p.r.a.v.u.j.e. .v.a.a.e. .p.r...v.a. .k. .p.o.u.~.i.t... .S.o.f.t.w.a.r.u.,. .j.e.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-da-DK.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2582), with CRLF line terminators
Category:	dropped
Size (bytes):	91776
Entropy (8bit):	3.453182110932442
Encrypted:	false
SSDEEP:
MD5:	3337D980215EA1E6C647FA4119A28521
SHA1:	FBA0B5211311999DF85B23488DAD7F7254FB2F0D
SHA-256:	C822463F38D0A8A04361A11CE0F43A865F5F5A9A3A8E16967A9EE6A057F83057
SHA-512:	032736E1059BC26A574ED0828F20236D2899564E235E849B08F07E8B64405C4D86ECBEA494286DF21BF1C6E1F8012335112E12954BA12681D8644DD8A90A03A3
Malicious:	false
Reputation:	low
Preview:	..L.i.c.e.n.s.a.f.t.a.l.e. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.k.,. .f.o.r.d.i. .d.u. .b.r.u.g.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.s. .s.o.f.t.w.a.r.e. .o.g. .t.j.e.n.e.s.t.e.r. .(.".S.o.f.t.w.a.r.e.n.".).,. .d.e.r. .l.e.v.e.r.e.s. .a.f. .M.c.A.f.e.e.,. .s.o.m. .e.r. .e.t. .h.e.l.e.j.e.t. .d.a.t.t.e.r.s.e.l.s.k.a.b. .a.f. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .D.e.t.t.e. .e.r. .e.n. .j.u.r.i.d.i.s.k. .a.f.t.a.l.e. .m.e.l.l.e.m. .o.s. .. .i.n.s.t.a.l.l.a.t.i.o.n. .e.l.l.e.r. .o.p.r.e.t.t.e.l.s.e. .a.f. .a.d.g.a.n.g. .t.i.l. .v.o.r.e.s. .S.o.f.t.w.a.r.e. .b.e.t.y.d.e.r.,. .a.t. .d.u. .a.c.c.e.p.t.e.r.e.r. .d.i.s.s.e. .v.i.l.k...r.,. .s... .d.u. .b.e.d.e.s. .l...s.e. .d.e.m. .o.m.h.y.g.g.e.l.i.g.t... .........I. .d.e.n.n.e. .l.i.c.e.n.s.a.f.t.a.l.e. .f.r.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".A.f.t.a.l.e.n.".). .g.e.n.n.e.m.g...s. .d.i.n.e. .r.e.t.t.i.g.h.e.d.e.r. .t.i.l. .a.t. .b.r.u.g.e. .S.o.f.t.w.a.r.e.n.,. .b.e.g.r...n.s.n.i.n.g.e.r. .f.o.r. .d.e.n.n.e. .b.r.u.g.,. .v.o.r.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-de-DE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (3216), with CRLF line terminators
Category:	dropped
Size (bytes):	104206
Entropy (8bit):	3.491690936146809
Encrypted:	false
SSDEEP:
MD5:	08C61EF338BE0CF2084A8118EF5279EE
SHA1:	FBDA8C94DE2D42F0624F45972686767F06A976D7
SHA-256:	12372C1DBBA6800D99AFF817ACB35CCF968254713E7E2ED8676D9F652F0AAFC4
SHA-512:	015553841CE77F952358EC26AB4C4E20128820B145D89F0146EE5A7C77CD24A3D23252BA52AAE8EC299FD447EFC472C6A27D83372F3DCED4A3E54B4492244887
Malicious:	false
Reputation:	low
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.z.e.n.z.v.e.r.t.r.a.g.........V.i.e.l.e.n. .D.a.n.k.,. .d.a.s.s. .S.i.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .S.o.f.t.w.a.r.e. .u.n.d. .D.i.e.n.s.t.e. .(.. S.o.f.t.w.a.r.e.. ). .n.u.t.z.e.n.,. .d.i.e. .v.o.n. .M.c.A.f.e.e.,. .e.i.n.e.r. .h.u.n.d.e.r.t.p.r.o.z.e.n.t.i.g.e.n. .T.o.c.h.t.e.r.g.e.s.e.l.l.s.c.h.a.f.t. .v.o.n. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.,. .b.e.r.e.i.t.g.e.s.t.e.l.l.t. .w.e.r.d.e.n... .D.i.e.s. .i.s.t. .e.i.n. .r.e.c.h.t.s.k.r...f.t.i.g.e.r. .V.e.r.t.r.a.g. .z.w.i.s.c.h.e.n. .u.n.s.. m.i.t. .d.e.r. .I.n.s.t.a.l.l.a.t.i.o.n. .o.d.e.r. .d.e.m. .Z.u.g.r.i.f.f. .a.u.f. .u.n.s.e.r.e. .S.o.f.t.w.a.r.e. .s.t.i.m.m.e.n. .S.i.e. .d.i.e.s.e.n. .B.e.d.i.n.g.u.n.g.e.n. .z.u... .L.e.s.e.n. .S.i.e. .s.i.e. .d.e.s.h.a.l.b. .b.i.t.t.e. .a.u.f.m.e.r.k.s.a.m. .d.u.r.c.h... .........D.i.e.s.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.z.e.n.z.v.e.r.t.r.a.g. .(.. V.e.r.t.r.a.g.. ). .u.m.f.a.s.s.t. .I.h.r.e. .R.e.c.h.t.e. .z.u.r. .N.u.t.z.u.n.g. .d.e.r. .S.o.f.t.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-el-GR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2776), with CRLF line terminators
Category:	dropped
Size (bytes):	103714
Entropy (8bit):	4.054391145636526
Encrypted:	false
SSDEEP:
MD5:	74C7533EE5FBED8576A4ECEC0289CA6F
SHA1:	E2C51284C29846E591E4C8EB931C9CAC85AE3A03
SHA-256:	9E45E75EF08C8CD2C84324BCEE4FCF0D58FE8FB8F62B0DE91424071D3D6E3B4F
SHA-512:	B339D79ED2176C7873F0E0AE4AFBE6B06EEDC81CBC537A715364C306FA1BE7B603A317737E6C16649E5EE371FE20EAD4406853EA11F5F6C4182EEBF1925C7361
Malicious:	false
Reputation:	low
Preview:	................ ............. ............. ..................... ....... ................... .I.n.t.e.l. .S.e.c.u.r.i.t.y............... ......................... ....... ............................. ................... ....... ................... .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. ................... ).,. ....... ............... ... .M.c.A.f.e.e.,. ....... ....................... ..................... ................... ....... .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... ... ............... ................. ....... ............. ................. ............... ..... ......... ....... .......... .. ....................... ... ..................... ....... ..................... ....... ....................... ....... ..................... ..... ......... ................. ...........,. ................. ....... ....................... ..... ......... ................... ....................... ........... ............... ............... ............. ............. .....................

C:\Program Files\McAfee\Temp2863637682\jslang\eula-en-US.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2456), with CRLF line terminators
Category:	dropped
Size (bytes):	85990
Entropy (8bit):	3.453033473575846
Encrypted:	false
SSDEEP:
MD5:	9B63156648366D674107FF5066A58B2A
SHA1:	9BB9FB43B3E5501C749364E8460C14F54B92F684
SHA-256:	11269B8E798B3A21B2CD50D03587948B25A26C63B2AC7B4ED1ADD7565F36E9E2
SHA-512:	9C7D3DBEFA0FAC4AF910EB6D6799D1C59BA880EE0B195D3648078159F3BEFCF8DCF965530CE5482DF6E17586494C44D5555CE5E710343CEA497B8B0C4BDC16A9
Malicious:	true
Reputation:	low
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t.........T.h.a.n.k. .y.o.u. .f.o.r. .u.s.i.n.g. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .s.o.f.t.w.a.r.e. .a.n.d. .s.e.r.v.i.c.e.s. .(.. S.o.f.t.w.a.r.e.. ).,. .p.r.o.v.i.d.e.d. .b.y. .M.c.A.f.e.e.,. .a. .w.h.o.l.l.y. .o.w.n.e.d. .s.u.b.s.i.d.i.a.r.y. .o.f. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .T.h.i.s. .i.s. .a. .l.e.g.a.l. .a.g.r.e.e.m.e.n.t. .b.e.t.w.e.e.n. .u.s.. i.n.s.t.a.l.l.i.n.g. .o.r. .a.c.c.e.s.s.i.n.g. .o.u.r. .S.o.f.t.w.a.r.e. .m.e.a.n.s. .y.o.u. .a.r.e. .a.g.r.e.e.i.n.g. .t.o. .t.h.e.s.e. .t.e.r.m.s.,. .s.o. .p.l.e.a.s.e. .r.e.a.d. .t.h.e.m. .c.a.r.e.f.u.l.l.y... .........T.h.i.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t. .(.. A.g.r.e.e.m.e.n.t.. ). .c.o.v.e.r.s. .y.o.u.r. .r.i.g.h.t.s. .t.o. .u.s.e. .t.h.e. .S.o.f.t.w.a.r.e.,. .r.e.s.t.r.i.c.t.i.o.n.s. .o.n. .t.h.a.t. .u.s.e.,. .o.u.r. .r.i.g.h.t. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .r.e.n.e.w. .a.n.d. .c.h.a.r.g.e. .y.o.u. .f.o.r. .p.a.i.d. .v.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-es-ES.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2904), with CRLF line terminators
Category:	dropped
Size (bytes):	100834
Entropy (8bit):	3.4280024557861886
Encrypted:	false
SSDEEP:
MD5:	36491A6CFF8B60CF03726466CEEBB0E0
SHA1:	4E1A04A03C6C61AE843DFA86ADA074F1993A8AC2
SHA-256:	30D4ABCB6EE990052D079EE1B57F5B1FDBA0343637AE6C2844BC6543D22EE5B5
SHA-512:	7FF7FC6C1E4389F5D2D6120B12749EF68B70B07053525A5F2120E62ABBCFC8DB2A570FCD420B467E4903A5CAA70B5F1AE9E82964F4FB925847377ED6008B61C5
Malicious:	false
Reputation:	low
Preview:	..A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.c.i.a.s. .p.o.r. .u.t.i.l.i.z.a.r. .l.o.s. .s.e.r.v.i.c.i.o.s. .y. .e.l. .s.o.f.t.w.a.r.e. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ).,. .s.u.m.i.n.i.s.t.r.a.d.o.s. .p.o.r. .M.c.A.f.e.e.,. .u.n.a. .f.i.l.i.a.l. .p.a.r.t.i.c.i.p.a.d.a. .p.l.e.n.a.m.e.n.t.e. .p.o.r. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .e.s. .u.n. .a.c.u.e.r.d.o. .l.e.g.a.l. .e.n.t.r.e. .n.o.s.o.t.r.o.s... .A.l. .i.n.s.t.a.l.a.r. .o. .a.c.c.e.d.e.r. .a. .n.u.e.s.t.r.o. .S.o.f.t.w.a.r.e. .i.n.d.i.c.a. .u.s.t.e.d. .q.u.e. .a.c.e.p.t.a. .l.o.s. .p.r.e.s.e.n.t.e.s. .t...r.m.i.n.o.s.,. .p.o.r. .l.o. .t.a.n.t.o.,. .l.e. .r.o.g.a.m.o.s. .q.u.e. .l.o.s. .l.e.a. .c.o.n. .a.t.e.n.c.i...n... .........E.l. .p.r.e.s.e.n.t.e. .A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.e.l. . .. A.c.u.e.r.d.o.. ). .e.s.t.a.b.l.e.c.e. .c.u...l.e.s. .s.o.n. .s.u.s. .d.e.r.e.c.h.o.s. .d.e. .u.s.o. .d.e.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-es-MX.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2904), with CRLF line terminators
Category:	dropped
Size (bytes):	100834
Entropy (8bit):	3.428304510295199
Encrypted:	false
SSDEEP:
MD5:	2ADEB2CD2B6CAA6551DB3085B39ED686
SHA1:	06EF0FCE06CC195702C1A962282EB3F9BEFEEE89
SHA-256:	FF9395DBE41433EBA7F33689178F78C31311B9BF4569843104DE9157D0A3643F
SHA-512:	78187F8F4230F87BF6DF62BC341FDC843CFF8546FA44FAD94A406ADEA77C81BEA51FA2A370F5BE3ACE039F2A377EC5D7E7975576E8A77F99132B71C8EACBED02
Malicious:	false
Reputation:	low
Preview:	..A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.c.i.a.s. .p.o.r. .u.t.i.l.i.z.a.r. .l.o.s. .s.e.r.v.i.c.i.o.s. .y. .e.l. .s.o.f.t.w.a.r.e. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ).,. .s.u.m.i.n.i.s.t.r.a.d.o.s. .p.o.r. .M.c.A.f.e.e.,. .u.n.a. .f.i.l.i.a.l. .p.a.r.t.i.c.i.p.a.d.a. .p.l.e.n.a.m.e.n.t.e. .p.o.r. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .e.s. .u.n. .a.c.u.e.r.d.o. .l.e.g.a.l. .e.n.t.r.e. .n.o.s.o.t.r.o.s... .A.l. .i.n.s.t.a.l.a.r. .o. .a.c.c.e.d.e.r. .a. .n.u.e.s.t.r.o. .S.o.f.t.w.a.r.e. .i.n.d.i.c.a. .u.s.t.e.d. .q.u.e. .a.c.e.p.t.a. .l.o.s. .p.r.e.s.e.n.t.e.s. .t...r.m.i.n.o.s.,. .p.o.r. .l.o. .t.a.n.t.o.,. .l.e. .r.o.g.a.m.o.s. .q.u.e. .l.o.s. .l.e.a. .c.o.n. .a.t.e.n.c.i...n... .........E.l. .p.r.e.s.e.n.t.e. .A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.e.l. . .. A.c.u.e.r.d.o.. ). .e.s.t.a.b.l.e.c.e. .c.u...l.e.s. .s.o.n. .s.u.s. .d.e.r.e.c.h.o.s. .d.e. .u.s.o. .d.e.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-fi-FI.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2621), with CRLF line terminators
Category:	dropped
Size (bytes):	90558
Entropy (8bit):	3.4505889656177646
Encrypted:	false
SSDEEP:
MD5:	A047978D7239FD164D0F0B4CDE70F429
SHA1:	C7D4FA0CAFD7960E4159A90AE66492A1DB9FCED9
SHA-256:	8FF6BCED89A9E669D247A37D4AEE43B5B3B362E70DFA3CFD3D23875350659185
SHA-512:	F42E7B55FCC7FB8918A45E063C5EE29326221A4B483CD788EF554E63B89E4649690E5EB7497029C2DFFBD3D5688A7D31E9399B831DB67DCED3E9DAFB2B040835
Malicious:	false
Reputation:	low
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .k...y.t.t...o.i.k.e.u.s.s.o.p.i.m.u.s.........K.i.i.t.o.s.,. .e.t.t... .v.a.l.i.t.s.i.t. .I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .o.h.j.e.l.m.i.s.t.o.n. .j.a. .p.a.l.v.e.l.u.t. .(.. o.h.j.e.l.m.i.s.t.o.. ).,. .j.o.t.k.a. .t.a.r.j.o.a.a. .M.c.A.f.e.e.,. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.i.n. .k.o.k.o.n.a.a.n. .o.m.i.s.t.a.m.a. .t.y.t...r.y.h.t.i..... .T...m... .o.n. .l.a.i.l.l.i.n.e.n. .s.o.p.i.m.u.s. .m.e.i.d...n. .j.a. .k...y.t.t...j...n. .v...l.i.l.l..... .A.s.e.n.t.a.m.a.l.l.a. .t.a.i. .k...y.t.t...m...l.l... .o.h.j.e.l.m.i.s.t.o.a.m.m.e. .s.i.t.o.u.d.u.t. .n...i.h.i.n. .e.h.t.o.i.h.i.n.,. .j.o.t.e.n. .o.n. .t...r.k.e.....,. .e.t.t... .l.u.e.t. .n.e. .h.u.o.l.e.l.l.i.s.e.s.t.i... .........T...m... .I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .k...y.t.t...o.i.k.e.u.s.s.o.p.i.m.u.s. .(.. s.o.p.i.m.u.s.. ). .p.i.t..... .s.i.s...l.l.....n. .k...y.t.t...j...n. .o.i.k.e.u.d.e.t. .o.h.j.e.l.m.i.s.t.o.n. .k...y.t.t.....n.,. .t...t... .k...y.t.t..... .k.o.s.k.e.v.a.t. .r.a.j.o.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-fr-CA.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2833), with CRLF line terminators
Category:	dropped
Size (bytes):	100074
Entropy (8bit):	3.456769060516734
Encrypted:	false
SSDEEP:
MD5:	026361432441B00900C15D81EFB20A25
SHA1:	287B1A572348C9EF3C17D716EDD54907A067DEE5
SHA-256:	BDAB2389238BCC00D71A642842B6167110CD22C04681256FCE1F1D362F7D7523
SHA-512:	F5C3009B1101A62BA010921A8DAC44B4D1111B35DD7D50EB33BADF2BEFCA3AFD435C34DC2C7946A9541002D4AADF8DB9B179BD37B85CF155072B5380DA68D5A6
Malicious:	false
Reputation:	low
Preview:	..C.o.n.t.r.a.t. .d.e. .l.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........M.e.r.c.i. .d.'.u.t.i.l.i.s.e.r. .l.e. .l.o.g.i.c.i.e.l. .e.t. .l.e.s. .s.e.r.v.i.c.e.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....L.o.g.i.c.i.e.l.....). .f.o.u.r.n.i.s. .p.a.r. .M.c.A.f.e.e.,. .u.n.e. .f.i.l.i.a.l.e. .e.n. .p.r.o.p.r.i...t... .e.x.c.l.u.s.i.v.e. .d.'.I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .L.e. .p.r...s.e.n.t. .d.o.c.u.m.e.n.t. .e.s.t. .u.n. .a.c.c.o.r.d. .j.u.r.i.d.i.q.u.e. .c.o.n.c.l.u. .e.n.t.r.e. .v.o.u.s. .e.t. .n.o.u.s... .E.n. .i.n.s.t.a.l.l.a.n.t. .o.u. .e.n. .a.c.c...d.a.n.t. ... .n.o.t.r.e. .L.o.g.i.c.i.e.l.,. .v.o.u.s. .a.c.c.e.p.t.e.z. .l.e.s. .p.r...s.e.n.t.e.s. .c.o.n.d.i.t.i.o.n.s... .V.e.u.i.l.l.e.z. .d.o.n.c. .l.e.s. .l.i.r.e. .a.t.t.e.n.t.i.v.e.m.e.n.t... .........L.e. .p.r...s.e.n.t. .C.o.n.t.r.a.t. .d.e. .L.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....C.o.n.t.r.a.t.....). .p.o.r.t.e. .s.u.r. .v.o.s. .d.r.o.i.t.s. .d.'.u.t.i.l.i.s.e.r. .l.e. .L.o.g.i.c.i.e.l.,. .l.e.s. .r.e.s.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-fr-FR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2833), with CRLF line terminators
Category:	dropped
Size (bytes):	100074
Entropy (8bit):	3.456927512697501
Encrypted:	false
SSDEEP:
MD5:	859EAF023C1F76ECDACB1E4EBD72BC7D
SHA1:	C34AC9FF223F920E751D8EA68E0F6B0E4601AB25
SHA-256:	0B451919A76D1EDE9E6C23D08F2ADDD2FD827D280407886E15093F8315CFE857
SHA-512:	BB60DE2FB2010D1E945B9C2E66AC989B8932D6E22A79A6752D4A91B4058C97A2260823A3B9DEA613CEFCCF604E448AFEE6A63B8F22141A938914FF594F5FDCDD
Malicious:	false
Reputation:	low
Preview:	..C.o.n.t.r.a.t. .d.e. .l.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........M.e.r.c.i. .d.'.u.t.i.l.i.s.e.r. .l.e. .l.o.g.i.c.i.e.l. .e.t. .l.e.s. .s.e.r.v.i.c.e.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....L.o.g.i.c.i.e.l.....). .f.o.u.r.n.i.s. .p.a.r. .M.c.A.f.e.e.,. .u.n.e. .f.i.l.i.a.l.e. .e.n. .p.r.o.p.r.i...t... .e.x.c.l.u.s.i.v.e. .d.'.I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .L.e. .p.r...s.e.n.t. .d.o.c.u.m.e.n.t. .e.s.t. .u.n. .a.c.c.o.r.d. .j.u.r.i.d.i.q.u.e. .c.o.n.c.l.u. .e.n.t.r.e. .v.o.u.s. .e.t. .n.o.u.s... .E.n. .i.n.s.t.a.l.l.a.n.t. .o.u. .e.n. .a.c.c...d.a.n.t. ... .n.o.t.r.e. .L.o.g.i.c.i.e.l.,. .v.o.u.s. .a.c.c.e.p.t.e.z. .l.e.s. .p.r...s.e.n.t.e.s. .c.o.n.d.i.t.i.o.n.s... .V.e.u.i.l.l.e.z. .d.o.n.c. .l.e.s. .l.i.r.e. .a.t.t.e.n.t.i.v.e.m.e.n.t... .........L.e. .p.r...s.e.n.t. .C.o.n.t.r.a.t. .d.e. .L.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....C.o.n.t.r.a.t.....). .p.o.r.t.e. .s.u.r. .v.o.s. .d.r.o.i.t.s. .d.'.u.t.i.l.i.s.e.r. .l.e. .L.o.g.i.c.i.e.l.,. .l.e.s. .r.e.s.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-hr-HR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2677), with CRLF line terminators
Category:	dropped
Size (bytes):	87744
Entropy (8bit):	3.58798496222848
Encrypted:	false
SSDEEP:
MD5:	F0F33F656C531A87089BEFD7FAC76A67
SHA1:	8E340F2A43C79656B5F5FE9AFF516EDA7291C209
SHA-256:	A025649E8AE1B5D9B8EE741DF8A0C277B25C901007829DAD897B92C3443780B9
SHA-512:	12BC664A425F0F2D356EE933BF5D42961FB101A81F5FD7496090F5F25B412EE6AE22CD0FA834C0642ED468507B795EEE6F078756DE67D66190785955C8C73205
Malicious:	false
Reputation:	low
Preview:	..L.i.c.e.n.c.n.i. .u.g.o.v.o.r. .z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........H.v.a.l.a. .a.t.o. .k.o.r.i.s.t.i.t.e. .s.o.f.t.v.e.r. .i. .u.s.l.u.g.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.v.e.r.".).,. .k.o.j.i. .i.s.p.o.r.u...u.j.e. .M.c.A.f.e.e.,. .p.o.d.r.u.~.n.i.c.a. .u. .p.o.t.p.u.n.o.m. .v.l.a.s.n.i.a.t.v.u. .t.v.r.t.k.e. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .O.v.o. .j.e. .p.r.a.v.n.i. .u.g.o.v.o.r. .i.z.m.e...u. .n.a.s.. i.n.s.t.a.l.i.r.a.n.j.e. .i.l.i. .p.r.i.s.t.u.p. .n.a.a.e.m. .S.o.f.t.v.e.r.u. .z.n.a...i. .d.a. .s.e. .s.l.a.~.e.t.e. .s. .n.j.e.g.o.v.i.m. .u.v.j.e.t.i.m.a.,. .p.a. .v.a.s. .m.o.l.i.m.o. .d.a. .i.h. .p.a.~.l.j.i.v.o. .p.r.o...i.t.a.t.e... .........O.v.a.j. .L.i.c.e.n.c.n.i. .u.g.o.v.o.r. .z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".U.g.o.v.o.r.".). .o.b.u.h.v.a...a. .v.a.a.e. .p.r.a.v.o. .n.a. .k.o.r.i.a.t.e.n.j.e. .S.o.f.t.v.e.r.a.,. .o.g.r.a.n.i...e.n.j.a. .u. .n.j.e.g.o.v.o.m. .k.o.r.i.a.t.e.n.j.u.,. .n.a.a.e. .p.r.a.v.o. .n.a. .a.u.t.o.m.a.t.s.k.o. .o.b.n.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-hu-HU.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2782), with CRLF line terminators
Category:	dropped
Size (bytes):	98690
Entropy (8bit):	3.6859429785866773
Encrypted:	false
SSDEEP:
MD5:	75C761130ED7CF86657209EA25D0AB63
SHA1:	65A7F1061516C37E96052A58384B9E53F22500F1
SHA-256:	960B02F8FF4F01689E61B4CE19EF3E87B4F998A0AAD5FB5919D893B81051FF35
SHA-512:	854ADB7925CE6307A7B5288071B47389ECA2EFA01C68978A1A17FB0B2F038A24BA194C956AF7C92ACF3DEC1C87A5C5D198D8F7EC9C6431D42AE12F49A359D31C
Malicious:	false
Reputation:	low
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s.........K...s.z...n.j...k.,. .h.o.g.y. .a.z. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .t.e.l.j.e.s. .t.u.l.a.j.d.o.n... .l.e...n.y.v...l.l.a.l.a.t.a.,. .a. .M.c.A.f.e.e. ...l.t.a.l. .k...n...l.t. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .s.z.o.f.t.v.e.r.t. ...s. .s.z.o.l.g...l.t.a.t...s.o.k.a.t. .(.. S.z.o.f.t.v.e.r.. ). .h.a.s.z.n...l.j.a... .E.z. .a. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s. .e.g.y. .k...z...t.t...n.k. .l...t.r.e.j...t.t. .j.o.g.i. .m.e.g...l.l.a.p.o.d...s. .. .a. .S.z.o.f.t.v.e.r...n.k. .t.e.l.e.p...t...s.e. .v.a.g.y. .a. .S.z.o.f.t.v.e.r...n.k.h...z. .v.a.l... .h.o.z.z...f...r...s. .a.z.t. .j.e.l.e.n.t.i.,. .h.o.g.y. ...n. .e.g.y.e.t...r.t. .a. .s.z.e.r.z.Q.d...s.b.e.n. .f.o.g.l.a.l.t. .f.e.l.t...t.e.l.e.k.k.e.l.,. .e.z...r.t. .o.l.v.a.s.s.a. .e.l. .f.i.g.y.e.l.m.e.s.e.n. .a.z.o.k.a.t... .........A.z. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s. .(.. S.z.e.r.z.Q.d...s.. ). .a. .S.z.o.f.t.v.e.r. .h.a.s.z.n...l.a.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-it-IT.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2974), with CRLF line terminators
Category:	dropped
Size (bytes):	103642
Entropy (8bit):	3.410923213664887
Encrypted:	false
SSDEEP:
MD5:	266422362D4487E33FA55D1644FDD2C1
SHA1:	73B1DFC1D22B0EA9070776B481F53FFE08E4A500
SHA-256:	1338056263EF2CF86FF8B6926F3AC25631B85813B07BF9BD3ECBE427A25905F3
SHA-512:	80E617FB194CF7783DFE1BB5DAEF9CE47669D7571868650998778F4CF259D79183AB991B1DA77F49297A56EDF71399047B531F40412D0C6D442F6E01F923167F
Malicious:	false
Reputation:	low
Preview:	..C.o.n.t.r.a.t.t.o. .d.i. .l.i.c.e.n.z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.z.i.e. .p.e.r. .a.v.e.r. .s.c.e.l.t.o. .d.i. .u.t.i.l.i.z.z.a.r.e. .i. .s.o.f.t.w.a.r.e. .e. .i. .s.e.r.v.i.z.i. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.w.a.r.e.".). .f.o.r.n.i.t.i. .d.a. .M.c.A.f.e.e.,. .c.o.n.s.o.c.i.a.t.a. .i.n.t.e.r.a.m.e.n.t.e. .c.o.n.t.r.o.l.l.a.t.a. .d.i. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .I.l. .p.r.e.s.e.n.t.e. .d.o.c.u.m.e.n.t.o. .c.o.s.t.i.t.u.i.s.c.e. .u.n. .c.o.n.t.r.a.t.t.o. .l.e.g.a.l.e. .t.r.a. .n.o.i. .e. .l.'.u.t.e.n.t.e... .L.'.i.n.s.t.a.l.l.a.z.i.o.n.e. .o. .l.'.a.c.c.e.s.s.o. .a.i. .n.o.s.t.r.i. .S.o.f.t.w.a.r.e. .i.m.p.l.i.c.a. .l.'.a.c.c.e.t.t.a.z.i.o.n.e. .d.i. .q.u.e.s.t.i. .t.e.r.m.i.n.i. .d.a. .p.a.r.t.e. .d.e.l.l.'.u.t.e.n.t.e.,. .c.h.e. .p.e.r.t.a.n.t.o. ... .t.e.n.u.t.o. .a. .l.e.g.g.e.r.l.i. .c.o.n. .a.t.t.e.n.z.i.o.n.e... .........I.l. .p.r.e.s.e.n.t.e. .c.o.n.t.r.a.t.t.o. .d.i. .l.i.c.e.n.z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".C.o.n.t.r.a.t.t.o.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-ja-JP.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1234), with CRLF line terminators
Category:	dropped
Size (bytes):	41412
Entropy (8bit):	5.771690240275463
Encrypted:	false
SSDEEP:
MD5:	6C7F6872BA27531BC70831CC9ABB326C
SHA1:	01ABACE1DFFF6AF1A387D8067A857AE50DA87CF0
SHA-256:	6F18E6253EF1C7BC883BE56F135171145A86B271A76B2D8BA16AF0F6B1F6CF67
SHA-512:	AB64DFB2688E715058CB232888D75254FE366A2C0EA4035054E69E78E7B279FE60647D15290B50678BE1022FA89AF29847C4C98416283CA8E6370604E849A19A
Malicious:	false
Reputation:	low
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. ..O(u1...QY.}........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .n0hQM..Q.P[.O>yg0B0.0 .M.c.A.f.e.e.L0.c.OY0.0 .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..0.0.0.0.0.0J0.0s0.0.0.0.0...0.0.0.0.0.0.0.0...0)R(uD0_0`0M0B0.0L0h0F0T0V0D0~0Y0.0 .,gQY.}o0J0.[.ih0S_>yh0n0..k0.}P}U0.0.0.l.vj0QY.}g0Y0.0J0.[.io0.0S_>yn0.0.0.0.0.0.0.0.0.0.0.0.0.0~0_0o0]0.0k0.0.0.0.0Y0.0S0h0k0.0.0.0,gQY.}n0ag.Nk0.T.aW0_0h0.0j0U0.0~0Y0n0g0.0,gQY.}.0.0O0J0...0O0`0U0D0.0 .........S0n0 .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..O(u1...QY.}.f...0,gQY.}.0..o0.0J0.[.in0.0.0.0.0.0.0.O(u)j.0.O(u6RP..0.0.0.0.0.0.0n0.g.Q.0.0.0.0.0~0_0o0_j...0..R.vk0.f.eJ0.0s0...Y0.0S_>yn0)j)R.0J0.0s0S_>yh0J0.[.in0..k0zv.uY0.0.S..'`n0B0.0.}.Nn0.N..k0.[Y0.0J0.[.in0.T.ak0d0D0f0....W0f0D0~0Y0.0 ....j0.0,gQY.}h0h0.0k0J0.[.ik0i.(uU0.0.0.0S_>yn0.0.0.0.0.0.0k0..Y0.0.X.f..h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.j.a.p.a.n.e.s.e./.i.n.d.e.x...h.t.m....0+T.0...Rag.Nx0n0.0.0.0L0+T~0.0f0D0~0Y0.0 ..T.Vyr.gn0ag.No0,gQY.}

C:\Program Files\McAfee\Temp2863637682\jslang\eula-ko-KR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1439), with CRLF line terminators
Category:	dropped
Size (bytes):	46328
Entropy (8bit):	5.585182635780428
Encrypted:	false
SSDEEP:
MD5:	8DC1287BCDE9634470CBC729998DB5D8
SHA1:	3E5FFB0DD3B6750F2C53A8B57D005AA8421089C1
SHA-256:	C81F8A65D9B1E06754BEA0AABC2BB0882A63F5D0D9C2975DF939E239297FE0AB
SHA-512:	0EB10729587531E25BE1CCD26685CADBF7901170009AA6160EEF2BEE85C6D7BDD995A6DDC67CB17AE36FF3205B81DD02B656B139051FB74AD4479CE834BB6989
Malicious:	false
Reputation:	low
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. .\|.t. ... ..}.........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.X. ...a. .... .....x. .M.c.A.f.e.e..... .....X.. .I.n.t.e.l. .S.e.c.u.r.i.t.y. ......... ... ...D...(.t.X. .. ......... ).\|. .....t. ...T... .....i..... .t..@. .....@. ...... ...t.X. ..... ..}...... .....X. .........\|. .$.X.X.p... .a.8...X.. ...@. .t. ..}. .}..... ..X.X.. ...t...\.,. .}...D. ...X. .J... .}.<...0. ......... .........t. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .\|.t. ... ..}.(.t.X. .. .}.. ).@. ......... ..... .....,. ......... .....X. ...\. .p.t.,. .........X. . .. .....t.. .0..... ...t. ....<.\. ..}.D. .1...X.. ......... ...a.D. ...l.`. ... .... .....X. .....,. ...... .....@. ...... ...t... .....`. ... .... .....X. ...... ...\. ...X.X. ..X. .....D. ........ .t. .8...... ...X.... ........ .t. ..... ..}.D. .l.1.X.. .\. .....x. ....\. ..... ..}. .}...(...:. ...x.......8. .H..8.,. .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-nb-NO.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2743), with CRLF line terminators
Category:	dropped
Size (bytes):	84476
Entropy (8bit):	3.4475806099732793
Encrypted:	false
SSDEEP:
MD5:	6CA4A7BDD113BA4CBEB11C1F6D55E878
SHA1:	D0E7870292715E80F6EF9EF097304EB34E278F04
SHA-256:	6938C6036427CF9573BC12E94D281F15ED80F79FF536B22765CF0DA907E5BF85
SHA-512:	997B039644AF43927F936E36AB52CE57F95EF05C234EFD1AEC6F379597C8A6AA126F9CF85EF48A5377B9B00FC0D258AE7AFD8DA9593FA516B945DE69BAD8F0FE
Malicious:	false
Reputation:	low
Preview:	..L.i.s.e.n.s.a.v.t.a.l.e. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.k.k. .f.o.r. .a.t. .d.u. .b.r.u.k.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.s. .p.r.o.g.r.a.m.v.a.r.e. .o.g. .t.j.e.n.e.s.t.e.r. .(.".p.r.o.g.r.a.m.m.e.t.).,. .l.e.v.e.r.t. .a.v. .M.c.A.f.e.e.,. .e.t. .h.e.l.e.i.d. .d.a.t.t.e.r.s.e.l.s.k.a.p. .a.v. .I.n.t.e.r. .C.o.r.p.o.r.a.t.i.o.n... .D.e.t.t.e. .e.r. .e.n. .j.u.r.i.d.i.s.k. .a.v.t.a.l.e. .m.e.l.l.o.m. .o.s.s. .. .i.n.s.t.a.l.l.a.s.j.o.n. .e.l.l.e.r. .b.r.u.k. .a.v. .v...r. .p.r.o.g.r.a.m.v.a.r.e. .b.e.t.y.r. .a.t. .d.u. .g.o.d.t.a.r. .d.i.s.s.e. .v.i.l.k...r.e.n.e.,. .s... .l.e.s. .d.e.m. .n...y.e... .........D.e.n.n.e. .l.i.s.e.n.s.a.v.t.a.l.e.n. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".a.v.t.a.l.e.n.".). .d.e.k.k.e.r. .d.i.n. .r.e.t.t. .t.i.l. ... .b.e.n.y.t.t.e. .p.r.o.g.r.a.m.v.a.r.e.n.,. .b.e.g.r.e.n.s.n.i.n.g.e.r. .p... .d.e.n.n.e. .b.r.u.k.e.n.,. .v...r. .r.e.t.t. .t.i.l. .a.u.t.o.m.a.t.i.s.k. .f.o.r.n.y.e.l.s.e. .o.g. .t.a. .b.e.t.a.l.t. .f.o.r. .b.e.t.a.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-nl-NL.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2801), with CRLF line terminators
Category:	dropped
Size (bytes):	100578
Entropy (8bit):	3.441900782202567
Encrypted:	false
SSDEEP:
MD5:	A01868D8BDC821913012C2B8C29552F7
SHA1:	513CA1D31EA18BAA36D6715824FA88933B6AF4B6
SHA-256:	FFAF392F8A5F32E210B423C7EA49F991BEC91E18ADE18C3CA913AFD0F7DB91A2
SHA-512:	ED7756573905F83071F5E154155AD3EEEED7DC6170010A42A3F6EB95F50B7D2D1E6BA969181388B7EC90083F1F9F44B926C3A1734B8416AAC604B0C009F3AE99
Malicious:	false
Reputation:	low
Preview:	..L.i.c.e.n.t.i.e.o.v.e.r.e.e.n.k.o.m.s.t. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........D.a.n.k. .u. .v.o.o.r. .h.e.t. .g.e.b.r.u.i.k. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y.-.s.o.f.t.w.a.r.e. .e.n. .-.d.i.e.n.s.t.e.n. .(.'.S.o.f.t.w.a.r.e.'.).,. .a.a.n.g.e.b.o.d.e.n. .d.o.o.r. .M.c.A.f.e.e.,. .e.e.n. .v.o.l.l.e.d.i.g.e. .d.o.c.h.t.e.r.o.n.d.e.r.n.e.m.i.n.g. .v.a.n. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .D.i.t. .i.s. .e.e.n. .j.u.r.i.d.i.s.c.h.e. .o.v.e.r.e.e.n.k.o.m.s.t. .t.u.s.s.e.n. .o.n.s... .D.o.o.r. .o.n.z.e. .S.o.f.t.w.a.r.e. .t.e. .i.n.s.t.a.l.l.e.r.e.n. .e.n. .t.e. .o.p.e.n.e.n.,. .g.e.e.f.t. .u. .a.a.n. .d.a.t. .u. .a.k.k.o.o.r.d. .g.a.a.t. .m.e.t. .d.e.z.e. .v.o.o.r.w.a.a.r.d.e.n... .L.e.e.s. .z.e. .d.u.s. .z.o.r.g.v.u.l.d.i.g... .........D.e.z.e. .L.i.c.e.n.t.i.e.o.v.e.r.e.e.n.k.o.m.s.t. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.'.O.v.e.r.e.e.n.k.o.m.s.t.'.). .b.e.s.c.h.r.i.j.f.t. .u.w. .r.e.c.h.t.e.n. .o.m. .d.e. .S.o.f.t.w.a.r.e. .t.e. .g.e.b.r.u.i.k.e.n.,. .d.e. .b.e.p.e.r.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-pl-PL.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2967), with CRLF line terminators
Category:	dropped
Size (bytes):	101850
Entropy (8bit):	3.7336966797598805
Encrypted:	false
SSDEEP:
MD5:	868618F543D0C5ABA43DE44071794B38
SHA1:	D33519C9283B4B09FA1AF46B228D19783D9CF92E
SHA-256:	C15649C9F86F8C7D0A4E7F6B3D047671D509786191C5FD490DC1847CB0B21360
SHA-512:	5F7FF28FD98E0C87091BB64600C805A65F018DA307D7F4AB0C94CEC3F34E5FE26571EB73BD4BD1BC733E7AF30DCA123CC48FB4ED222EE892C92CF30200EBE5FB
Malicious:	false
Reputation:	low
Preview:	..U.m.o.w.a. .l.i.c.e.n.c.y.j.n.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........D.z.i...k.u.j.e.m.y. .z.a. .k.o.r.z.y.s.t.a.n.i.e. .z. .o.p.r.o.g.r.a.m.o.w.a.n.i.a. .i. .u.s.B.u.g. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.z.w.a.n.y.c.h. .d.a.l.e.j. .. O.p.r.o.g.r.a.m.o.w.a.n.i.e.m.. ). .o.f.e.r.o.w.a.n.y.c.h. .p.r.z.e.z. .M.c.A.f.e.e.,. .s.p...B.k... .z.a.l.e.\|.n...,. .k.t...r.e.j. .w.y.B...c.z.n.y.m. .w.B.a.[.c.i.c.i.e.l.e.m. .j.e.s.t. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .N.i.n.i.e.j.s.z.y. .d.o.k.u.m.e.n.t. .s.t.a.n.o.w.i. .u.m.o.w... .p.r.a.w.n... .m.i...d.z.y. .n.a.m.i. .a. .U.\|.y.t.k.o.w.n.i.k.i.e.m. .. .z.a.i.n.s.t.a.l.o.w.a.n.i.e. .n.a.s.z.e.g.o. .O.p.r.o.g.r.a.m.o.w.a.n.i.a. .l.u.b. .u.z.y.s.k.a.n.i.e. .d.o. .n.i.e.g.o. .d.o.s.t...p.u. .j.e.s.t. .r...w.n.o.z.n.a.c.z.n.e. .z. .z.a.a.k.c.e.p.t.o.w.a.n.i.e.m. .n.i.n.i.e.j.s.z.y.c.h. .w.a.r.u.n.k...w.,. .w. .z.w.i...z.k.u. .z. .c.z.y.m. .p.r.o.s.i.m.y. .o. .u.w.a.\|.n.e. .z.a.p.o.z.n.a.n.i.e. .s.i... .z. .t.r.e.[.c.i... .d.o.k.u.m.e.n.t.u... ...

C:\Program Files\McAfee\Temp2863637682\jslang\eula-pt-BR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2603), with CRLF line terminators
Category:	dropped
Size (bytes):	91306
Entropy (8bit):	3.465058408699289
Encrypted:	false
SSDEEP:
MD5:	8ED01AF36A96D5933FBBC78CED777F77
SHA1:	E6509BA295633BCF387559F2CBB95CC847457469
SHA-256:	C446AE91F85DD2779A13A70583825C5067F97DE81EDBD59D1C32879859BA5145
SHA-512:	8C0B61DF2EE05D3DFFA95B8813828FCF30C4FDA54B973C038F01BB3BAB4DC21263DEFC6A051CCD934E491DF82BA4CEAC03CC5D3240364D8B4E867ADA6EDC6EEF
Malicious:	false
Reputation:	low
Preview:	..C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........A.g.r.a.d.e.c.e.m.o.s. .p.o.r. .u.t.i.l.i.z.a.r. .o. .s.o.f.t.w.a.r.e. .e. .o.s. .s.e.r.v.i...o.s. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.w.a.r.e.".).,. .f.o.r.n.e.c.i.d.o. .p.e.l.a. .M.c.A.f.e.e.,. .u.m.a. .s.u.b.s.i.d.i...r.i.a. .i.n.t.e.g.r.a.l. .d.a. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. ... .u.m. .c.o.n.t.r.a.t.o. .l.e.g.a.l. .e.n.t.r.e. .n...s.:. .a.o. .i.n.s.t.a.l.a.r. .o.u. .a.c.e.s.s.a.r. .n.o.s.s.o. .S.o.f.t.w.a.r.e.,. .s.i.g.n.i.f.i.c.a. .a. .s.u.a. .c.o.n.c.o.r.d...n.c.i.a. .c.o.m. .e.s.t.e.s. .t.e.r.m.o.s.,. .d.e. .f.o.r.m.a. .q.u.e. .v.o.c... .d.e.v.e. .l...-.l.o.s. .c.o.m. .a. .m...x.i.m.a. .a.t.e.n.....o... .........E.s.t.e. .C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".C.o.n.t.r.a.t.o.".). .c.o.b.r.e. .s.e.u.s. .d.i.r.e.i.t.o.s. .d.e. .u.t.i.l.i.z.a.....o. .d.o. .S.o.f.t.w.a.r.e.,. .r.e.s.t.r.i.....e.s. .a. .e.s.s.e. .u.s.o.,. .o. .

C:\Program Files\McAfee\Temp2863637682\jslang\eula-pt-PT.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2536), with CRLF line terminators
Category:	dropped
Size (bytes):	96486
Entropy (8bit):	3.4740788952855137
Encrypted:	false
SSDEEP:
MD5:	27331E6D23C62FEA0F0557F13D99D43C
SHA1:	8D474CBFE5B8E772AA4F5AFA6A9B59F06119A55E
SHA-256:	4F53C602976E47C1DAEC67E1300E22E9E6BBB7B511A9CD31B38880C8B6821C1E
SHA-512:	78FE5479997BC23C9F458880DEE0B660D8FC798A44860F0657B0979D0DB67D01F544E17F50B1259DEEB8C649AC81B74CA95D5A6BC7FC374918210907CC7D8C3B
Malicious:	false
Reputation:	low
Preview:	..C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........O.b.r.i.g.a.d.o. .p.o.r. .u.t.i.l.i.z.a.r. .o. .s.o.f.t.w.a.r.e. .e. .o.s. .s.e.r.v.i...o.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ). .f.o.r.n.e.c.i.d.o.s. .p.e.l.a. .M.c.A.f.e.e.,. .u.m.a. .s.u.b.s.i.d.i...r.i.a. .t.o.t.a.l.m.e.n.t.e. .d.e.t.i.d.a. .p.e.l.a. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .d.o.c.u.m.e.n.t.o. .c.o.n.s.i.s.t.e. .n.u.m. .c.o.n.t.r.a.t.o. .l.e.g.a.l. .e.n.t.r.e. .a.m.b.a.s. .a.s. .p.a.r.t.e.s.. a.o. .i.n.s.t.a.l.a.r. .o.u. .a.o. .a.c.e.d.e.r. .a.o. .n.o.s.s.o. .S.o.f.t.w.a.r.e. .e.s.t... .a. .c.o.n.c.o.r.d.a.r. .c.o.m. .o.s. .p.r.e.s.e.n.t.e.s. .t.e.r.m.o.s.,. .p.o.r. .i.s.s.o.,. .l.e.i.a.-.o.s. .a.t.e.n.t.a.m.e.n.t.e... .........O. .p.r.e.s.e.n.t.e. .C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. C.o.n.t.r.a.t.o.. ). .i.n.c.l.u.i. .o.s. .s.e.u.s. .d.i.r.e.i.t.o.s. .d.e. .u.t.i.l.i.z.a.....o. .d.o. .S.o.f.t.w.a.r.e.,. .r.e.s.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-ru-RU.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2934), with CRLF line terminators
Category:	dropped
Size (bytes):	105274
Entropy (8bit):	3.9253890058091128
Encrypted:	false
SSDEEP:
MD5:	8E8679BD238881B4E328758EE9B1CD2C
SHA1:	8B58CFA9E861D4F4423C7D9A39F0A4C5AFAEEEEB
SHA-256:	87DF68D221DED619D5B33F572270BB4A78678ED550912286058185A7D46AD3D3
SHA-512:	3B995444C93AF8B9FB4A566406F0E4351A45A7F8359DB773C3D54B630991C1F160B91D2BCD9F2FCA6FF3AAAA503DA2F5DB1302C5C53669B4E839F39D099E59E2
Malicious:	false
Reputation:	low
Preview:	....8.F.5.=.7.8.>.=.=.>.5. .A.>.3.;.0.H.5.=.8.5. .4.;.O. .?.@.>.3.@.0.<.<.=.>.3.>. .>.1.5.A.?.5.G.5.=.8.O. .I.n.t.e.l. .S.e.c.u.r.i.t.y...........;.0.3.>.4.0.@.8.<. ...0.A. .7.0. .8.A.?.>.;.L.7.>.2.0.=.8.5. .?.@.>.3.@.0.<.<.=.>.3.>. .>.1.5.A.?.5.G.5.=.8.O. .8. .A.;.C.6.1. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(."...@.>.3.@.0.<.<.=.>.5. .>.1.5.A.?.5.G.5.=.8.5.".).,. .?.@.5.4.>.A.B.0.2.;.O.5.<.K.E. .:.>.<.?.0.=.8.5.9. .M.c.A.f.e.e. .. .4.>.G.5.@.=.5.9. .:.>.<.?.0.=.8.5.9.,. .=.0.E.>.4.O.I.5.9.A.O. .2. .?.>.;.=.>.9. .A.>.1.A.B.2.5.=.=.>.A.B.8. .:.>.@.?.>.@.0.F.8.8. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... ...0.=.=.K.9. .4.>.:.C.<.5.=.B. .?.@.5.4.A.B.0.2.;.O.5.B. .N.@.8.4.8.G.5.A.:.>.5. .A.>.3.;.0.H.5.=.8.5. .<.5.6.4.C. .=.0.<.8... .#.A.B.0.=.>.2.:.0. .8.;.8. .4.>.A.B.C.?. .:. .=.0.H.5.<.C. ...@.>.3.@.0.<.<.=.>.<.C. .>.1.5.A.?.5.G.5.=.8.N. .>.1.>.7.=.0.G.0.N.B. ...0.H.5. .A.>.3.;.0.A.8.5. .A. .C.A.;.>.2.8.O.<.8. .M.B.>.3.>. .A.>.3.;.0.H.5.=.8.O.,. .?.>.M.B.>.<.C. .2.=.8.<.0.B.5.;.L.=.>. .>.7.=.0.:.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-sk-SK.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2701), with CRLF line terminators
Category:	dropped
Size (bytes):	89572
Entropy (8bit):	3.7335008776841807
Encrypted:	false
SSDEEP:
MD5:	57DDAB65D1D5F575977AFCAF92F9C9C1
SHA1:	41FFD8C6FF2D41912A945BD307EF69CBEC60B1B5
SHA-256:	AEE55641C00773BA23B26AEF0720578EFCBB7F7B2B22E328E9422083F824B1EE
SHA-512:	1CD3CD42AA44C96DDCEB055153A6B32758E94B0DA77AC6FAC1DA12ECA4310279755FE6F7FD0F7F3E60E71C20B0E9740F218D1E5A5A932217FAF15443EAAB6D49
Malicious:	false
Reputation:	low
Preview:	..L.i.c.e.n...n... .z.m.l.u.v.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y...........a.k.u.j.e.m.e. .v...m. .z.a. .p.o.u.~...v.a.n.i.e. .s.o.f.t.v...r.u. .a. .s.l.u.~.i.e.b. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.v...r.. ).,. .p.o.s.k.y.t.o.v.a.n...c.h. .s.p.o.l.o...n.o.s.e.o.u. .M.c.A.f.e.e.,. .k.t.o.r... .j.e. .d.c...r.s.k.o.u. .s.p.o.l.o...n.o.s.e.o.u. ...p.l.n.e. .v.l.a.s.t.n.e.n.o.u. .s.p.o.l.o...n.o.s.e.o.u. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .T.o.t.o. .j.e. .p.r...v.n.a. .z.m.l.u.v.a. .m.e.d.z.i. .n.a.m.i. .. .i.n.a.t.a.l...c.i.o.u. .a.l.e.b.o. .p.r...s.t.u.p.o.v.a.n...m. .k. .n...a.m.u. .S.o.f.t.v...r.u. .s...h.l.a.s...t.e. .s. .t...m.i.t.o. .p.o.d.m.i.e.n.k.a.m.i.,. .t.a.k.~.e. .s.i. .i.c.h.,. .p.r.o.s...m.,. .p.o.z.o.r.n.e. .p.r.e.....t.a.j.t.e... .........T...t.o. .L.i.c.e.n...n... .z.m.l.u.v.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(...a.l.e.j. .l.e.n. .. Z.m.l.u.v.a.. ). .s.a. .v.z.e.a.h.u.j.e. .n.a. .v.a.a.e. .p.r...v.a. .n.a. .p.o.u.~...v.a.n.i.e. .S.o.f.t.v...r.u.,. .o.b.m.e.d.z.e.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-sr-Latn-CS.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2634), with CRLF line terminators
Category:	dropped
Size (bytes):	88356
Entropy (8bit):	3.5780462545512095
Encrypted:	false
SSDEEP:
MD5:	449B9426C6C6CA645B6BCDB1A69122CA
SHA1:	3CF9A6BCD1580F3F9875BF87730DA14FBA64DAD7
SHA-256:	034F01176DFF06358C7BF32CBA0B60A671831EC3C39CE4B3C75A2051C6843DA6
SHA-512:	4909B45B95161960665821C98E8BA99C590F8DA69E19D5FB4BD897A53565DCB7A9979F28B62C115D8FF8BC3A40E5A4DEA947C92CBE55ECDF7B148123BECB4F52
Malicious:	false
Reputation:	low
Preview:	..U.g.o.v.o.r. .o. .l.i.c.e.n.c.i.r.a.n.j.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........H.v.a.l.a. .v.a.m. .a.t.o. .k.o.r.i.s.t.i.t.e. .s.o.f.t.v.e.r. .i. .u.s.l.u.g.e. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.v.e.r.. ).,. .k.o.j.i. .o.b.e.z.b.e...u.j.e. .k.o.m.p.a.n.i.j.a. .M.c.A.f.e.e.,. .p.o.d.r.u.~.n.i.c.a. .u. .p.o.t.p.u.n.o.m. .v.l.a.s.n.i.a.t.v.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .O.v.o. .j.e. .p.r.a.v.n.i. .u.g.o.v.o.r. .i.z.m.e...u. .n.a.s. .. .i.n.s.t.a.l.i.r.a.n.j.e. .n.a.a.e.g. .S.o.f.t.v.e.r.a. .i.l.i. .p.r.i.s.t.u.p.a.n.j.e. .n.j.e.m.u. .z.n.a...i. .d.a. .p.r.i.h.v.a.t.a.t.e. .o.v.e. .u.s.l.o.v.e.,. .p.a. .i.h. .s.t.o.g.a. .p.a.~.l.j.i.v.o. .p.r.o...i.t.a.j.t.e... .........O.v.a.j. .U.g.o.v.o.r. .o. .l.i.c.e.n.c.i.r.a.n.j.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. U.g.o.v.o.r.. ). .p.o.k.r.i.v.a. .v.a.a.a. .p.r.a.v.a. .d.a. .k.o.r.i.s.t.i.t.e. .S.o.f.t.v.e.r.,. .o.g.r.a.n.i...e.n.j.a. .t.o.g. .k.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-sv-SE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2632), with CRLF line terminators
Category:	dropped
Size (bytes):	89704
Entropy (8bit):	3.503679482731326
Encrypted:	false
SSDEEP:
MD5:	0BF8549EE388824ECE877A8F57284741
SHA1:	5DC7E108E0C92840ED5233DF96648FB79FD0D07E
SHA-256:	C171B6CF831FF87A9DA8085AAED1345B466CDCE40F1272338DB4578FCE516D8C
SHA-512:	02F28793B7DD26F647551F8C946325094E2372076761986C0C952EC1DE91AACD96FFD39DE550972838BA24DB533AF55D86B2271F84844424978CCD7FD2EA11E1
Malicious:	false
Reputation:	low
Preview:	..L.i.c.e.n.s.a.v.t.a.l. .f...r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.c.k. .f...r. .a.t.t. .d.u. .a.n.v...n.d.e.r. .p.r.o.g.r.a.m.v.a.r.a.n. .o.c.h. .t.j...n.s.t.e.r.n.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. P.r.o.g.r.a.m.v.a.r.a.n.. ). .f.r...n. .M.c.A.f.e.e.,. .e.t.t. .h.e.l...g.t. .d.o.t.t.e.r.b.o.l.a.g. .t.i.l.l. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .N...r. .d.u. .i.n.s.t.a.l.l.e.r.a.r. .e.l.l.e.r. .a.n.v...n.d.e.r. .P.r.o.g.r.a.m.v.a.r.a.n. .g.o.d.k...n.n.e.r. .d.u. .a.u.t.o.m.a.t.i.s.k.t. .v.i.l.l.k.o.r.e.n.,. .s... .l...s. .n.o.g.a. .i.g.e.n.o.m. .d.e.m. .f...r.s.t... .D.e.t.t.a. ...r. .e.t.t. .b.i.n.d.a.n.d.e. .j.u.r.i.d.i.s.k.t. .a.v.t.a.l. .o.s.s. .e.m.e.l.l.a.n... .........D.e.t.t.a. .L.i.c.e.n.s.a.v.t.a.l. .f...r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. A.v.t.a.l.e.t.. ). .r.e.g.l.e.r.a.r. .d.i.n.a. .r...t.t.i.g.h.e.t.e.r. .i. .s.a.m.b.a.n.d. .m.e.d. .a.n.v...n.d.n.i.n.g. .a.v. .P.r.o.g.r.a.m.v.a.r.a.n.,. .e.v.e.n.t.u.e.l.l.a. .b.e.g.r...n.s.n.i.n.g.a.r. .i. .a.n.v...n.d.n.i.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-tr-TR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2527), with CRLF line terminators
Category:	dropped
Size (bytes):	89572
Entropy (8bit):	3.762382319609866
Encrypted:	false
SSDEEP:
MD5:	1B4DD315A275F8BFED163420DA8FBEE4
SHA1:	A6CDDB33749AE857176B15008F1E50AED603045B
SHA-256:	61C8CEA6AB8E5461CC240EEF016BDEB16E62BC6B7744DA9E80B51B1123BD6237
SHA-512:	30632B6DC06B57F0092CEBFCC7687C7E005B85A1E55804CC235ADEB0D057C80C39675F89DD41F092071213FC32CAA5132F82F92AD6F3EA33FEE7425963589B99
Malicious:	false
Reputation:	low
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.s.a.n.s. .S...z.l.e._.m.e.s.i.........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.. 1.n. .y...z.d.e. .y...z. .i._.t.i.r.a.k.i. .o.l.a.n. .M.c.A.f.e.e. .t.a.r.a.f.1.n.d.a.n. .s.a...l.a.n.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .y.a.z.1.l.1.m.1. .v.e. .h.i.z.m.e.t.l.e.r.i.n.i. .(.. Y.a.z.1.l.1.m.. ). .k.u.l.l.a.n.d.1...1.n.1.z. .i...i.n. .t.e._.e.k.k...r. .e.d.e.r.i.z... .Y.a.z.1.l.1.m.1.m.1.z.1.n. .k.u.r.m.a.n.1.z. .v.e.y.a. .Y.a.z.1.l.1.m.1.m.1.z.a. .e.r.i._.i.m. .s.a...l.a.m.a.n.1.z. .a.r.a.m.1.z.d.a.k.i. .b.u. .y.a.s.a.l. .s...z.l.e._.m.e.n.i.n. .i.l.g.i.l.i. .h...k...m.l.e.r.i.n.i. .k.a.b.u.l. .e.t.t.i...i.n.i.z. .a.n.l.a.m.1.n.a. .g.e.l.e.c.e...i.n.d.e.n.,. .l...t.f.e.n. .b.u.n.l.a.r.1. .d.i.k.k.a.t.l.i.c.e. .o.k.u.y.u.n... .........0._.b.u. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.s.a.n.s. .S...z.l.e._.m.e.s.i. .(.. S...z.l.e._.m.e.. ). .Y.a.z.1.l.1.m.1.n. .k.u.l.l.a.n.1.l.m.a.s.1.n.a. .i.l.i._.k.i.n. .h.a.k.l.a.r.1.n.1.z.1.,. .s...z. .k.o.n.u.s.u. .k.u.l.l.a.n.1.m.

C:\Program Files\McAfee\Temp2863637682\jslang\eula-zh-CN.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (873), with CRLF line terminators
Category:	dropped
Size (bytes):	27048
Entropy (8bit):	6.793318949139549
Encrypted:	false
SSDEEP:
MD5:	359E8741BF5310BFBFC926B2739899AD
SHA1:	E3ECADA8CC71A3B8CCC6AD203D40EECFDEFA712E
SHA-256:	A24E29E3AAB9D673AB3B3584189440579CBA3E4659755FBCE8DEEB168A1F2721
SHA-512:	C7672DD79E7960924F11A16ED363FA571ED793F57DF3DCEEBB7115C8FFA5CEA74DC78DA5F1CE49FCBAC72EE54888A0D8B6928FB521D8A1212C2E5EA862B15312
Malicious:	false
Reputation:	low
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. ....SOS...........a"..`.O(u1u .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. ..vhQD.P[lQ.S .M.c.A.f.e.e. ..c.O.v .I.n.t.e.l. .S.e.c.u.r.i.t.y. .o..N.T.g.R... o..N. ...0 ../f.`.N.b.NKN...v.l._OS.....[..b....b.N.v. o..N. ..sSh.:y.`.T.a..Nag>k...Vdk...N.~.....0 .........,g .I.n.t.e.l. .S.e.c.u.r.i.t.y. ....SOS..... OS... ...m.v.`.O(u. o..N. .vCg)R.0.O(uP.6R.0.b.N.R.~..v^1\. o..N. .v.N9.Hr,g.b.R...T.`6e9..vCg)R...N.S.`.T.a....N...Q.b.NKN...S...N.u.v.NUO.N...0 .,gOS...S+T.b.N.v...y.X.fI{D..Rag>k.v...c .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.c.h.i.n.e.s.e.-.s.i.m.p.l.i.f.i.e.d./.i.n.d.e.x...h.t.m.).....Nag>k._.....v^qQ.T.g.b..(u.N.`.v,g.l._OS...0 ..V.[/.0W:Syr.[.vag>kMO.NOS...v.g.T.Nag.0 ..........Y.g.`g.n .1.8. ..\...l.g.`.v6r.k.b.v.b.N...N.N._{.HQ.c.S,gOS..v^.Nh..`.{.t. o..N. ...v.T.a...`.N._.O(u. o..N. .b.T.b.N.c.O.`.vN.N.Oo`.0 .........1......c.S,gOS...T.O9e .. .US.Q. .c.S. .c...b.[.. o..N. ..sSh.:y.`.eag.N.T.a.S,g

C:\Program Files\McAfee\Temp2863637682\jslang\eula-zh-TW.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (904), with CRLF line terminators
Category:	dropped
Size (bytes):	27300
Entropy (8bit):	6.852766523087007
Encrypted:	false
SSDEEP:
MD5:	EC47749751D4472B0CE985A60609B1D6
SHA1:	9F391EC407FA4F1FD4984E7B2235C8639F81E8E9
SHA-256:	1A821698AF829C6B15A5CD0130E84141D9CBB10ED21D692390DA3491F9AC3B53
SHA-512:	70A0F745D2275B101FE234265BFA706234F72AE31EEF2CA28027E8C38CD64273DD93D1694B07CAA71DF1443A1F710F4F1259A7BC231DF6E749EBA717C354821D
Malicious:	false
Reputation:	low
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. ..c.k.T.}.........a...`.O(u1u .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .hs.P[lQ.S .M.c.A.f.e.e. ..c.O.v .I.n.t.e.l. .S.e.c.u.r.i.t.y. ......g.R...0...0...0 .../f.`...b.PKN...v.l._.T.} .. ..[..bX[.S.b.P.v.0...0..sSh.:y.`.T.a...N.h>k...Vdk..N0}.....0 .........,g .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..c.k.T.}...0.T.}.0...m..`.O(u.0...0.v.k)R.0.O(uP.6R.0.b.P..R.~..&N1\.0...0.v.N..Hr,g.b.R...T.`6e...v.k)R...N.S.`.T.a..N..N...zl.b.PKN...S.."u.u.v.NUO-rp..0 ..b.P.].S.b.b.P.v...y.kr..fI{D..R.h>k.v#.P} .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.c.h.i.n.e.s.e.-.t.r.a.d.i.t.i.o.n.a.l./.i.n.d.e.x...h.t.m.)......N.h>k._.....&NqQ.T.i.bi.(u.e.`.v,g.l._.T.}.0 ..W.[/.0W@Syr.[.v.h>kMO.e.T.}.v.g._.N.h.0 ..........Y.g.`*g.n .1.8. .rk...l.g.`.v6r.k.b.vw..N...N.P._..HQ.c.S,g.T.}&N.Nh..`.{.t.0...0...v.T.a...`.N..AQ1..O(u.0...0.b.T.b.P.c.O.`.v.P.N....0 .........1......c.S,g.T.}.T.O9e .. ..c.N.0.c.S.0.c...b.[..0...0..sSh.:y.`!q.h

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-cs-CZ.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2553
Entropy (8bit):	5.574169144997834
Encrypted:	false
SSDEEP:
MD5:	94D48A00A5CD08BCBF7C00FE867AC6C8
SHA1:	0E716AB1E0CE58E4A41A2E76609E2CFA5A286903
SHA-256:	DCFCCD54723678E4A046D91CFAB4E47A9153F867BF71C02418329E675378C23F
SHA-512:	72D934B757AEB52F78BAFBBE40AE651ED767654E19F79979291800956EAB6B63DAB989B015D20BB1C44343A57911B9E6F072FA3361949FAEBA3E1D0AD44617CD
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licen.n. smlouva",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "P.e.etl(a) jsem si licen.n. smlouvu a souhlas.m s n..",.. //{0} - Company name.. THANK_YOU: "D.kujeme, .e jste si vybrali aplikaci {0}.",.. INSTALL: "Nainstalovat",.. CANCEL: "Zru.it",.. RETRY: "Zkusit znovu",.. //{0} - Product name.. PROGRESS_TITLE: "Aplikace {0} poskytuje rady ohledn. va.. bezpe.nosti kdekoli na internetu.",.. PROGRESS_SUBTITLE: "Prob.h. instalace...",.. COMPLETE_TITLE: "V.born.! Aplikace byla nainstalov.na a bude v.m poskytovat rady ohledn. bezpe.nosti na internetu.",.. COMPLETE_SUBTITLE: "V.e je p.ipraveno.",.. COMPLETE_LAUNCH: "Otev..t prohl..e.",.. ERROR_OS_REQUIREMENTS: "V instalaci nelze pokra.ovat, proto.e opera.n. syst.m nespl.uje minim.ln. po.adavky na syst.m. Aktualizujte ho a zkuste to znovu.",.. ERROR_BROWSER_REQUIREMENTS: "V instalaci nelze pokra.ovat, proto.e prohl..

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-da-DK.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2347
Entropy (8bit):	5.333935106455295
Encrypted:	false
SSDEEP:
MD5:	31CD59D443F62894AA7845B16B52D230
SHA1:	445862B005673F3D8579E735B9E2BADF12B8A9C1
SHA-256:	A136CF17026B7D5C3F7B686095697697AD937F11B7DAD300793BD6A04FAE8484
SHA-512:	6D8E4428868C025CC5ECD489DB9AA670B83D6F039A76AE989DE6C96A94ED54BE6C9BD588748094D4327FD66E2777D53BB0A6ED7EF4164D34753D3923FD1C1CDF
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licensaftale",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jeg har l.st og er indforst.et med licensaftalen",.. //{0} - Company name.. THANK_YOU: "Tak, fordi du valgte {0}",.. INSTALL: "Installer",.. CANCEL: "Annuller",.. RETRY: "Pr.v igen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} er din personlige sikkerhedsr.dgiver, uanset hvor du f.rdes p. nettet.",.. PROGRESS_SUBTITLE: "Installerer ...",.. COMPLETE_TITLE: "Fint. Vi har installeret din personlige onliner.dgiver.",.. COMPLETE_SUBTITLE: "Klar til start",.. COMPLETE_LAUNCH: ".bn browseren",.. ERROR_OS_REQUIREMENTS: "Installationen kan ikke forts.tte, da operativsystemet ikke lever op til minimumssystemkravene. Opdater, og pr.v igen.",.. ERROR_BROWSER_REQUIREMENTS: "Installationen kan ikke forts.tte, da browseren ikke lever op til minimumssystemkravene. Opdater browseren, og pr.v igen.",.. ERROR_VERSION: "Der er allerede installeret e

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-de-DE.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2600
Entropy (8bit):	5.247421187490919
Encrypted:	false
SSDEEP:
MD5:	CB1508DCE3D340F7510181A0D8C8795C
SHA1:	E07A00782D22DE00EBDB8922E39F8AE94B2620FF
SHA-256:	768CE90BC1ABF7C4B4DE06AF052EAA469B96A2A15A96BC2C93517A233C24B8B8
SHA-512:	1BF169C5492BD29D5D39B42890AD0A657CEC69ECE0D8EA37265912402548F0E0A5A0A51BDB2B8DC39F825B4E4BAA4B4DBDA42EA4A341E01B2605578D04BAB30A
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Lizenzvertrag",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ich habe den Lizenzvertrag gelesen und stimme ihm zu",.. //{0} - Company name.. THANK_YOU: "Vielen Dank f.r Ihren Download von {0}",.. INSTALL: "Installieren",.. CANCEL: "Abbrechen",.. RETRY: "Erneut versuchen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ist Ihr pers.nlicher Sicherheitsberater f.r das Internet.",.. PROGRESS_SUBTITLE: "Installation l.uft...",.. COMPLETE_TITLE: "Sehr gut. Ihr pers.nlicher Online-Berater wurde installiert.",.. COMPLETE_SUBTITLE: "Fertig",.. COMPLETE_LAUNCH: "Browser .ffnen",.. ERROR_OS_REQUIREMENTS: "Ihre Installation kann nicht fortgesetzt werden, da Ihr Betriebssystem nicht den Mindestsystemanforderungen entspricht. Aktualisieren Sie es, und versuchen Sie es erneut.",.. ERROR_BROWSER_REQUIREMENTS: "Ihre Installation kann nicht fortgesetzt werden, da Ihr Browser nicht den Mindestsystemanforderungen entspr

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-el-GR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3909
Entropy (8bit):	4.959626330234211
Encrypted:	false
SSDEEP:
MD5:	35188F8291A1F6C53385FEB578A4DCE8
SHA1:	1C3617998E95B54DA45D2A568B2CA898041E7BE1
SHA-256:	E48BFD5A8A23739E0442BE5B85232450736349D01E201317DCC35C6D9836997E
SHA-512:	028FEA1DBEC413C387484D81B8362B6241882A0026DE85554A20D308730CB82C9996776E6432C1D68D4E36EA6CAA7BC99A0AFB5637EB0475370E7578659F18E9
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "........ ...... ......",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "....... ... .......... .. ........ ...... ......",.. //{0} - Company name.. THANK_YOU: "............ ... ......... .. {0}",.. INSTALL: "...........",.. CANCEL: ".......",.. RETRY: ".........",.. //{0} - Product name.. PROGRESS_TITLE: ".. {0} ..... . .......... ... ......... ......... ... ........... ......... ............ ... Internet.",.. PROGRESS_SUBTITLE: "..............",.. COMPLETE_TITLE: "......! ............. ... ......... ... ........ ... Internet.",.. COMPLETE_SUBTITLE: "..... .......",.. COMPLETE_LAUNCH: "....... ............ ..........",.. ERROR

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-en-US.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.267826119993783
Encrypted:	false
SSDEEP:
MD5:	826DA40012B9ED67DEC5628564F13E37
SHA1:	7394CF9C5690D48F9B98F7EC2B787AAEAB4343F6
SHA-256:	99F7D7328C393F9B9EDE0920965F3450D28EAB68FC84A5E9C85D96BE066D54FE
SHA-512:	14A2F8C1ED483780B9CE2DD42728EE540AF3C3E6DD3CFAC9D270E4EB40E1DE5833FE0CF5418D39444A490320D8B04BB0EE72C6F4C764B6BA69021C340829EBEF
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "License Agreement",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "I have read and agree to the License Agreement",.. //{0} - Company name.. THANK_YOU: "Thank you for choosing {0}",.. INSTALL: "Install",.. CANCEL: "Cancel",.. RETRY: "Try Again",.. //{0} - Product name.. PROGRESS_TITLE: "{0} is your personal safety advisor wherever you go online.",.. PROGRESS_SUBTITLE: "Installing...",.. COMPLETE_TITLE: "Great! We've installed your personal online advisor.",.. COMPLETE_SUBTITLE: "Ready to go",.. COMPLETE_LAUNCH: "Open my browser",.. ERROR_OS_REQUIREMENTS: "Your installation cannot continue because your operating system does not meet the minimum system requirements. Please update it and try again.",.. ERROR_BROWSER_REQUIREMENTS: "Your installation cannot continue because your browser does not meet our minimum system requirements. Please update your browser and try again.",.. ERROR_VERSION: "You already hav

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-es-ES.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2408
Entropy (8bit):	5.23107103371674
Encrypted:	false
SSDEEP:
MD5:	38170910D2B12FC46D35AAC5B865B4C8
SHA1:	B428448B240FC63E756E4A5AF50B70F603027C5F
SHA-256:	13D67914092413B6101892F3749A2026FB02812226C7E26230B642EDC14F51DE
SHA-512:	BD1511DC9161290E17B3625FC75307E2A37CF7037B04ACF9E23B369FE17A0D6EDECD296D60B6F630DA6BE23ADAEC5379884AA7E57A5B7FE35B33E0FCEBCE6D4B
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Acuerdo de licencia",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "He le.do y acepto el Acuerdo de licencia",.. //{0} - Company name.. THANK_YOU: "Gracias por haber elegido {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Vuelva a intentarlo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} es su asesor de seguridad personal para la navegaci.n online.",.. PROGRESS_SUBTITLE: "Instalando...",.. COMPLETE_TITLE: ".Genial! Hemos instalado su asesor online personal.",.. COMPLETE_SUBTITLE: "Listo para empezar",.. COMPLETE_LAUNCH: "Abrir mi navegador",.. ERROR_OS_REQUIREMENTS: "La instalaci.n no puede continuar porque el sistema operativo no cumple los requisitos m.nimos necesarios del sistema. Actual.celo y vuelva a intentarlo.",.. ERROR_BROWSER_REQUIREMENTS: "La instalaci.n no puede continuar porque el navegador no cumple los requisitos m.nimos necesarios del sistema. Actualice el navegador y

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-es-MX.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2426
Entropy (8bit):	5.244880336393164
Encrypted:	false
SSDEEP:
MD5:	565FA3F4435A6879B7192319001F21C7
SHA1:	1B79C7DFB1A35D9575C548D3350A7522DAEB4EC6
SHA-256:	DE331BFE0312F4A0B5DB40AAB8FADC385CE051D43ED60A470CF9B35954C88308
SHA-512:	5C380CEA1FA5B70588DF5D08E87B4C4B95D524B08E71B31EC7BB2829ABB148FE7680BA698663EF8FFE10E1E5B7967F44EE7D2749C8C1612CC1B3F4CF69CC5069
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Acuerdo de licencia",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "He le.do y acepto el Acuerdo de licencia",.. //{0} - Company name.. THANK_YOU: "Gracias por elegir {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Vuelva a intentarlo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} es su asesor de seguridad personal para la navegaci.n en l.nea.",.. PROGRESS_SUBTITLE: "Instalando.",.. COMPLETE_TITLE: ".Excelente! Hemos instalado su asesor de seguridad personal en l.nea.",.. COMPLETE_SUBTITLE: "Listo para empezar",.. COMPLETE_LAUNCH: "Abrir mi navegador",.. ERROR_OS_REQUIREMENTS: "La instalaci.n no puede continuar porque el sistema operativo no cumple los requisitos m.nimos necesarios del sistema. Actual.celo y vuelva a intentarlo.",.. ERROR_BROWSER_REQUIREMENTS: "La instalaci.n no puede continuar porque el navegador no cumple los requisitos m.nimos necesarios del sistema. Actualice

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-fi-FI.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2464
Entropy (8bit):	5.32809919710467
Encrypted:	false
SSDEEP:
MD5:	FC172CAEBECD16B5ACA6A31132898868
SHA1:	6959FDE12BDB2B64DDE80572548E0A2C181BB201
SHA-256:	F9874A51A7DDAACACEC7A53221D9FE1495C67C11B9B60C731C782597A2040285
SHA-512:	2947B934B0F75A08750077981742569F04EEB5DB691F42941AD5A517E1EB27C414C319FF62A2FF05B9FEAB93A2963C77B85D0D04533E6156ED41A2281F9DC8BF
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "K.ytt.oikeussopimus",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Olen lukenut k.ytt.oikeussopimuksen ja hyv.ksyn sen.",.. //{0} - Company name.. THANK_YOU: "Kiitos, ett. valintasi on {0}",.. INSTALL: "Asenna",.. CANCEL: "Peruuta",.. RETRY: "Yrit. uudelleen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} on henkil.kohtainen turvallisuusavustajasi, kun k.yt.t verkkoa.",.. PROGRESS_SUBTITLE: "Asennetaan.",.. COMPLETE_TITLE: "Hienoa! Henkil.kohtainen verkkoavustajasi on asennettu.",.. COMPLETE_SUBTITLE: "Valmis k.ytett.v.ksi",.. COMPLETE_LAUNCH: "K.ynnist. selain",.. ERROR_OS_REQUIREMENTS: "Asennusta ei voi jatkaa, koska k.ytt.j.rjestelm.si ei t.yt. j.rjestelm.n v.himm.isvaatimuksia. P.ivit. k.ytt.j.rjestelm. ja yrit. uudelleen.",.. ERROR_BROWSER_REQUIREMENTS: "Asennusta ei voi jatkaa, koska selaimesi ei t.yt. j.rjestelm.n v.himm.isvaatimuksia. P.ivit. selain ja yr

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-fr-CA.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2783
Entropy (8bit):	5.254933022383819
Encrypted:	false
SSDEEP:
MD5:	64816D7F2A328E11F770E32F7A50484E
SHA1:	383930CB275A9AF6DB080DA6B09842B76FF440F4
SHA-256:	DBCD2341621B62D12ACF04701BFC42F1D4EB646439F9D7D242605CC036AF51FC
SHA-512:	2BB37692C8381066FA2F0CEE734CD58207DE8FEE0E0EB68947A286EAE74D403D516981A057F1068E83606EC1BDEB671AB7A3639FC8238D1A7B14E918899413EF
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Contrat de licence",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "J'ai lu et approuv. le contrat de licence",.. //{0} - Company name.. THANK_YOU: "Merci d'avoir choisi {0}",.. INSTALL: "Installation",.. CANCEL: "Annuler",.. RETRY: "R.essayez",.. //{0} - Product name.. PROGRESS_TITLE: "{0} est votre conseiller personnel en mati.re de s.curit. lorsque vous naviguez en ligne.",.. PROGRESS_SUBTITLE: "Installation...",.. COMPLETE_TITLE: "Tr.s bien! Nous avons install. votre conseiller personnel en mati.re de s.curit. en ligne.",.. COMPLETE_SUBTITLE: "Pr.t au lancement",.. COMPLETE_LAUNCH: "Ouvrir mon navigateur",.. ERROR_OS_REQUIREMENTS: "Il est impossible de poursuivre l'installation, car votre syst.me d'exploitation ne satisfait pas . la configuration minimale requise. Veuillez le mettre . jour et essayer de nouveau.",.. ERROR_BROWSER_REQUIREMENTS: "Il est impossible de poursuivre l'installatio

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-fr-FR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	5.272326001804358
Encrypted:	false
SSDEEP:
MD5:	D88A9443942F187F9A59D334F5B1A765
SHA1:	647DE934D2426375D3E311E5FADDD97C4D093FD1
SHA-256:	975A1B714BC14BED3636A6756C581898DEC03AF3B0A6D996D777B03B1BEEF88F
SHA-512:	8E198C8EDFA388CA54970FEBB395F8CCAA83BF10EEA49B3D21027F36B7E96EF0F8452255F090C06DD8209E1648BC0502B2A44740971CA83E12651EEC42DF6343
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Accord de licence",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "J'ai lu et j'accepte l'accord de licence",.. //{0} - Company name.. THANK_YOU: "Merci d'avoir choisi {0}",.. INSTALL: "Installer",.. CANCEL: "Annuler",.. RETRY: "R.essayer",.. //{0} - Product name.. PROGRESS_TITLE: "{0} est votre conseiller personnel en mati.re de s.curit. o. que vous vous trouviez en ligne.",.. PROGRESS_SUBTITLE: "Installation...",.. COMPLETE_TITLE: "Tr.s bien. Nous avons install. votre conseiller en ligne personnel.",.. COMPLETE_SUBTITLE: "Pr.t",.. COMPLETE_LAUNCH: "Ouvrir mon navigateur",.. ERROR_OS_REQUIREMENTS: "Votre installation ne peut pas se poursuivre car votre syst.me d'exploitation ne correspond pas . la configuration syst.me minimale requise. Mettez-le . jour et essayez . nouveau.",.. ERROR_BROWSER_REQUIREMENTS: "Votre installation ne peut pas se poursuivre car votre navigateur ne correspond pas .

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-hr-HR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2472
Entropy (8bit):	5.35142214273438
Encrypted:	false
SSDEEP:
MD5:	F5A4C7E4887A85968564F17531A199F6
SHA1:	14AFA8A3089E9FDF56104ECD055CAA301DCCE892
SHA-256:	CA1DA36A8E26CC5C4283E1B0FCFC4DE98A79A5FE9C847F52E74C70FC2982BEC6
SHA-512:	B921A83071EBEBBD71234B3015AD01708CF8B6530721707CDDB8AB8572EFC3FD6E7DCA46A653F0AE63B076DEB305450FCAD1477F54D1C0FFC21896121FD7978B
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licencni ugovor",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pro.itao/la sam i prihva.am Licencni ugovor",.. //{0} - Company name.. THANK_YOU: "Zahvaljujemo .to ste odabrali tvrtku {0}",.. INSTALL: "Instaliraj",.. CANCEL: "Odustani",.. RETRY: "Poku.ajte ponovno",.. //{0} - Product name.. PROGRESS_TITLE: "{0} va. je osobni savjetnik o sigurnosti neovisno o tome gdje se nalazite na mre.i.",.. PROGRESS_SUBTITLE: "Instaliranje...",.. COMPLETE_TITLE: "Sjajno! Instalirali smo va.eg osobnog savjetnika na mre.i.",.. COMPLETE_SUBTITLE: "Spremno za rad",.. COMPLETE_LAUNCH: "Otvori moj preglednik",.. ERROR_OS_REQUIREMENTS: "Instalaciju nije mogu.e nastaviti jer va. operacijski sustav ne ispunjava minimalne preduvjete sustava. A.urirajte ga i poku.ajte ponovno.",.. ERROR_BROWSER_REQUIREMENTS: "Instalaciju nije mogu.e nastaviti jer va. preglednik ne ispunjava minimalne preduvjete sustava. A.urirajte p

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-hu-HU.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2712
Entropy (8bit):	5.522969234769431
Encrypted:	false
SSDEEP:
MD5:	EAF7ABF3740F41E8D05C8F0788D794F2
SHA1:	5C7B54D31137ADB73E49F7C8976A4B20A65AF544
SHA-256:	D744D6F90475CF2C7CC66B8B9DBC5049DB3E4720086EB672A812F3F40BA6395D
SHA-512:	0EF015D69A409BA85E7F0C69C3615C73DBFEE4A4185EBD88D369890CD826E7F5472DFCFB5F7C90318C092D0B3FF5B14022B0052B1C4A0EFAB63E04636989DF8E
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licencmeg.llapod.s",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Elolvastam .s elfogadom a Licencmeg.llapod.st",.. //{0} - Company name.. THANK_YOU: "K.sz.nj.k, hogy a(z) {0} mellett d.nt.tt",.. INSTALL: "Telep.t.s",.. CANCEL: "M.gse",.. RETRY: "Pr.b.lkozzon .jra",.. //{0} - Product name.. PROGRESS_TITLE: "{0} az .n szem.lyi tan.csad.ja, aki mindenhova .nnel tart az interneten.",.. PROGRESS_SUBTITLE: "Telep.t.s...",.. COMPLETE_TITLE: "Rendben. Szem.lyi tan.csad.j.nak telep.t.se sikeresen befejez.d.tt.",.. COMPLETE_SUBTITLE: "Haszn.latra k.sz",.. COMPLETE_LAUNCH: "B.ng.sz. megnyit.sa",.. ERROR_OS_REQUIREMENTS: "A telep.t.s nem folytat.dhat, mivel az oper.ci.s rendszer nem felel meg a minim.lis rendszerk.vetelm.nyeknek. Hajtsa v.gre a friss.t.st, majd pr.b.lkozzon .jra.",.. ERROR_BROWSER_REQUIREMENTS: "A telep.t.s nem folytat.dhat, mivel a b.ng.sz. n

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-it-IT.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	5.2754976493804335
Encrypted:	false
SSDEEP:
MD5:	B55990CF0154A46C757DBB34AAD702E6
SHA1:	EDF6DF5FE52A8FDFBE9DB8A5CC71E258E3DE85D3
SHA-256:	0C12592901FE41369B4E112E6E8E758EA477F111C0C32557C7E0036275C1E2EA
SHA-512:	7B97219B654E9D6E81F9477317A043420BCCA2E3B5424D408783ED9013AE8FF8B0A7A6773C9E794AE75086492234AA460993684D573538F9B91B8A253E8706B1
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Contratto di licenza",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ho letto e accetto il contratto di licenza",.. //{0} - Company name.. THANK_YOU: "Grazie per aver scelto {0}",.. INSTALL: "Installa",.. CANCEL: "Annulla",.. RETRY: "Riprova",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . il tuo consulente sulla sicurezza personale quando sei online.",.. PROGRESS_SUBTITLE: "Installazione in corso...",.. COMPLETE_TITLE: "Perfetto! Abbiamo installato il tuo consulente sulla sicurezza online personale.",.. COMPLETE_SUBTITLE: "Pronto all'uso",.. COMPLETE_LAUNCH: "Apri browser",.. ERROR_OS_REQUIREMENTS: "L'installazione non pu. proseguire poich. il sistema operativo non soddisfa i requisiti minimi di sistema. Aggiornalo e riprova.",.. ERROR_BROWSER_REQUIREMENTS: "L'installazione non pu. proseguire poich. il browser non soddisfa i requisiti minimi di sistema. Aggiorna il browser e riprova.",.. ERROR_VE

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-ja-JP.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3042
Entropy (8bit):	5.662814560469893
Encrypted:	false
SSDEEP:
MD5:	12CB76F3C6DA72199F124488CEB0C739
SHA1:	BCDC554FE579D2CE9B887D28F8CBD70D12AF1110
SHA-256:	DBF88A45B56D90B823AE70F42AB6C523B12AC98A85FDD7097FE7D45D1DC2F37A
SHA-512:	AD0067E9040F0E8D7DB7DCD77901F29866E49B07243F42961C96FCF173D7725663445F8E0C6DF298D4F2C8C0ACE00A0E56F8443D5B162C92CB222A7A5C1A7D00
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "......",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "......................",.. //{0} - Company name.. THANK_YOU: "{0} ...................",.. INSTALL: "......",.. CANCEL: ".....",.. RETRY: "...",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ...................................",.. PROGRESS_SUBTITLE: "..............",.. COMPLETE_TITLE: "....... ........... ...................",.. COMPLETE_SUBTITLE: "........",.. COMPLETE_LAUNCH: "........",.. ERROR_OS_REQUIREMENTS: "....................... ....................

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-ko-KR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2602
Entropy (8bit):	5.836230399985154
Encrypted:	false
SSDEEP:
MD5:	D23965E41B4539E4CC497222F6684919
SHA1:	3E44F89D44431C401194CE7177B318C75178AC2A
SHA-256:	DC67EFA7C9947B1D3E0420834F18C897AE03167CEB0C66C4EAF00DAC9372F0D1
SHA-512:	B37045ABF2E217F6B3F280A887C01FCDF5C87D41DF73FAAFF9B8C48C93A257EF6D291199C4E4E4C7F0D44CFE04B83D47F9432A651EA98C546F1A6F47AA61C23E
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "... ..",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "... ... .. .. ......",.. //{0} - Company name.. THANK_YOU: "{0} ... ... ... ......",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: ".. ..",.. //{0} - Product name.. PROGRESS_TITLE: "{0}. .. .... .. .. .. ... .......",.. PROGRESS_SUBTITLE: ".. ....",.. COMPLETE_TITLE: "....! .. ... .... .......",.. COMPLETE_SUBTITLE: "... ... .....",.. COMPLETE_LAUNCH: ". .... ..",.. ERROR_OS_REQUIREMENTS: "..... .. ... ... .... .... ... ... . ..... ..... ...... .. .......",.. ERROR_BROWSER_REQUIREMENTS: "..... .. ... ... .... ...

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-nb-NO.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2387
Entropy (8bit):	5.326526728309049
Encrypted:	false
SSDEEP:
MD5:	FE4AD063455C03EE27B5F750D61E95B9
SHA1:	7DEACAC98FD52F7502861449F357665F54579C5F
SHA-256:	FB963C4BB34D1A5EB6B9C7815653467905AC018B37A3D7A0A9C025340A1715E7
SHA-512:	F97A4ACD8AF732661E6E978A6E7FC8D6D8DBFFD09AF92F9C72198140CA62B32374BD8ECE49FDBBD10D32BB66366BD8A60226D5FC1E7883528B136C2A7B14136F
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Lisensavtale",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jeg har lest og godtar lisensavtalen",.. //{0} - Company name.. THANK_YOU: "Takk for at du har valgt {0}",.. INSTALL: "Installer",.. CANCEL: "Avbryt",.. RETRY: "Pr.v p. nytt",.. //{0} - Product name.. PROGRESS_TITLE: "{0} er din personlige sikkerhetsr.dgiver n.r du er p. Internett.",.. PROGRESS_SUBTITLE: "Installerer..",.. COMPLETE_TITLE: "Flott! Vi har installert din personlige Internett-r.dgiver.",.. COMPLETE_SUBTITLE: "Klar til . sette i gang",.. COMPLETE_LAUNCH: ".pne nettleseren min",.. ERROR_OS_REQUIREMENTS: "Installasjonen kan ikke fortsette fordi operativsystemet ikke oppfyller minimum systemkrav. Oppdater det og pr.v p. nytt.",.. ERROR_BROWSER_REQUIREMENTS: "Installasjonen kan ikke fortsette fordi nettleseren ikke oppfyller minimum systemkrav. Oppdater nettleseren og pr.v p. nytt.",.. ERROR_VERSION: "Det ser ut til at d

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-nl-NL.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	5.226284665023455
Encrypted:	false
SSDEEP:
MD5:	BF5949895F41B4F6D08E49698DC4E9D3
SHA1:	066B405A8A2868483F97113B0B60B1AC676E842F
SHA-256:	8C555EB343D4C728ACE8BCBEB5A352C07B3E00C83147D169EF6B9DFD9CD23040
SHA-512:	61C40CD80955E7CA5D103276F62B6ECBAC7C60A5078B7877D7D1033F12D55131AA9A257A829CAED139FECD01E2B01CB86075C5206790AC2C58CACD22F99E2864
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licentieovereenkomst",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ik heb de Licentieovereenkomst gelezen en ga ermee akkoord",.. //{0} - Company name.. THANK_YOU: "Hartelijk dank dat u hebt gekozen voor {0}",.. INSTALL: "Installeren",.. CANCEL: "Annuleren",.. RETRY: "Opnieuw proberen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} is uw persoonlijke veiligheidsadviseur waar u ook online gaat.",.. PROGRESS_SUBTITLE: "Installeren...",.. COMPLETE_TITLE: "Fantastisch! We hebben uw persoonlijke online adviseur ge.nstalleerd.",.. COMPLETE_SUBTITLE: "U bent klaar om te beginnen",.. COMPLETE_LAUNCH: "Open mijn browser",.. ERROR_OS_REQUIREMENTS: "Uw installatie kan niet worden voortgezet omdat uw besturingssysteem niet voldoet aan de minimale systeemvereisten. Werk het bij en probeer het opnieuw.",.. ERROR_BROWSER_REQUIREMENTS: "Uw installatie kan niet worden voortgezet omdat uw browser niet voldoet aan onze mi

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-pl-PL.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2589
Entropy (8bit):	5.548786014317691
Encrypted:	false
SSDEEP:
MD5:	6A16DAB3523E7AF305B26FBA217E860E
SHA1:	29517855BEB19D32519143173BB22D135F6B98FB
SHA-256:	30F0DBE88BE90649F4FAE6DCB106F4DE959C820F2DB1C5BE21AC35EABDA75175
SHA-512:	2199F9FC519A9F8DC6D721A2F40611750AF8360C9AD28C407234A07E208674F37F676D4741F2C1836D5CBEF7AD3D5BE11031B3BDE37B03DC0D0F6055DB8DD3E7
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Umowa licencyjna",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Potwierdzam znajomo.. warunk.w umowy licencyjnej i akceptuj. je.",.. //{0} - Company name.. THANK_YOU: "Dzi.kujemy za wybranie firmy {0}",.. INSTALL: "Zainstaluj",.. CANCEL: "Anuluj",.. RETRY: "Spr.buj ponownie",.. //{0} - Product name.. PROGRESS_TITLE: "Program {0} to Tw.j osobisty doradca bezpiecze.stwa online.",.. PROGRESS_SUBTITLE: "Instalowanie...",.. COMPLETE_TITLE: ".wietnie. Tw.j osobisty doradca bezpiecze.stwa online zosta. zainstalowany.",.. COMPLETE_SUBTITLE: "Gotowe",.. COMPLETE_LAUNCH: "Otw.rz przegl.dark.",.. ERROR_OS_REQUIREMENTS: "Nie mo.na kontynuowa. instalacji, poniewa. system operacyjny nie spe.nia minimalnych wymaga. systemowych. Zaktualizuj system i spr.buj ponownie.",.. ERROR_BROWSER_REQUIREMENTS: "Nie mo.na kontynuowa. instalacji, poniewa. przegl.darka nie spe.nia minimalnych wymaga. systemow

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-pt-BR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2414
Entropy (8bit):	5.2988087990745925
Encrypted:	false
SSDEEP:
MD5:	849C3799B0C8971570831E4F711B3346
SHA1:	CDBF413BCE5DAACBFE84E373A1540DC5B011A106
SHA-256:	87D05712716ECD8E6105FFE67D6F3CBAE37F587C20F5969BDC4CB272659A06A7
SHA-512:	29D895F2F8246E6EB6C843ABABF524182E880724E192CA10C24548ECB26429076D21F3C816C22480265F7792E9595C03E554AEE6F075AAF7E12AEA6DF73243F8
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Contrato de Licen.a",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Li e concordo com o Contrato de Licen.a",.. //{0} - Company name.. THANK_YOU: "Obrigado por escolher {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Tentar novamente",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . o seu assessor de seguran.a personalizado onde quer que voc. navegue.",.. PROGRESS_SUBTITLE: "Instalando...",.. COMPLETE_TITLE: "Excelente! O seu assessor online personalizado foi instalado.",.. COMPLETE_SUBTITLE: "Pronto para come.ar",.. COMPLETE_LAUNCH: "Abrir meu navegador",.. ERROR_OS_REQUIREMENTS: "A instala..o n.o pode continuar. Seu sistema operacional n.o atende aos requisitos m.nimos do sistema. Atualize-o e tente novamente.",.. ERROR_BROWSER_REQUIREMENTS: "A instala..o n.o pode continuar. Seu navegador n.o atende aos requisitos m.nimos do sistema. Atualize o navegador e tente novamente.",.

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-pt-PT.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	5.2886589358625
Encrypted:	false
SSDEEP:
MD5:	398278D642159E254CC2E2E93E1179A9
SHA1:	CA3D1F07A7BEA2F5543C06850D4D2BA8933DCF96
SHA-256:	F002B5EB3EF95D1885943AE117C0126B7C0A1AE8717FBC6CEC6E71738A6B11FB
SHA-512:	D51964FC93B16B112094E3C796096B821B5D5392D7E26BFD2527279290D1D84472AA32BB34533D14C5E89570BA257DFB82DB78C0170552A24C0222FB54D818B8
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Contrato de Licen.a",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Li e concordo com o Contrato de Licen.a",.. //{0} - Company name.. THANK_YOU: "Obrigado por escolher a {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Tentar Novamente",.. //{0} - Product name.. PROGRESS_TITLE: "O {0} . o seu assistente de seguran.a pessoal quando navega online.",.. PROGRESS_SUBTITLE: "A instalar...",.. COMPLETE_TITLE: ".timo! Instal.mos o seu assistente pessoal online.",.. COMPLETE_SUBTITLE: "Pronto a utilizar",.. COMPLETE_LAUNCH: "Abrir o meu browser",.. ERROR_OS_REQUIREMENTS: "N.o . poss.vel continuar a instala..o porque o seu sistema operativo n.o cumpre os requisitos m.nimos do sistema. Atualize-o e tente novamente.",.. ERROR_BROWSER_REQUIREMENTS: "N.o . poss.vel continuar a instala..o porque o seu browser n.o cumpre os nossos requisitos m.nimos do sistema. Atualize o seu browser e ten

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-ru-RU.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3518
Entropy (8bit):	4.982461398239248
Encrypted:	false
SSDEEP:
MD5:	0D30587749530D65A88D73D59CCD1E5A
SHA1:	9EE32D2B5EF0CEFE8D4FDB3EC212D8543BC3BE37
SHA-256:	4D49FCE39B3D237AD4C06CDDEEB3A18E1E24AEAD20F1B29E130D2C6A0F9E6664
SHA-512:	FD37F80A531EC3F24FD904EE1C95AFC2E6BC07D3FBC10C450AF5E768FCC61C2ED7EE9B6D13F8953A33BE2C88E841EB2389C7E8E741A198E4BC46F4E605B8CC86
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "............ ..........",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: ".... ......... . ....... ....... ............. ..........",.. //{0} - Company name.. THANK_YOU: ".......... ... .. ..... {0}",.. INSTALL: "..........",.. CANCEL: "......",.. RETRY: "......... .......",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . ... ...... ........ .. ........ ............ . ..........",.. PROGRESS_SUBTITLE: "............",.. COMPLETE_TITLE: ".......! ...... ........ .. ........ ............ ...........",.. COMPLETE_SUBTITLE: "... ......",.. COMPLETE_LAUNCH: "....... .......",.. ERROR_OS_REQUIREMENTS: "......... .......... ..........

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-sk-SK.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2503
Entropy (8bit):	5.602740783934961
Encrypted:	false
SSDEEP:
MD5:	C54E3998BC66508564C96E1293B8DF95
SHA1:	99EEF5395A784B94F8AF841165A5AC88AFC0F7B5
SHA-256:	3AD5819098C6B95BBA65144A4FFDE14FF3DB1BEE95934B7F56C51EDCEF1E0E81
SHA-512:	5888B2C5E34D39A9C876DB7F7C53B0059A5A9D9CD15F8F678601049940BFA0467B490A926812AC92EE28EA74425070D2A5A45A9C4472316FA334202FB3B7EC85
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licen.n. zmluva",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pre..tal(-a) som si licen.n. zmluvu a s.hlas.m s .ou",.. //{0} - Company name.. THANK_YOU: ".akujeme, .e ste si zvolili {0}",.. INSTALL: "In.talova.",.. CANCEL: "Zru.i.",.. RETRY: "Sk.si. znova",.. //{0} - Product name.. PROGRESS_TITLE: "{0} je v.. osobn. bezpe.nostn. poradca pri va.ich potulk.ch internetom.",.. PROGRESS_SUBTITLE: "In.taluje sa...",.. COMPLETE_TITLE: "Skvel.! Osobn. poradca online je nain.talovan..",.. COMPLETE_SUBTITLE: "Hotovo",.. COMPLETE_LAUNCH: "Otvori. prehliada.",.. ERROR_OS_REQUIREMENTS: "V in.tal.cii nie je mo.n. pokra.ova., preto.e opera.n. syst.m nesp..a minim.lne syst.mov. po.iadavky. Aktualizujte ho a sk.ste to znova.",.. ERROR_BROWSER_REQUIREMENTS: "V in.tal.cii nie je mo.n. pokra.ova., preto.e prehliada. nesp..a minim.lne syst.mov. po.iadavky. Aktuali

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-sr-Latn-CS.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2366
Entropy (8bit):	5.3706965599670475
Encrypted:	false
SSDEEP:
MD5:	9A4E59CB63A401DD5E47D83064EC040C
SHA1:	5668CFE91E01BE9871C15E878D6F09338FFAADC5
SHA-256:	C0CCAA5684770250AB97DACFE88BF4C5FCBAFDCCBB8444208B3C659B10C09A51
SHA-512:	D49CF85D1CEB390C6BF955FD81371EBC95A642F2119A25F6A70B8B543BEBE01C30E3A46823926617041AD34C8191385B5583BC9AAB2D64BCB5915F2166B40768
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Ugovor o licenciranju",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pro.itao/la sam i saglasan/na sam sa ugovorom o licenciranju",.. //{0} - Company name.. THANK_YOU: "Hvala vam .to ste odabrali {0}",.. INSTALL: "Instaliraj",.. CANCEL: "Otka.i",.. RETRY: "Poku.ajte ponovo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} je va. li.ni savetnik kada god ste na mre.i.",.. PROGRESS_SUBTITLE: "Instaliranje...",.. COMPLETE_TITLE: "Odli.no! Instalirali smo va. li.ni savetnik na mre.i.",.. COMPLETE_SUBTITLE: "Spremno je",.. COMPLETE_LAUNCH: "Otvori pregleda.",.. ERROR_OS_REQUIREMENTS: "Instalacija ne mo.e da se nastavi zato .to sistem ne ispunjava minimalne zahteve. A.urirajte i poku.ajte ponovo.",.. ERROR_BROWSER_REQUIREMENTS: "Instalacija ne mo.e da se nastavi zato .to pregleda. ne ispunjava minimalne zahteve sistema. A.urirajte pregleda. i poku.ajte ponovo.",.. ERROR_VERSION: "Ve. imat

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-sv-SE.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2265
Entropy (8bit):	5.377389451873531
Encrypted:	false
SSDEEP:
MD5:	3D0EF828C3BD895D981998C4E58C7B95
SHA1:	AF4217D3F6A58EF0E813860AF905DF4F7A4DE35D
SHA-256:	266FB97C87C109B9FB7FF8099DBA0BBE00C52F7E4106D0138E6922FED4F01EDF
SHA-512:	9B847A3F5385601767090338CC50F8960FABA50DDAF66A71ACE6C3E9B057FDA6C5C8C55323198BA91421C902D6BD7BD496A231B4556A9533B1FD00A5697D2329
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licensavtal",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jag har l.st och godk.nner licensavtalet",.. //{0} - Company name.. THANK_YOU: "Tack f.r att du valde {0}",.. INSTALL: "Installera",.. CANCEL: "Avbryt",.. RETRY: "F.rs.k igen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} .r din personliga s.kerhetsr.dgivare online.",.. PROGRESS_SUBTITLE: "Installerar...",.. COMPLETE_TITLE: "Perfekt. Vi har installerat din personliga r.dgivare online.",.. COMPLETE_SUBTITLE: "Klar att anv.nda",.. COMPLETE_LAUNCH: ".ppna min webbl.sare",.. ERROR_OS_REQUIREMENTS: "Installationen avbr.ts eftersom ditt operativsystem inte uppfyller systemkraven. Uppdatera och f.rs.k igen.",.. ERROR_BROWSER_REQUIREMENTS: "Installationen avbr.ts eftersom din webbl.sare inte uppfyller systemkraven. Uppdatera webbl.saren och f.rs.k igen.",.. ERROR_VERSION: "En nyare version av programvaran .r redan installerad p.

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-tr-TR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2564
Entropy (8bit):	5.498731406448142
Encrypted:	false
SSDEEP:
MD5:	026E4B5E29E4BBB3159ABEAF2B8E4F45
SHA1:	7FB235431596C61420DFAE2415BD87DA22A096C9
SHA-256:	47FB7C0C921E2948CA58775F9FA12177A33B9C8CBF4531369CABFBA73382983D
SHA-512:	E55D2815279E0CB933525FAC56261CC8F07089D3FD49A797EDF4A51F2A31BBB29CAAFFB7D9B1DF95CAC2E7A3F255B75F4D98D314DE9F755422203442B008337F
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Lisans S.zle.mesi",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Lisans S.zle.mesi'ni okudum ve kabul ediyorum",.. //{0} - Company name.. THANK_YOU: "{0}'yi se.ti.iniz i.in te.ekk.rler",.. INSTALL: "Y.kle",.. CANCEL: ".ptal",.. RETRY: "Yeniden Dene",.. //{0} - Product name.. PROGRESS_TITLE: "{0} Internet'te her an yan.n.zda olan ki.isel g.venlik dan..man.n.zd.r.",.. PROGRESS_SUBTITLE: "Y.kleniyor...",.. COMPLETE_TITLE: "Harika! Ki.isel .evrimi.i dan..man.n.z. y.kledik.",.. COMPLETE_SUBTITLE: "Kullan.ma haz.r",.. COMPLETE_LAUNCH: "Taray.c.m. a.",.. ERROR_OS_REQUIREMENTS: "..letim sisteminiz minimum sistem gereksinimlerini kar..lamad...ndan y.kleme i.lemine devam edilemiyor. L.tfen g.ncelleyin ve tekrar deneyin.",.. ERROR_BROWSER_REQUIREMENTS: "Taray.c.n.z minimum sistem gereksinimlerimizi kar..lamad...ndan y.kleme i.lemine devam edilemiyor. L.tfen t

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-zh-CN.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	6.285030103087084
Encrypted:	false
SSDEEP:
MD5:	0B59E12E50A67AD6F2DDD0E3F66AFECA
SHA1:	D8FEBC294B43FB2D8E64342BD4237B77D7CCD2C6
SHA-256:	ADEF8EB008A44767EFFAC76D89EB8E25F2A5FDBE89D015489377AE4170BFD893
SHA-512:	A9C34AE2CBD7B6AD7FE5EFCAFBF9BB7D94D524C402635DFE4D2FA94D0591371927B7F6A719C75C56D90202FD5992CE8D7932B0AFD0E575A235EF0D6A09A74EE3
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "....",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "...........",.. //{0} - Company name.. THANK_YOU: ".....{0}",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: "..",.. //{0} - Product name.. PROGRESS_TITLE: "{0}.................",.. PROGRESS_SUBTITLE: ".......",.. COMPLETE_TITLE: "...! ............",.. COMPLETE_SUBTITLE: "....",.. COMPLETE_LAUNCH: ".......",.. ERROR_OS_REQUIREMENTS: "....................... .........",.. ERROR_BROWSER_REQUIREMENTS: "...................... ..........",.. ERROR_VERSION: "...................",.. ERROR_FAIL: ".......... ....",.. ERROR_DU

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-install-zh-TW.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2196
Entropy (8bit):	6.289430294079431
Encrypted:	false
SSDEEP:
MD5:	C900225095802764F8679D8A02F02AB5
SHA1:	4D9C399F5EB401D47C09690F9249FDFD51F61411
SHA-256:	08ED61685723AF77BED3313C0AB99630DAE45433A56299A616C964FE6962CF7E
SHA-512:	44D0B72C7E0CCC89F482CDC5899D08F5243C0A701189A149C660F5013CC3B028835819350CA40784DD07D0DA62D53343D2B5868A4D91048F12051561A627A619
Malicious:	false
Reputation:	low
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "....",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "............",.. //{0} - Company name.. THANK_YOU: "..... {0}",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: "....",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ...................",.. PROGRESS_SUBTITLE: ".......",.. COMPLETE_TITLE: ".... ..............",.. COMPLETE_SUBTITLE: ".......",.. COMPLETE_LAUNCH: ".....",.. ERROR_OS_REQUIREMENTS: "......................... ...........",.. ERROR_BROWSER_REQUIREMENTS: "........................ ................",.. ERROR_VERSION: ".................",.. ERROR_FAIL: ".

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-cs-CZ.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	716
Entropy (8bit):	5.607011971536562
Encrypted:	false
SSDEEP:
MD5:	DB5296C11A4E1E23249BFBA40CE350D8
SHA1:	85C35D7E41A25D99378F2814874547D87010913F
SHA-256:	957F3FFE17A9069F4750CD36096BD997349B53A1952A67D5C1F9FD6B5851EEF2
SHA-512:	2D143620D9B37B28EE8F16FEBA6F422C3B4765D7D22976C941609BA283AD6636B4306C7D0E32ADF7595B7B01E0CE86F29FDF452EA6739483ACE1EF206809D77F
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verze",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Prohl..en. o ochran. osobn.ch .daj.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//81042082CF7CB241A3443F862EE0EECFC8376F5C371C52B28F8DEA321E42D8840BC343D8FABC64A697B28E43C4C1C1BFA5EC01A85A0790B68226181A356241BD++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-da-DK.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	728
Entropy (8bit):	5.532507354590994
Encrypted:	false
SSDEEP:
MD5:	7B935965B36524190BD312B61B43A078
SHA1:	52C05B0B95461D1B80543AA032422F91BA6BC72B
SHA-256:	3C137CDC865081F47A2F8062CE7B9A3F951F992F236B974582589CD8014A8AAF
SHA-512:	2EB7186ACFC3570FA08F39225B4198616547627CFFDAB9D47A58A25FF9FEFD8EC68AEE886622983E404E87C918024888DC39FF1C94B0BA7499ADFF08864C356D
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Meddelelse om beskyttelse af personlige oplysninger",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "F.rdig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//3E820E543090689D74FF63DE8AEDAAE21AE9AB8C7D697AED71A8150A8BAE9004FC3F4C908202E74DEBAF28611421437720982EFDCC7CB2A2BA103910200151AA++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-de-DE.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	695
Entropy (8bit):	5.523104478615486
Encrypted:	false
SSDEEP:
MD5:	40ACF45F141BA18E03507C2082902777
SHA1:	DAB8213D3E5FFF5838D1CB873E65784B635DE966
SHA-256:	CD252FEECF3EE19E9C849783C416E9B782BFD3D681C658FB1464DABFCB839019
SHA-512:	189881E6F381CA9F6392C7B9DBD302C119158997C1B6D9E23E9D2EB375FA54FD453DE6515E073A59F6AFC14132571B4C3ECE176DA75B9244A1CD5224D6348A99
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Datenschutzhinweise",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Fertig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//49321CFEBE589D1646EB716015DFBDDDBC5CB3611EF0CC5F0E546054368EF7FFF2A13B5AF228BB9481A39AE66C23F091EECA5628AEFC29837E2DAA08BDF0F01A++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-el-GR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	750
Entropy (8bit):	5.752183544639771
Encrypted:	false
SSDEEP:
MD5:	25AC661CB1DA437FE20306E83B1F0752
SHA1:	44E4613D0C73D7A51F4C649022AD3117E4ABFD7A
SHA-256:	262AC8842829AFEEACDF6F83AF411381669D507CD3D60A51BA200C9F13385F28
SHA-512:	B8B8C5DA963A5EE2A0357C45B70A8DE1465135A8764BF8251CEA65A8F56568796C663116F2EF58B91192F538D17937CFB9A83C580247CC74E172B94A35EECB9B
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "...... ............ .... .........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: ".....",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//7AA3959D20712220C1EE8D6030BFEABD0FE618A56739AEB295AA1FDD7536506322ED0BDF68CE43EF03EB8900FAD16939DE7E65016BB3BC3B1C54618D07E1FC9D++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-en-US.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	688
Entropy (8bit):	5.5142215205780944
Encrypted:	false
SSDEEP:
MD5:	5B28705E4840EF14D1893BE363B803BD
SHA1:	10BF34AF49949E96B94A2A0E013BB156683B4D3E
SHA-256:	4E0D93048BB7F2995CCB68C151BDBD5D8589948F81DE2280502831DE03DCE62D
SHA-512:	FE75224A87BE247C7114BB049ED25F55F427F1CDBDBBD685366F036E8891B270214F77958A6D8A905B66DEC529129C644321E5125A1C5317099DA2C780A8A4B2
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacy Notice",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Done",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//4880C596D977ADDC5F6D3DE47F016E24850A8A25B6B56EC102FB57BE17EF30F108D9A49AE7BFD248E08C2CE6AE5D4B173F602DEC34B0926DFA5EB9F879CC09F1++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-es-ES.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.532615699841096
Encrypted:	false
SSDEEP:
MD5:	8E6F1DCBF2BBDD4812FA4F2DAB9C43A8
SHA1:	180B797F99229214046DCB1C5BC9F2D646A75E13
SHA-256:	D2BE5B199291B5BAB255A83AE6B0AA82D0EFE0E0DECF8937DB521C6708DCB980
SHA-512:	5C4373EAD81032E51B69798A250890B9A2FBC9A63D26749A72CEB93B7F43682BF883BC1C10F273C92DA13996DD466130AD28803E42A78DD5BE0FD3B3B05FCBA8
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//7AA804C15F6975C084E7F423A39B1C4D1E061F52EE01933A21C16015FB0611C02DE575E939968EAE27B083C0DD9A5D7D263C3CC462F91B26A3EF4321880F1C8F++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-es-MX.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.522511534706463
Encrypted:	false
SSDEEP:
MD5:	98EFE7D3B444951AFDCB0ACBB730C25E
SHA1:	EC3799399BA47D27AEAC09EB21B7E18714E1B2E7
SHA-256:	10252291B3535DBCB63E84374010830ED20530C03A4E25B2A499120FB356FAAF
SHA-512:	89CC94F506B6F0DCE08A037EC0ACA6821A2DBF258A2043AFA4D2884B14A21540F0467CA01E0B7909D38FE16997A034E50CCC04D9BA8BECDE2616143448128D69
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//D230E1F1A500DB032A710473C3AECDA773F053E1419B3DA43B5CF22F51D59DF2B34B096545A072A09360F6AE735D8607C07EBE0C97AA8BF78D6E1D3083E3556B++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-fi-FI.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	692
Entropy (8bit):	5.533689253513386
Encrypted:	false
SSDEEP:
MD5:	D0C17F7AE5C3DA9BE7BC96245E9D0F5E
SHA1:	9BF2CDBA16C3CCCCD7A2E069086342333B573D0D
SHA-256:	DCD5D47D3477438074B190ED1E00A72ACF74401354646F02CF00A1A77205D317
SHA-512:	48C3C0647EABF13366E919EFB7E7A24B520917098852C49DEEA36CF430A8879C2225A2997C4F8B75A1F86CE3E5C0BEC68E714BD6D1DF2B6FA8B767FD16820DEE
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versio",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Tietosuojaseloste",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Valmis",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//BC956D6A6A53E1F7AAD19F3D631FEF940A670FD790C7DEB3A241CABBBF67E2083B495DBB95B04F2262B036B552D8A56A0044921BF062E1DD666173CB9843DB94++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-fr-CA.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	710
Entropy (8bit):	5.55151240094457
Encrypted:	false
SSDEEP:
MD5:	BC4A141B5CBC453B3F05FE63DF0BA5B3
SHA1:	0855321761C9A7035A8798FC211F597B2BCD24CC
SHA-256:	6C373DF185597E9B942D5738D1077919AF981DBEAE5A2DB69F7D06BB58137EC1
SHA-512:	85AF7B1CDD91DA5F1BBAD996866C42B6EFB2D8A35A52799F85C025361C211AA2BC40B1869CEE7A50EC9A24FC3B8862A58A290258D741018AB6E5B350541CE0B8
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//0F0F9CFDACF5B41C6C177531339BE320FAFEF6A800775EC347D5D488EFA8F8317B5DE20B713422F1FBFDC13EC57F67B1CC08B1A30C59525F06DEC2E0D56A5668++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-fr-FR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	710
Entropy (8bit):	5.530208948535214
Encrypted:	false
SSDEEP:
MD5:	C44E59985A55311E7F6BAA87EF993B98
SHA1:	12134E8C69120B2FBC8AF82E1BE8183DB5BB898E
SHA-256:	32E9956A1AB7DFDC54EB77B1FFFCDADD2DFEC0CA5B4D38F2A5B950A79F5D062D
SHA-512:	2ADCC224B551C403FF00FC21311FF9D842027FB2BEDE9F64B66F08A128D561517721CE3C72BC5B8F38D70E7FF526C911BB99BEC23021DC5589B80BF7DF2203B2
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//998ED52278AF698342457AFEF2ABFC43EB8E1CA85C5511CF6E5DEEC26B18184BDA7A567652CA7982A1162D16F248961F2D98D598A2792DAA948A5069C85CE9A3++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-hr-HR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	703
Entropy (8bit):	5.518105253351284
Encrypted:	false
SSDEEP:
MD5:	DC378106F4DEAEC0CABD0F5E88A515AC
SHA1:	F67E647DD898830A46A8B6480D8806E2A73917BF
SHA-256:	CCE7D0C8F783F6D14436AEFC89B8879A4700AE8BC1DC5912D0B9C2EBF365A0A3
SHA-512:	39DD91FE9AFBCC7D4D31134315360D595A83A845799C256147A71B94A08696FDAF383867CD51961950821D75CCD4748EFD0D844AC6F9568038AC8649D235C4C1
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obavijest o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//A493FBFB5AE3EC66777ECF1DB2BA30F9F1F4A6E6DFCBAC4EDA0DA7443D2DC28F3CCF659841F3F6446712C6D8D47AC143ED02C8A4EAC11C700573E2C920ABF9C2++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-hu-HU.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.599467220659489
Encrypted:	false
SSDEEP:
MD5:	04D4B5B205C463AD95BD36318E6714AE
SHA1:	8F2D5223224D0DB4445D37B29F624DB2C56BA0E8
SHA-256:	6C47EA4147DB11C121F90CB9456CCB273AB45B7D3BF291F795DE4D99CA8DA668
SHA-512:	DEF6234A83BC211AE3CA539A282400869A8FFF95ABCDB90C2F31436D0A27EA2BBA26A0094089196C8F1C173E52FA6A1AD1C50E369148DE4908C07BF4433AB738
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzi.",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Adatv.delmi k.zlem.ny",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "K.sz",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//CD9F5CF6CBBBA54C3F23A659D3912D647862A87F5273FB0E2DBFF22941D2BE434F1A6538BE7A4CD09D28EF385A95B92D9C48A687DBE1B013FBAA731521673633++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-it-IT.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	697
Entropy (8bit):	5.539019069592982
Encrypted:	false
SSDEEP:
MD5:	66DA2DC63D6A3925D48F40AEB602D502
SHA1:	A53F5FA1B97FC7CAFFAEDFF3E3FD7B8C0725D2A7
SHA-256:	1638AB11E485CA57AEC94F987B5B0CA7B9D0B8B09CD7B80A36FD3DCF0BC3F55A
SHA-512:	13766D0071C8B96FA222645026C7BBDF78D1C629C0C5A7FE7796A3F05384C652B36602D792A8C9106E90C1B0623DC11AEB7BFBE4DDBBDDBB1BFC7AB409B474CB
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versione",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Notifica sulla privacy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fine",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//01F59DD33A54B1B634D2DAD086EB337D2F51F8692DD0CF7F590351097B7C81BBFA9106E0E29D53425605E0B0A607D8C11B05FFF8CABBAA10DA77B6B84C1D138E++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-ja-JP.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	808
Entropy (8bit):	5.738433406660423
Encrypted:	false
SSDEEP:
MD5:	AE48A5FF7596694A4FD1AB26F50B00E3
SHA1:	702780AC40822B2ADD3139E0B7B123834CA4B487
SHA-256:	6DF0DEA4086371AD6A3F1DAFA584FD2531F0229DFC518396AA3434F3DFEFF7A6
SHA-512:	DC188AD001508C0BAD665E7AD9886551283E5B16BC590FCD5B14373401ADB137119C93FFA68C69B939E1989D6861449A4C200D7BDACDD97BAD82190B51BC272D
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "..... .........",.. PRODUCT_NAME_LIVE: "..... ......... ...",.. PRODUCT_NAME_TRADEMARKED: "...... .........",.. VERSION: ".....",.. WEBADVISOR: ".........",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//1C4184071F95F14CF00EEBD3AB4A7D7995B06EC7F97188DFFC294ECA8E75AF545331449C57697749715F92FE166E2E4AE3D22882960F462CE6F6996A1E75D592++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-ko-KR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	742
Entropy (8bit):	5.822041209914263
Encrypted:	false
SSDEEP:
MD5:	DC7B76F9DE7F35276C2143C5EB102EBF
SHA1:	8D2AB5544CCB298761AD43B3644041023B758BDD
SHA-256:	B7AF107F96B56FC6FCBC642A0A6F94F0ACF0352A2FC8D6A30B0DC4F7A78F3576
SHA-512:	B231589775366E1B6B4D12497F321E9A93D2C8DF0C5CC1BBCBA1012CE8BD4429FEFA91BE68EEC9C797649FA2A14FA7DA8342F23023EA4B17C6F6F1B194EF7BFC
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee ......",.. PRODUCT_NAME_LIVE: "McAfee ...... ...",.. PRODUCT_NAME_TRADEMARKED: "McAfee. ......",.. VERSION: "..",.. WEBADVISOR: "......",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".. .. ....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//AAFA73BEEF104F5ADBF69569B45268191B8C4082876E870E1484D98FA17AC8F7275EE9083D7D9FBE552E3144770D5820AE3AA2B0FCC2E732A3BA80B338CE1904++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-nb-NO.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	696
Entropy (8bit):	5.563291933943177
Encrypted:	false
SSDEEP:
MD5:	DD4688CB4523EE561CA94C2DA49E335A
SHA1:	8047EC0B501FA264F945957C0E362310B1CE66E7
SHA-256:	3F1E1DD5CE540E4DC4C06313851F35FFD1D7DFB27961059FD32947F2D8661F05
SHA-512:	9FF8C8392F336D7291574542505A8175693CA1534D4BA26977F1817E261727FF5CBBC31788A23735E7617950F06DBA20EAEACA563399A492EA155E48B60CD191
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versjon",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Personvernmerknad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fullf.rt",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//9E9A1473D0E14AFD79647DE49EBDB6500B342965F5C3E5F660CA5BE56755AB544CE8034283771B76E169B8FCC0E95742C6CAD1E238FC2211EB505CF6BC884601++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-nl-NL.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	746
Entropy (8bit):	5.6087546952598295
Encrypted:	false
SSDEEP:
MD5:	12B1FCF468BEEA23810C5E29E00955A3
SHA1:	1C5829EDEBAB9768FA20308DE723FB452A09BD2D
SHA-256:	F214DF27C228AF7545300A18535433501C730B035A46E5F9C5B6D8EA134ED3E1
SHA-512:	8309B74B03D8D2E5F55ABA411DA06B604B74586438CF13CEF59A92E07C0EC9D5B389420B73CB98558ACD0B3266311E861CFAE71D63ADAEE639A128872461BEFF
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versie",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacyverklaring",.. PRIVACY_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Gereed",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//CB6340B4EFECAB3E71CB08FD5C0F4C5285E77639F0E2D8361F3498F4A47F78E2FAAB43BD5148673AB645AC0AC3E22C9D3110834DD0FE917B44E73BE905B94BD7++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-pl-PL.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	709
Entropy (8bit):	5.547492619756502
Encrypted:	false
SSDEEP:
MD5:	8826C3D661F02DF18E529EE006C0074E
SHA1:	3B34EB20315AC50282146A4204D3EBB1BAB9E5A2
SHA-256:	AADC501672DFC69A1443DB6DF6E7E265105AD0D35E2970A0BE0B581934EBFBA8
SHA-512:	8299A48AA7B13FB6CC757FE0D01FC33073218FCE89E0AEE014A5550FA8EB0DA43295E9B81113E523CBAB26531CDEE98EC65D7D3E3FE9742A640651381E2D934D
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Wersja",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Informacje o ochronie prywatno.ci",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Gotowe",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//17FDDA361C160E1D310873ACC18B2A0ADD5102010B762EB776BD100F17C46301160D84E653EC76428F9ED2C2B81B441B716B90800DF6CCCA3ACA5D867D193D60++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-pt-BR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.538511894040431
Encrypted:	false
SSDEEP:
MD5:	FDE3D3EA8FE84835283B9B56430EC29E
SHA1:	1264DCF81224D50E00668F2AB05954205445704F
SHA-256:	F320951C0B9E57DDF7A910E0B94F4125B15320C8656CAE832DA0D1DAC46604E3
SHA-512:	1DEE807E2BEBFDCB144421FD9CE53EF5CC26352CDC29E784498727C6966F92CDBFAFEE0E9584F25361ABA2726AB656FEAB3FC8D7A65348AA939D1BC1A398E0BD
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//B6B6A9911A08317B36CCB25A27F2A509E5FE6E73002120AD1BED572BE9D87A7CFDBA2607ECB9E5023860C494E0F4F0708E84CEEF8BFDA4F07F53491FD9BFBEBF++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-pt-PT.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.537523162423459
Encrypted:	false
SSDEEP:
MD5:	14C56FFA20920CCDE1B19B733CB85FAB
SHA1:	474AC88709CE4B55BB54137F467949B09CD147EB
SHA-256:	9E00583D89A3A1C5717D2D1659E4AB128F86AD0801B2B3BA5F85F3CF7BF170C2
SHA-512:	EEF3A6C625083AFE5261ED7659B63E59D793228B7A07F791833EFCAD699F239D0C3B60BEAB2C65F194AEBF4019B16086E6D81D429DF42A96294FA15ADB83E0AB
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de Privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//D630EF6834C2DF4F454AAD8AC93FCDBEA26EF7FBE1396FC5E95D2ED564E46E5A122BBC1943EB4F39BC54CD5FCC0768C696B62861C1259FF82F57120574CAC80A++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-ru-RU.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	751
Entropy (8bit):	5.762905150784842
Encrypted:	false
SSDEEP:
MD5:	D37EE749862FB89C64AC60108D7DFBF9
SHA1:	20647A50F8807D09819EEF6C2CD29230882373B1
SHA-256:	9F3AA8EBCDD309AFDDAE08C5331CFF223DCCDB026BBB20618A09AB84C26789C8
SHA-512:	F0FA804CC1DDAC94CD15B5414A12B89F97E6997B02E14337C0DEA619F5D83AAE3F78456DCAECC896E79B8DAB1074F8EDC9CC3041AC863DC55658F65B753EDFDE
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........... . ..................",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "......",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//1BBCF622DFC15CFEB9A52B5F5D981C8B8413EDAEA7B714254A99AFC82C962439630225D096E319595DC777402B74CF57B39402B61FB4A77DAF7FA0278366CFF5++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-sk-SK.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	719
Entropy (8bit):	5.608359372203038
Encrypted:	false
SSDEEP:
MD5:	039A4B97702E56DDDD98E64526364190
SHA1:	39FE5D4FAA2B83D9F7930D5EF64711BCAD9E4830
SHA-256:	FB4283F741112BFA20A09C4693585AEF9521D2A7D70D66440030D957DF819DAC
SHA-512:	C8403E82680B6FE1E2FF9FA14969ACD4C33AE3CBF2D6C1291AAD10A10B63B4F35D6BA7F7D7614DF1C481E300564EF39FAA39D9D079DF4F6FFB9F6A99304A609F
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzia",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Vyhl.senie o pou..van. osobn.ch .dajov",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//E574C8953368BE6E9E4E2131834E332BB1EF2B469C106EA92F119638AB8BD08E79E61753671722021A4AA0BDCFA111B5319B3EAEA44DBCEA84E4DDFB9109EDB0++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-sr-Latn-CS.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	706
Entropy (8bit):	5.563197455028977
Encrypted:	false
SSDEEP:
MD5:	0B067B696A6F2B7FDAFC6E733872401A
SHA1:	E804B3A048F3381C3E8DBDDD2DD51F0C11156971
SHA-256:	B42F2EC3B128DEA5FB95E19BF3C9B0794D7DF0E9A9CEA51199C3D69C252AF9BC
SHA-512:	204EE91380D9F87C8895EF29EDDD3FF2A1E4E79B423DE38DBCD6CFE79ECAF22E30CC4A79D1B756C9D9658D7347C088D89B4185D1ACAF347F91AF08391E1AA61B
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obave.tenje o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//81CD68B5ABFBD1D2EFFC9A3778314BDBB771A2770E9125B7369851DF9C36434CEF054A284B0CED6E3AEF5F9E4D745F2507A51DE8375215334BA83E007F2E1661++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-sv-SE.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	690
Entropy (8bit):	5.533144558424333
Encrypted:	false
SSDEEP:
MD5:	49BD8D622ABF07A89C6450F6760A934A
SHA1:	FC7C55ED457358DB7A0A34042F3E17AB21A000D0
SHA-256:	5491BC1348519AB1130D9E1859272FA7336B6386E6F002E92C725007E1BFC8CB
SHA-512:	BE3210541077EEBC083B43E330AC32C2ACD6092D658D9E725B2D1467D6A7FC5B7769506007E110DA390BFAD12C3FED038601E34E1405949AB233D42A5D51D0C3
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Sekretesspolicy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Klart",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//99592B3FDCD482063EFDD4D0D71A45608159E4B410EE9DA426896483C35C9A1576F22AF8CC2225CAB446BF6640B248A7E04B2250D9880E21EC2D34AFBA6F0592++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-tr-TR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	696
Entropy (8bit):	5.546230689160202
Encrypted:	false
SSDEEP:
MD5:	0A399950FB2D1D80725F3CEA6BE75322
SHA1:	F78707F7288CC04320CBD855830F7D0D5C5862D5
SHA-256:	11BCB1325493DD7886DB10309A616EA8ADF395D470759ECE01540DA39CC02B31
SHA-512:	3978A9F55ED7075C3642C385818C0A099FA914BDFE67CBB36AF94773BE4447D6BC838DD605D7FAFD2DA0915403BC2435B664F5AA8E88C14928B13604CB2C7EEB
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "S.r.m",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Gizlilik Bildirimi",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Tamam",.. DONE: "Bitti",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//459C6B15A94C2BDDB33AC8749C4799657210EC421A307BD0DFEA6943FFE5A4E0E3F6D7E94E3FC34F7581AE498B26A46ADAC1C962E3C5AF1E01563551E7C83D3B++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-zh-CN.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	713
Entropy (8bit):	5.911021719409146
Encrypted:	false
SSDEEP:
MD5:	61254A9C6CE57B8FB6DAF5C47840C53F
SHA1:	D9B109B65B5B725D90E4366FCDEE509012FB0751
SHA-256:	BD6876CAE0889DB066FB4F8F7FA38ED517023806C7D41341C7522DBC0E412FC6
SHA-512:	31A0C944BB7EB098AAFE2FB280D21248834F3AFB7CE21D818C8CED3CFD95D0EC8F61F6023BD8EDC3178AC39AE7A9059EFBA35A474E18BC8C697DB9546B6CA9E8
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: ".......",.. PRODUCT_NAME_LIVE: "..........",.. PRODUCT_NAME_TRADEMARKED: ".... ....",.. VERSION: "..",.. WEBADVISOR: "....",.. COMPANY_NAME: "...",.. PRIVACY_NOTICE: "....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//C49666C6D17B3380489032D792278402A58C50CA24B473ED94B458FE49F52BF29B7E9CBB0FC9915FCDFCE0CCE37FB45A71D3DB9EF0EF754DDD0177BFEFDAA76F++

C:\Program Files\McAfee\Temp2863637682\jslang\wa-res-shared-zh-TW.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	modified
Size (bytes):	694
Entropy (8bit):	5.692484981098063
Encrypted:	false
SSDEEP:
MD5:	A62FE1D5E76F93DE63A6CE0848412310
SHA1:	951E5AF2615D9D352124599DD8B1E0A5796479B3
SHA-256:	FAD192A1E13114CFC65AA7EBDA0589240B08C8516ADAE145F2CF7309B5156CD3
SHA-512:	FB1D86DE2F4975AB293B10062854A3D7944664109EFF5679011D4E22AEF3FAF8C6A611BCBE67BEEC343DF89B0C7DD8C062349CB223302791F595585C97657BB5
Malicious:	false
Reputation:	low
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "..",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//DA60579E457B68E8BEED2C221EB14808A61CCB56CE7A89168B68C6933874687459C88D14DCF7061DF466EE138F540489BDA6C24DB96B3C8D0E348B97E735E643++

C:\Program Files\McAfee\Temp2863637682\l10n.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 259404 bytes, 513 files, at 0x44 +A "\l10n.manifest" +A "\jslang\new-tab-res-toast-cs-CZ.js", flags 0x4, number 1, extra bytes 20 in head, 39 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	281404
Entropy (8bit):	7.9353344781841635
Encrypted:	false
SSDEEP:
MD5:	3D2DA95E75C0FA4FFF38C977227891B1
SHA1:	246CB3E6BD274AC51AB45A512BF7B02B7E993681
SHA-256:	2EDE69815E66AE0D47F6121CB92C74DBAAF68D9E09AEE7F0F1675CA6CC0EB249
SHA-512:	400929026E74C78D1E86C767445637FE6C7196DA3C9DA54A055010705D12503010201717739A302256B3E2F427EE0DEEFA8703F7055E8CAAD4EBB8D0ABECABEE
Malicious:	false
Reputation:	low
Preview:	MSCF....L.......D...........................L....U...........i..'.............SW._ .\l10n.manifest.#.........SW.^ .\jslang\new-tab-res-toast-cs-CZ.js.#.........SW.^ .\jslang\new-tab-res-toast-da-DK.js.#.........SW.^ .\jslang\new-tab-res-toast-de-DE.js.#.........SW.^ .\jslang\new-tab-res-toast-el-GR.js.#...!.....SW.^ .\jslang\new-tab-res-toast-en-US.js.#...D.....SW.^ .\jslang\new-tab-res-toast-es-ES.js.#...g.....SW.^ .\jslang\new-tab-res-toast-es-MX.js.#.........SW.^ .\jslang\new-tab-res-toast-fi-FI.js.#.........SW.^ .\jslang\new-tab-res-toast-fr-CA.js.#.........SW.^ .\jslang\new-tab-res-toast-fr-FR.js.#...."....SW.^ .\jslang\new-tab-res-toast-hr-HR.js.#....&....SW.^ .\jslang\new-tab-res-toast-hu-HU.js.#...9)....SW.^ .\jslang\new-tab-res-toast-it-IT.js.#...\,....SW.^ .\jslang\new-tab-res-toast-ja-JP.js.#..../....SW.^ .\jslang\new-tab-res-toast-ko-KR.js.#....2....SW.^ .\jslang\new-tab-res-toast-nb-NO.js.#....5....SW.^ .\jslang\new-tab-res-toast-nl-NL.js.#....8....SW.^ .\jslang\new-tab-re

C:\Program Files\McAfee\Temp2863637682\logicmodule.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1558063 bytes, 2 files, at 0x44 +A "\logicmodule.dll" +A "\logicmodule.manifest", flags 0x4, number 1, extra bytes 20 in head, 138 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1580063
Entropy (8bit):	7.999600937770339
Encrypted:	true
SSDEEP:
MD5:	4AF485B15421E8B721457AB0286220C4
SHA1:	DE370B917B0ED36963CA95BB94FB6D1365FAD4FF
SHA-256:	117969CE7A430D98F1B51BF6830DC729F664D71641F064654ABB9C79C0C1E8B7
SHA-512:	F45A1B31CA9D7475FF51E41107C6BEA0335EDF95334AC3EA2AA4EF96F8BF78CCC7CA952AFC52818B266B0C42BA939E99BE3B99559B3802C4792C64FDED7B24A6
Malicious:	true
Reputation:	low
Preview:	MSCF..../.......D.........................../....U..................@.D.......SW._ .\logicmodule.dll.....@.D...SW._ .\logicmodule.manifest.&l...,..[...< .......4....._..Vi...Fc.....9......X..E9.;....T.v.[7....]-...Si...#g.NJ.a41g........b..9...\|s..\|.._.'...$.z.R.".2...R.....%.N..;5....7...rV.............I:...F...E.;.... )!..>.+ .....]@.............f.h............yc....1.R.IX&@....+...7tvPI../.g@.<.]..y..sJ...r.........m..Dvv.XeSr.G:.;<OvE..v?..7_..\|.w.D..vo..W...r.-..z.n.."].....s.5.%.I.?.L..E.o.?...L{..[.....[jz.w...~-...y.u..~K.3Y.....V}.....H..H.$H..o..k..[..._...zz.........J.........<.#^......W..\.?.L.{.S.X]..B..{...[u.......1U.............%.D...]......k[7...f.4\|...be.+..h.....<}-...'\|........W.}..../.~..!/W.^.+...f.H...o..g..w.+I.......Y.\|.{..x..s.o..7.i..?.J?..y[......^k...>6...g..;.~l\|...i\|K<.+.e.....{.).O..d_.....[~.Y...%2W.6\|..L>....>..5.>.u.^.}O>.O........w.......c......+yc.[}\|r.........9....{..,.#.....<9......)5k.L.....

C:\Program Files\McAfee\Temp2863637682\logicscripts.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 36383 bytes, 20 files, at 0x44 +A "\logicscripts.manifest" +A "\logic\aj_logic.luc", flags 0x4, number 1, extra bytes 20 in head, 4 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	58383
Entropy (8bit):	7.922554941357534
Encrypted:	false
SSDEEP:
MD5:	ADD08210F32AA8FBCB6472FDC03F9440
SHA1:	E46956E5462B34A284FB0D7F39FD0604227F3064
SHA-256:	E9BBD57E9AEAB34A1ADFB8E6F0B9F7F150F8797BC2C3405BA16F9AD3E333360F
SHA-512:	6D1334252BFA9A314BA1B8A5F7DD0456861433D4087DD102E85D8731BEAA21A9F108D6B4A81DA509CE2D7AFBC9E704AB9B702916D5299CC8DEF84EBF3633731C
Malicious:	false
Reputation:	low
Preview:	MSCF............D................................U............................SW._ .\logicscripts.manifest...........SW._ .\logic\aj_logic.luc...........SW._ .\logic\base_provider.luc.w.........SW._ .\logic\edge_onboarding.luc.T.........SW._ .\logic\ff_monitor.luc.....l;....SW._ .\logic\logic_loader.luc.....RC....SW._ .\logic\miscutils.luc.#'...S....SW._ .\logic\oem_business_logic.luc......{....SW._ .\logic\providers_selector.luc.?x........SW._ .\logic\ss_logic.luc.E'..C.....SW._ .\logic\tests_logic.luc......!....SW._ .\logic\type_tag_utils.luc......*....SW._ .\logic\usage_calculation.luc......2....SW._ .\logic\oem_utils\affid_monitor.luc.0...%7....SW._ .\logic\oem_utils\oem_util.luc.W...U9....SW._ .\logic\oem_utils\oem_utils_wps.luc.Q....L....SW._ .\logic\oem_utils\oem_utils_wss.luc......U....SW._ .\logic\oem_utils\oem_util_selector.luc.(....X....SW._ .\logic\providers\bing.luc.`9...g....SW._ .\logic\providers\yahoo.luc....2/..[.... X.q...D34C.P..._....$.Ir........=...M'......n

C:\Program Files\McAfee\Temp2863637682\lookupmanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 469579 bytes, 2 files, at 0x44 +A "\lookupmanager.dll" +A "\lookupmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 48 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	491579
Entropy (8bit):	7.998529856255498
Encrypted:	true
SSDEEP:
MD5:	417EC3C8C79435BC05A035E1EEC7C7CC
SHA1:	F4007A7889B6C7B85429E1E5CB777B49FEEE7C47
SHA-256:	0F5584619C6B6B0A40367EC3DCC2BD97CB037F912C7C5C806FC98D4A53940C3B
SHA-512:	EEE040F0290907B0B97BD2D98A450782CF72684C392C25442536E579687DE8A3E4DD1D5D778736384BF6D781C8A5573E4DF074CC203430D5DEB65531854478B9
Malicious:	true
Reputation:	low
Preview:	MSCF....K......D...........................K...U..............0...@.........SW.^ .\lookupmanager.dll.....@.....SW._ .\lookupmanager.manifest.k.&.....[.... H....@d.5......myS.Tk.Sx.K....[j.\o.....R(-..$.g..Q.-4.....X.,..-......q}......#.:3...3y.s.....\w......z..F..T.d.w..*@Q..d...G.a..)..].c....US.-...I......-.c.ga.A.3.......d..~....1...3......{.s..t'..#1G...5..5FO\.:.Y4a....G.M...w..y.fH..?....E.m>.8.6}..k..PY...(..{....S../.....\|W..~)....../[._p..d...~.l.k..'..k7...xxw.m...r..r.....s....am.......#.-..7K.u...c.....\..\..}...Z.7.7=u...X.H.-..n.1.+V.~[]......7...`.m......m..![........dg6...d./<.......W~.g4?.....M................n...E....X..f~..?....b...[..M..}.[.q...o\|w.i.C.CG............6.........._M.....U..V...o..sW....RC/j.{..mo/...$,?dQ.lz..[t................./...O.z..3.Uc.....m.........OY.,....~)w..c...../...{.[........c.n..;..\|V....o....A..zw7.......J~X?.{.E'...zk....Sn6..R.......v.g.y.'..........=E........u............g..7..zn.m

C:\Program Files\McAfee\Temp2863637682\main_close_large.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 13 x 14, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.185064395828422
Encrypted:	false
SSDEEP:
MD5:	3F33BF7A71F1A94B30AD98121F2DC31F
SHA1:	533B933BACBAE375164518AF202EB90086BEFC44
SHA-256:	4D3581315F5AB93538BEE793BA9727FC9E8444E9B09773566C4BDF0C44618828
SHA-512:	4E768ABACB878A5F9BE79B91E9BC77778F62AA4ACAEC4A246AB3359E86FF685250A1BA9E7765CE5174A42E5936CFAC27CB381B505F92F30EBF4B43806848899C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.....................sBIT....\|.d.....pHYs...........~.....tEXtCreation Time.10/1/14........tEXtSoftware.Adobe Fireworks CS6......IDAT(...1K.a..........+ht...".96..\....M..f..9........ n....~.KK..o..~..g{8.:...I..D%...^..6V......w<K.......z.?..dk2..p.G.U.&...?..U.].m.O....L2.o.`<,.....k....\|....L...Q._.<.....?(...[...lW...O.6....Z....r.q....Nr..p2.d._.w...1....F.....@..x....x.X..T./.H..w./.yrd.......IEND.B`.

C:\Program Files\McAfee\Temp2863637682\mcafee_pc_install_icon.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 67 x 57, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2052
Entropy (8bit):	7.890065571351557
Encrypted:	false
SSDEEP:
MD5:	18344204EC04F1E95E086D3BC94FA0FD
SHA1:	87CA3ED8948774091B451F7CB2F95139E56D351B
SHA-256:	30ADF46FD9311E5C6DFEA8A2AB2176EBAF83E7019EE341896FC3AAA5F498D2BA
SHA-512:	13757DC62505D01E44523823F38001D28A2FB9CBA5ACBF9CB7D9BDD8D0F19583D814E5A47B2DB255E18CCC05C34D43A02C387B60D05D1E802F9AF527D3633C5E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...C...9.....ms......gAMA......a.....IDATh...l.........\|u...4q....T$....IHK.u.h...lS..{.....i.6..h....@PX[.&...AH.&.($E.(.R..).......M..:..}.g.M.8.c3.'........{....}.``....q.. 0..b.=B..?.:t......1..P_f5.......).7\..e..Y.gA.......XPL...Hss. .ks..... ..aPx;\|VO..{{{).`"...VAb....u.\|..>_..#......2>V......9.g ....<Bss.T....LFI[[..+%.Y.....N...~X.!......h.q.J.l...A.s...p8,.\|.K2..'.{.j..c.<.\|m..<.....'.K....zF...nu..<...\.a#U.Q.a#`..ZF%`...6..=j{ta...ax.....\.<.H....<>.'...x......./n..g..'G.z.E.\|.....(H~)2...U..O.?w...u.X{..j.v.D.M...z.9.\|.a.......\v..f..0....0..1Xs..p&5.C.?....XY.~...K...p.._.+....KEF......5V.f....l.u...N..../o....t....b.......z.).....v............f......L.:.n+..s>.r0l.i..&.u...1.J)..sk0l.j0j0l.l....C.......3Q#..7.......f.[..&).r.z..0..^Xs...z.-`....3..........{N.e...g...O..~[A.F...."....E.d\|..?.8S.........}.\|;.......>u..B.....Y Z.w.....W..:...Z+.r....+...7..._..b..........~.a..w..o........0.J...[.d...W..>...

C:\Program Files\McAfee\Temp2863637682\mcafee_pc_install_icon2.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7205
Entropy (8bit):	7.9471260512499375
Encrypted:	false
SSDEEP:
MD5:	F2E3045621ADE164E9DA40F294BEB00C
SHA1:	36E9D967C679FC898BED1FF6751A73BB863EAF79
SHA-256:	D820CF499FC4A9453771A23209A6C63DDD2CE3439E8B651A98DDF0C36ED2BDA5
SHA-512:	7E515A44BD63B33881EE86E0A911897138F2BA0A6E81925612EAF19E3EDAC5A9FDCEDE30E3AFF3E906A4BBA8AA4570E06308D75783057015C882C7E62A880928
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...`...`......w8....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs.................tIME......'..l.....IDATx..y.\U..?......./.@@....E&..P..GF.Q.F.....#..T..........D4.AC....b. +![w..NuU/.....q.z!.ToI@..SIW.s..}.y..s.U..?g.D?`..._T.(..}.n.I.w"+_..r0}y,.....`&....P......8.,....n.I..c@.4._....]@.J..UL.....A...[K........[.-...A.....g.'.N........#.l`.p'.d..o.@@T.P..tQ.A..........t..q`5.=...B.(Q.).."..`1j..&..n....}..e..].....-...x]..p%d.(,............g....o.C......p.j ..W~tW.3.]mq ...H.Q.P..-...Q2...v..O(..`...8....?.4...A..}#K...m......\|-.....w.2.m..lwL....Ys..y.;..\.Q ..p..e....B'p..........^@m.c\..[..Z!v....*a5...T#R..B8YH\|.....iw...8......,f.v......i`..:T.!F.\....t"5....0..._..K ...M.`.8d.5.9.x.c.v.A...Ug...Va.d.?..M]B.U..E.E.....: . .B5.B.1."......>...w7.-....@.P.;.d.LUp.D.0..R..TE......k..K[.>o...?.~....i..}bu...6......Pj.g.U..~'..+.\|.F'......y..t.p..0.6 ........E.).n`...3\-D.......^~6..

C:\Program Files\McAfee\Temp2863637682\mcafeecerts.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (2293), with CRLF line terminators
Category:	dropped
Size (bytes):	126293
Entropy (8bit):	5.969613768259596
Encrypted:	false
SSDEEP:
MD5:	D0CD30BD9B02F33B222FF8A846821D4B
SHA1:	DA85556707CB3FD59E08DF69017DF6BB82E52F62
SHA-256:	1CC3969AEF3DC3DC2330DB0386C6C27C09A58D078689D8D97D900A2B9ABE31A0
SHA-512:	6C1F9DE0897F02648638B26F20728C5F2E9822F8CAD232ED42ACC18F33AAE7E102C7A00E5D42B80C10E423DB937DC6AB783255342B12B0DB07B378508886C2ED
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<Package Version="1">.. <Certificates>.. <Certificate Name="McAfee Trust:0">.. <Privilege>PRIVILEGE_IOCTL</Privilege>.. <Issuer>Microsoft Root Certificate Authority</Issuer>.. <Subject>Microsoft Code Signing PCA</Subject>.. <ValidFrom>20060125</ValidFrom>.. <ValidTo>20170125</ValidTo>.. <SerialNumber>6115082700000000000C</SerialNumber>.. <PublicKeyMD5>4A171B7E5701870357585DD1BAAD752C</PublicKeyMD5>.. <SHA1Thumbprint>FDD1314ED3268A95E198603BA8316FA63CBCD82D</SHA1Thumbprint>.. <Data>MIIGgTCCBGmgAwIBAgIKYRUIJwAAAAAADDANBgkqhkiG9w0BAQUFADBfMRMwEQYKCZImiZPyLGQBGRYDY29tMRkwFwYKCZImiZPyLGQBGRYJbWljcm9zb2Z0MS0wKwYDVQQDEyRNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDYwMTI1MjMyMjMyWhcNMTcwMTI1MjMzMjMyWjB5MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSMwIQYDVQQDExpNaWNyb3Nv

C:\Program Files\McAfee\Temp2863637682\mfw-mwb.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 10303 bytes, 6 files, at 0x44 +A "\mfw-mwb.manifest" +A "\packages\mwb\mwbhandler.luc", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1503 compression
Category:	dropped
Size (bytes):	32303
Entropy (8bit):	7.808899056176092
Encrypted:	false
SSDEEP:
MD5:	47CE729455BB56778B16B97EF1F5DE3B
SHA1:	D81688BFEBE2E51A5BFE5C7B8BE1A492B790F553
SHA-256:	E639502F668950CE99B5E6ADD518A12E43C98B3F8CA8EF524B75F190396AC4D5
SHA-512:	2BA5DBADB091D441BD372A5C104F464EFE9CEDDE9900925049E7DC7C1518D0A402491C807625886F9FBAF9487D9682C9D120B0B4FAFB6B9AD85480D838C49614
Malicious:	false
Reputation:	low
Preview:	MSCF....?(......D...........................?(...U..........m.......W.........SW._ .\mfw-mwb.manifest.~...W.....SW._ .\packages\mwb\mwbhandler.luc.3.........SW.Z .\packages\mwb\stop-video-alert-icon.png..... ....SW._ .\packages\mwb\wa-controller-mwb-checklist.js......J....SW._ .\packages\mwb\wa-mwb-checklist.html......T....SW.Z .\packages\mwb\wb-rocket-icon.png....6.&@V[......d..A..#..O...%......Jk..m.?.D8....V..".A...\|.8...\|........w) "4.5#.p...`....t..8...`.4.....P.y.[7/.....IU.....}c=...[.j...5k..zX....C...a......j.h..>..... ...#.DD...U3w//ro.V...@#...). .P.YP"^.p....x\|...\|..a..$R...&.`(..=p..+ti...C.....F.U...!..0"E.%&...bM.[..^L.?B..mr.w...G..U{s..O.}..$...]p......6./......l\|..&P..AMN-A8<..L.(.aP.?..q4...,...~/....='..2.$F.1.'...0[U.'..y..QeF31..(..H.......N.$D$m.q.5...%....33.".>.O-..o0...@..../.3..{caRV....$eL..<..b.{.p...$.~Q0..p.....~.I...9..(K..Uy.T.9.E...r..I@../..I.......Er...oQ..PT...........%.0./...c.c.P3B_..Y.\.........Y\.r.......5...H$#Z

C:\Program Files\McAfee\Temp2863637682\mfw-nps.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 12598 bytes, 6 files, at 0x44 +A "\mfw-nps.manifest" +A "\packages\nps\clipboard.png", flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	34598
Entropy (8bit):	7.82948620298698
Encrypted:	false
SSDEEP:
MD5:	E1995E6890D79881E969BE718925F2D8
SHA1:	686278ED110BACE808D3122349B0823A57CDAF1D
SHA-256:	85DF465C4E7C0AE9F821D7B291DB4E9AD22609822C2258EC5F9A50EAB5C04737
SHA-512:	D69DD972F318206D6DC980905E36C562F17CA5C6F5E93F560081F05DBF6487D1DB092470F4E3F92742D787F14319EF7BA2B1D00C604A9D3966679B3B58D3858C
Malicious:	false
Reputation:	low
Preview:	MSCF....61......D...........................61...U..........Z.......P.........SW._ .\mfw-nps.manifest.k...P.....SW.Z .\packages\nps\clipboard.png.-.........SW.Z .\packages\nps\info-16.png.o.........SW._ .\packages\nps\npshandler.luc..j..W/....SW._ .\packages\nps\wa-controller-nps-checklist.js..........SW._ .\packages\nps\wa-nps-checklist.html.-+..\|..[.........B.....=....$".^..=......Z+~...Rh).Vi...VG.V.....+hBX.A#.`U..V.x.$..W.o%h.^N0.^-Iw..fk.2.D.q.....w 6..P{._..........jdh.=..~AI.n=.....'.yZ......\|E{.K#.sQ.#.t.Y.<M.2..wE.GF.!a...N....055..3.i......ORH..%... w...7...^..L...f....F..oZ[...Z.?.~Os..k~....U.h]....................Q.\|8j4....~B}............K.......L.G.I..7.....;..~.~.1....~.. ...8....Q.Z.v......)hq.....z.?....c..,..'..X..../.._..j..pk.fS...?.=?..._)w.i.IASM..3..n......+^[........a8L....@...U..{.._...E........S3.."....w}7?ok.....7.......>.>.E....y......Y.5.~}..o\Q.qNyr.../......zjOjo..%..........2.G/.........B..9.8..0.......98.@D.(~.....@..B.......82.T

C:\Program Files\McAfee\Temp2863637682\mfw-webadvisor.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 914590 bytes, 203 files, at 0x44 +A "\mfw-webadvisor.manifest" +A "\packages\auxiliary\reset_handler.luc", flags 0x4, number 1, extra bytes 20 in head, 48 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	936590
Entropy (8bit):	7.997351059282376
Encrypted:	true
SSDEEP:
MD5:	0927B8B2CADAE4A10A45FB4AE65811DC
SHA1:	1B4894803F93009E0DCB1979ABA89B4DE74AFE15
SHA-256:	16733E6356B7EE58EB78FFBD53925FA305712C9BC524C2480E6D5B9B37533A76
SHA-512:	39928E91E95F1322D2989283EF55991D9111A490180BA2D0824EEEF5DE6AD3BEC768E13EA5C2D198E3E4DF98C39733B2851716F286CBFA16FEF393ACF5C8DB1B
Malicious:	true
Reputation:	low
Preview:	MSCF............D................................U...........1..0.............SW._ .\mfw-webadvisor.manifest...........SW._ .\packages\auxiliary\reset_handler.luc.e.........SW.Z .\packages\builtin\allow.png.....,.....SW.Z .\packages\builtin\balloon-arrow-right.png.....).....SW.Z .\packages\builtin\balloon-arrow.png..5..6 ....SW.Z .\packages\builtin\card_bg_image.png.....%V....SW.Z .\packages\builtin\celebration_white_bg_color.gif......Q....SW.Z .\packages\builtin\close.png.8....R....SW.Z .\packages\builtin\close_icon.png.T...%T....SW.Z .\packages\builtin\dialog-balloon-logo.png..I..yZ....SW.Z .\packages\builtin\enable_ext_guide_ss.png..R..d.....SW.Z .\packages\builtin\enable_ext_guide_wa.png.d4..@.....SW.Z .\packages\builtin\enable_sideloaded_ext_guide.png..8...+....SW.Z .\packages\builtin\keep_changes_guide.png.W...id....SW.Z .\packages\builtin\logomark_white.png......e....SW.Z .\packages\builtin\mcafee-logo-1.png.)....k....SW.Z .\packages\builtin\mcafee-wa-logo.png.EP...t....SW.Z .\p

C:\Program Files\McAfee\Temp2863637682\mfw.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 295347 bytes, 54 files, at 0x44 +A "\mfw.manifest" +A "\core\class.luc", flags 0x4, number 1, extra bytes 20 in head, 32 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	317347
Entropy (8bit):	7.995080582141161
Encrypted:	true
SSDEEP:
MD5:	94C4D71DDA561624BBA345AD8FFED580
SHA1:	F6C9ECC1C418A82F75FC42F5BB727AFC3A7C746B
SHA-256:	A1A28B554B155EAE43329F216F05C1CEC8F5B91A39EA7487B19C8B2B2BB4B736
SHA-512:	C3EE2671C0267291474B970C7397B207887D1CBEA07377B0B5600EBD3CD8BDF1EF6760AAA101EA411B41300A07B54951C3F7558150A455D8B38FCE297D82473C
Malicious:	true
Reputation:	low
Preview:	MSCF............D...........6....................U..........3... .............SW._ .\mfw.manifest...........SW._ .\core\class.luc..'..H.....SW._ .\core\dkjson.luc.....82....SW._ .\core\handlers.luc......:....SW._ .\core\init.luc.....oD....SW._ .\core\json.luc......F....SW._ .\core\logger.luc.....*I....SW._ .\core\postinit.luc......L....SW._ .\core\priorityqueue.luc.....xQ....SW._ .\core\triggeracceptor.luc.P...TS....SW._ .\core\uiarbitratorhelper.luc......a....SW._ .\core\uihandler.luc.u...Rf....SW._ .\core\uithreadexithandler.luc..d...j....SW._ .\core\win32helper.luc...........SW._ .\core\utils\browserutils.luc.`...].....SW._ .\core\utils\common_utils.luc.c.........SW._ .\core\utils\packageutils.luc..... .....SW._ .\core\utils\settingsdb.luc.}.........SW._ .\core\utils\stringutils.luc...........SW._ .\core\utils\telemetry.luc.^...a.....SW.Z .\packages\builtin\green_check.png..>........SW.Z .\packages\builtin\icn_mshield.png......I....SW.Z .\packages\builtin\installer_background.png..l

C:\Program Files\McAfee\Temp2863637682\resource.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38888
Entropy (8bit):	6.344666762097508
Encrypted:	false
SSDEEP:
MD5:	9FC3387AB7332BA77EC8EDAEAF67FFCB
SHA1:	9DFB79913911F0810357021026F72088138F4A44
SHA-256:	7E3BE8083094958386B39F4A2C2E0E7267065EF4D2D44495058B0E571D76A17D
SHA-512:	D758A43AD9FF77CF976C5C72AAC120D5BD361353295510312A2501D0E6D45BFCCBBDBAC8CCF99718C673CCE723D84281E6A64489FB92DD8981FB52DE2049AE07
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......yj=.=.S.=.S.=.S..~..<.S..~Q.<.S.Rich=.S.................PE..L....k1e...........!.........>...............................................`......c.....@.......................................... ..\:...........@...W..............p............................................................................rdata..............................@..@.rsrc...\:... ...<..................@..@.....k1e........z................k1e.........................k1e........l................k1e............................................RSDS.{xU%..H.\|5.+.s'....c:\jenkins\remoting\workspace\ebAdvisor_WABinary_release_4.1.1@2\build\Win32\Release\Resource.pdb.......................GCTL....p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..`....rsrc$01....`!.......rsrc$02........................................................................................................

C:\Program Files\McAfee\Temp2863637682\resourcedll.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 31998 bytes, 3 files, at 0x44 +A "\resource.dll" +A "\resourcedll.manifest", flags 0x4, number 1, extra bytes 20 in head, 5 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	53998
Entropy (8bit):	7.919912822738636
Encrypted:	false
SSDEEP:
MD5:	B182229CED974DD50A4CDF384D2C9D0B
SHA1:	EBFCE8B75FDEEB4E64BC5C3F9EB3245BA4A2266A
SHA-256:	1F4FE65A3D4EBC4C4DB02E91F5D3B8EA92A2BC45E25A8633260E8792D7BE799A
SHA-512:	4F0BADB6995269C9B4B20525F10DC43131784615A1F459D75C96023FB4B022ACEB5AC2AAD3B06EB871A6F99BD78F4F659336277D9E152A47007A61470CD5F62E
Malicious:	false
Reputation:	low
Preview:	MSCF.....\|......D............................\|...U...........................SW._ .\resource.dll..........SW._ .\resourcedll.manifest.4.........SW.Z .\webadvisor.ico....y.<..[.... w.q..@........m<{....D.7y...{....J..U. R%(R$.$...N..$E.......8..~0......v...T.[. `$.......N.....7_d..Y.X..nj..Y..<.d.>..7.8.ki\|\|+.mk\|TS...by~x........._.$..t.. b.DD`TU...+.\|.......Zd..%`."..t....Q...g..Du.@G.AX..u..@`.w..O.....(../xyP....D.....qq..j@.w.V.gf.q.......}......7.6.l...........h.\h...b..T.0....{`.>..S....,..TcB.....4..>...X...G.4.(/w\|c.....\|.?..J......`..t...A^v... -.w}..z..->....j......\...?.u'r8F0............."4.!x9....!..Q!...@s..3hbP.P.d.K.>.7..0...q.....,.K..E..3@..C.c.;K.c..[..k..:....4/...1.".:..3...7....j._ccq:]75D..C..v6%./..4>....n.ps..s......tdu...w...t.Pt-jmkr.b..B~..../.F.....K..B.....-......=.z.{... .WZ..Ny.....n.1....#...`..I........../.%...^.yw.....2Pa .P.A/.....d..3.aA.C..E.....>1lm.b......A......m......\|Gi..*.yy...p..>.......azy.P....

C:\Program Files\McAfee\Temp2863637682\servicehost.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 291149 bytes, 2 files, at 0x44 +A "\servicehost.exe" +A "\servicehost.manifest", flags 0x4, number 1, extra bytes 20 in head, 28 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	313149
Entropy (8bit):	7.9960870127885775
Encrypted:	true
SSDEEP:
MD5:	5612671EA047C3822127208FF3D393BA
SHA1:	D575548A6B5C2607FC266269BF46EF7B89BFA209
SHA-256:	CE830C787B162732C718DCF7399DE12D8D109BC9E568DE3E0663675E7A42F6E6
SHA-512:	377286C251026795F6891D3701F9FA617C1CC34D3E6C967228979125EF9C2D9B80BFE045E52512B7AEBC5362AE1C9A9A36DD03005933B00144299BAAB7E464E3
Malicious:	true
Reputation:	low
Preview:	MSCF....Mq......D...........................Mq...U...................u........SW.^ .\servicehost.exe......u....SW._ .\servicehost.manifest..N].....[.... H....R.4".....m..]1...D...6.W..;5K.i....i..v..VW.....v.\e/.`v.HZN...y\|...2N./.Q.#; .#.g4VU...`..y{sg.9._...~/?.D....P,.\r.. ..i....X.-....d[..(!...IA.h!f..Q....B.... F..t.......P.]...5....p.....w+...h.x..IR......1=..=.....,......U.m @.R.O....+..=..E}.U....,....u..A....Wv?+...o.......d....Nw....]..W;J..........M.d.{N.~q.D.o..?..!O..a.M.Do...n..w.08.b.r..j...{.......W{....^...#..a.X..~$.Pp...=....Y\|......r..._v..o.......>.~.........).Iv.=..k..{..........d.3.oZ_o..C.......&R..5}...\|.....jo9..........S2..s.X?>sWN.\|.B./.....V..~u..2.A.c........U...lkD........3..D>..+EW.#k.].?../.l...x....l.\|....(.Xv....~.w......k4...j..-..A..[..o.....)C.?...ud.......Y...........".9.~....-Y....x..........dd.....Q[?..Y,L.L.#...*....7....{A$.^M.....B....W...........<k... .2.,kW....wi@...".M.......W.:L=.:){Q..

C:\Program Files\McAfee\Temp2863637682\settingmanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 858839 bytes, 2 files, at 0x44 +A "\settingmanager.dll" +A "\settingmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	880839
Entropy (8bit):	7.999427454798419
Encrypted:	true
SSDEEP:
MD5:	19647CE69AA4B694E2771A182A5151C3
SHA1:	AA9063652BC38BEEF7F382F75BEC0B512C18C845
SHA-256:	A0D70CD5C72B0B30CFEC2DA7569E417A0C0E7245291C3A5360587866EC0173A8
SHA-512:	51C0E9930F1234BF78DDEE8151855CFBF8847F7336B175891AE8D8FDDFB606A36C0074F82898B5C8761D9340971DAFA2C05BF95AC7AF7457747AD7B10B070257
Malicious:	true
Reputation:	low
Preview:	MSCF............D................................U..............D... .!.......SW.^ .\settingmanager.dll..... .!...SW._ .\settingmanager.manifest...T.....[.... .....@d.5.....V.A.L[+.4^w.w..c.p.-8....X._.-.;...0n....r.;.#..i.......mUjXc#.........X..<..~.............d.L......V.@.k.m+2;A..2.P.dV...C....0.e...X(.cd.P.......(.N<..a.........H.....{.....s.U(l$.! ..@.u.%.....$:.u..=.t.f.B^}<.f.f.L."^...d...Y.[;~..2.M6........S_.]......N...=.7/......../R.}...o.5....t...w...Y./~....b.L....c......W/...=y...3\|.....C..9.~.a.0kzZo;.........gR..3..../........P......./.V=....u..s.e..u^......-.O...[.4....E....f....m.l.B>^I.<....i?.^..n.}..7.....4H'.....h...#.......\.J..y-=.__.r.....v.._h. 1..$...m.....w.W.?~..K..f.}..oo..o.v....../me.q.^..}.......q2.'-S.....>xS..q...N.........w.....a..k7..Q...F.).Y8.^.O.nt..e..?..<x........X..~.s........2.H6.1....5\.-..O.\4.......q...~....Y.Z..Y.m.d...............^.u..>X=.Y..[.jR.............$.^..n...Q...a.........pwx.OBo&..

C:\Program Files\McAfee\Temp2863637682\taskmanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1355431 bytes, 2 files, at 0x44 +A "\taskmanager.dll" +A "\taskmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 126 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1377431
Entropy (8bit):	7.999544124187063
Encrypted:	true
SSDEEP:
MD5:	A749E4229060DAF3181DB8B3BDB48A09
SHA1:	EFBCF90D3E3470350F906353749D5CBDBA085C79
SHA-256:	8ABFAA7FA12ED325AB48628B3E089D128381545A3A14E8E507F4DA41EEFB3D88
SHA-512:	4528CB6225B8100C1E633A5BC2664AF21D2685178F2FC3BE11D56F562520015D2D3173410140ACC13518DAAA57D1FDB0D0BE1004BAB0CFBB2847236745F5F392
Malicious:	true
Reputation:	low
Preview:	MSCF............D................................U..............~.....>.......SW._ .\taskmanager.dll.@.....>...SW._ .\taskmanager.manifest.........[...E .D...@R.5.............v.dLv0n8..ej....a.d...d..9.ae:.j.S..-.;.\........dG....y....T.U\..5.......}.....I...[.F.U./HH.-WW...q.f&.c[....H.7.....)I.Z..P6.:4...W.J...7....T.T...~.,...B../x" .<..D...%....4.U4`5wP.E....N..I#'.-.h..T[...(=...`q....^.....FYc...^9...p..D.x...m..N../.Q.....6.NId.\|.-...y..NJ.J.ne=c6q...n}.W..v.;..-g..K......M..7n...^......zO.?..n..S...c........lL]_..s^Gj9.(.7.v..b.o..~c.....Fm..bd~...!.j...........Z....D....o..W.~.U...:8I..x..~....~..... .....oX....l.}..r_\|..2).o0.s.....#...Ra..d...G.~.o...y.%...._......?yy.'_........1...o.n..E.'...z.?K..5.a2O.6....~.gM..a...._l.sr...o.^y.BU.{.k..U.c..w[.._7.Y......{_G.........\|<...-..~./..O^z...soI.[.).-...};x........4W.T.a.Awx...^..PQ.>z..Oz.=u..~w.'.......C......~.3.........z1..8p.o.P..N..Sm.=.;2.S...[......G.w...6...g.0..g.a..

C:\Program Files\McAfee\Temp2863637682\telemetry.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 69888 bytes, 123 files, at 0x44 +A "\telemetry.manifest" +A "\dimensions\dimensionconfig.luc", flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	91888
Entropy (8bit):	7.922281166531392
Encrypted:	false
SSDEEP:
MD5:	5E210B6385D6CF0D469C1F6B9F34EB1E
SHA1:	9E61166A27F70C54E06340B6A3301D17FDD93112
SHA-256:	29DF965DA8DEF7ECBA6669188E6460A14038762AD98E22FE687258C4FF006529
SHA-512:	5911A1E28BDD5F0B7E274501423D1495FC9A0AE917758095E9BF2912ABB4EB7B495A385975DC044F45F568D1921889BBC5CACACAAA3099C9E1FE9F5EA8B03571
Malicious:	false
Reputation:	low
Preview:	MSCF............D...........{....................U..................@.........SW._ .\telemetry.manifest..\..@.....SW.[ .\dimensions\dimensionconfig.luc......h....SW.[ .\dimensions\dimensionhandler.luc......j....SW.[ .\dimensions\dimensionprocessor.luc......p....SW._ .\dimensions\version.luc......q....SW.[ .\events\eventformatter.luc.....Tw....SW.[ .\events\eventhandler.luc.....h.....SW.[ .\events\eventtransmitter.luc.....j.....SW.[ .\events\handleonnavigate.luc...........SW.[ .\events\sendonping.luc..g........SW.[ .\events\telemetryconfig.luc.....K.....SW.[ .\events\telemetryhandler.luc.....E.....SW._ .\events\version.luc.....0.....SW._ .\serializers\download_scan_ui.js.....0.....SW._ .\serializers\edgeonboarding.js...........SW.[ .\serializers\edgeonboarding.luc.<.........SW._ .\serializers\edgesecuresearchonboarding.js...........SW.[ .\serializers\edgesecuresearchonboarding.luc.,.........SW._ .\serializers\extensioninstallationtoast.js.]...!.....SW._ .\serializers\fw_av_warning.js...

C:\Program Files\McAfee\Temp2863637682\uihost.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 285929 bytes, 2 files, at 0x44 +A "\uihost.exe" +A "\uihost.manifest", flags 0x4, number 1, extra bytes 20 in head, 27 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307929
Entropy (8bit):	7.996513692611283
Encrypted:	true
SSDEEP:
MD5:	8DD7B2952CC7A3A5EB8F1AC3E8B30215
SHA1:	39AD040718F144B92BA57D4D8FAE1C3086D67BBB
SHA-256:	B9EC5CF56F89263A2F1EE10D0F7A09525A988C3BC636F6819BF5191D00A35EC3
SHA-512:	4CB56D69A3C50BF34F87CA6BC378AF52004BB2F65A31360389D7F4D4AD04146A528FD856BA84FF3B65342F1D62A2E147C06B9EB90E482389C0927496AC45BD2E
Malicious:	true
Reputation:	low
Preview:	MSCF.....\......D............................\...U............................SW._ .\uihost.exe.-.........SW._ .\uihost.manifest..,3.V...[.... .&...@R.4".....n...jk.5.Lm..T.g.Z..t...6R....T2..EX.^./.7#o.....)......QL.....A.U.Q!V6@\F..h......s.y.5.......t}. .k..,......D.U.%f2`[.21.....%.FJ.@.B..J0...PKR.......}.}"..... .........B.....d...[f..T.hQ..{..1..x.t.....t.zo.d{.Sk.h.XX.@.lbk....l.>mdF.tX....}o..Z.-.A.}g.......%E....%...-.31.%.s{.p.F...s.;...g.S....y..5f......J...n.p.f.......)'........Z.v.{.r..m.........L...Ove!.79A.3..w..8...{....=....M{..%...g...Z.yw..........^:.....;....VS..9.........Dn..m..z>..c....Y..Ac..z.mO.._?..z'.I....6K..._..k..>~..=..{z.E\|%......._....h..7...;...E.......A....,..m?t.'@......~.M7`....>:......s..z.?{..._.-....JKe.\|`.sv=*.4h.:eA.....x{=.{..}w...k.......6.....y~...S/f.x..'......kn...l....q^?..[..k...h6....l.......z.....~...M. g...<p[.o...x{.>....'.+.e..-;. ..]._..q.2.A...fK....6..l.5......My......8N.V.....'\.

C:\Program Files\McAfee\Temp2863637682\uimanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1751629 bytes, 2 files, at 0x44 +A "\uimanager.dll" +A "\uimanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 167 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1773629
Entropy (8bit):	7.999595046383415
Encrypted:	true
SSDEEP:
MD5:	47E1D0B80A30A92E69B82399CA89121A
SHA1:	4DB660A2DF048015754FA9C107986B1FF460C00A
SHA-256:	7B476E41FA265A84630CA0C806684DEDE107DC09143695385CCB426879845333
SHA-512:	67AA7519763A394E73D66A0D03264F1C8B353BC72D72E7524A9AEB2C85F8F4D44C86617A689FF6BCD618450BEA8E27FD1C9521367FAFBEB89250EAD3B163BC30
Malicious:	true
Reputation:	low
Preview:	MSCF....M.......D...........................M....U...................)S.......SW._ .\uimanager.dll.)....)S...SW._ .\uimanager.manifest...jM.3..[......X.."c`$..n...Y..{.P@C.A%...e..i..d.....+A....+u...gyl..1A.;..~....we"..5......Za^F.034W2..`...o...Y.&g.M..4.A.MjFb..pSs....d...M..5......@[.4& c."G....d...k#Af.lF....&$.................l...yx..&T...$....a].w...c...E......b1.vB.S...\|...+`..w..w.r..k..^...zKj..7...K.V..t\|.Z2V.Y.....5{...CS.s<wZT.mr.{.Z..p}.[..s'[ruR[\|u...".-...YltA.4."._.?..&G.8.F>I.....P.x..(.-....n.\|.8.n'...}}n...Y.]}.4l.._......we.+T.5.h..g....p%...(.x...4w.P%.x.......H?Z^.Q..>>H...!......~.......M3...V......K.f...l...q~{.^.....h..f..."....._..Vk6.I..I.H=..<K......Ky9%.z%e.eU$7'\a.k.\.'_...I.I..QV.v....$E@S2...r..W...X....i..nK..r.k..=..B.....r.-..u.O_^.^X..y.u...=...h9F;?.\|...S5......a.9.##q..T.we..8..x.R.......!W-.$]...;...ee...b....OS..Q'...E...Q.Ox.<.U.8.i+.......?~....f.A4.p2..G.9....a.R..5<H+.D.."U.%...\|%8\|....{.*.=...G

C:\Program Files\McAfee\Temp2863637682\uninstaller.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 896328 bytes, 5 files, at 0x44 +A "\uninstaller.exe" +A "\uninstaller.manifest", flags 0x4, number 1, extra bytes 20 in head, 78 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	918328
Entropy (8bit):	7.99935092902814
Encrypted:	true
SSDEEP:
MD5:	73AF0159DBD92E6039AE1D86B84F312D
SHA1:	F69A327A885DEEED29AF60FF26F382C4AC4F2DF5
SHA-256:	4D8CCE57584B25B71EC547958E84E95954090644CCE0C7284243DB5E5EA48DE0
SHA-512:	D001C8A65C8A7FF09220DAE89DEBE0E07EAAB3A2C36542ABC0A735AB6AD615321BB4869A075C6735A16606383C38023B7D824F9FE3F5BF113220B1E7DFFADAC5
Malicious:	true
Reputation:	low
Preview:	MSCF....H.......D...........................H....U..............N...@E&.......SW._ .\uninstaller.exe.u...@E&...SW._ .\uninstaller.manifest..'...W&...SW._ .\wa-ui-uninstall.js.......&...SW._ .\wa-uninstall.css.......&...SW._ .\wa-uninstall.html......,..[... .......4............Y.l......K..KvS.Z.KQXm.bl.........aka..d."i.b..QX.@,f..f..........._.N.{w1.1s.).D........[Z1....n....6.......TI.,.;.jl,...9e.I.ZK.q$.i,Z(..,F3..0...`...&zH/................AA?.{.L.1...9n..v...T.T....E.-...E.Q..i..V..Y...^Y..v..ES....((.c_..h..aOrL....>...1N6..[.\`7.+.n.o.f... ....r...\..{`s\|..n......./.7%-c.....c..y.8o....l/.\2.D.!....,c\|.9..ay.`...y.z.Y.A.@...Q~.....v.v./......$\x..(......sM.:.W......;...5C...J.-....d....5.P3.h.._O.Yb..)..............Tk....W.v.&..e_....?..B.....&........v.`...P..~....C.r....a...........%..[.:...D...........S\|....s.-.Zm. ..j...[.....yH.z.......uK....V.C0.z....G.Fs..........W.=...^.T....i.V....~..o.V...\.n..O,}...2u.......x.......l....G

C:\Program Files\McAfee\Temp2863637682\updater.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 855441 bytes, 2 files, at 0x44 +A "\updater.exe" +A "\updater.manifest", flags 0x4, number 1, extra bytes 20 in head, 77 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	877441
Entropy (8bit):	7.999306815127104
Encrypted:	true
SSDEEP:
MD5:	15E28F4C08E79950B8534200C09E5F37
SHA1:	CAD828D2B815EDBC916382F68FB6EFE810D0EB49
SHA-256:	CD5920D44F5A5663B556098836F04D932769AA86E96129816FF63D0802CE2BBC
SHA-512:	80CEF52CE5A4A98EED6AEE65B5555F84AA97EF5431100CCEC33C0B96713F12F0875A4F54C2E7F7E29C343F3DBABEE44B1747DDC158001F182524287E27353007
Malicious:	true
Reputation:	low
Preview:	MSCF............D................................U..............M....M&.......SW._ .\updater.exe......M&...SW._ .\updater.manifest........[.... ......d.5......m.ZV.........,..B.R...R.HR.[..K.C.m.......q..q;.a6.t..v.....Zl...!3..23.~?.w.9......w.f..'.2iE...l#.3O.B.c......fC7.$..Bw:K.6...-......WP. ".v..TP.([....T&b.&.Z.m..9..cM,.3KY......Dh.f........~$../..7.y..P)M.@.......lQ.....N@K.,...5...._f.7....YfU..~.{..J.'...s...,=..y.....=.g....}.k..k.}+...=..x\.o{..E<.N../.:.....t.&.J.&...,.fS..I....t.....)}.#......go...i.c...H.c...b.H.....H.F....I...i.1q6._s(...W...H.myO...3...].e7.l...J......i{.fH.q^u:..=,'..l.Y..6.g...%.R.t....-4+...?....C\|7{........mB.>.....?..S..R.Y.<...z..#.......fX..cG..W......o.O....1...l.6..w.....h....J.......f\|.i....N..a*_.....^g.9.1.K.e..{...;...T.6Y..y.\|.Z...W.....zl...z{...oU[-..}._..i/..t..........e.....~.+..tHmM{...oJkfM....l..`....ak8...>..K.%....,..z.nx.....F..m.....@8....6..s.v.>g.j.........-...-Z

C:\Program Files\McAfee\Temp2863637682\wa-common.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	ASCII text, with very long lines (33246), with CRLF line terminators
Category:	dropped
Size (bytes):	34082
Entropy (8bit):	6.048810099348607
Encrypted:	false
SSDEEP:
MD5:	BED2FF23927C34F86C480203AA7F87A0
SHA1:	90B1B32D7A9CEECCD555D674582CB8AEE64E8909
SHA-256:	9D7AC9A5AE897E993C0B6BAD468F56BF3B6CEFCFEAAD6FD2307CF8370945A2C2
SHA-512:	6538FEDBC2DCE5EAF944CBD18F93783CDBFDC2920726A3509D0686BD062793B422AE6C6F67DFB0C344AC3E084F8B1F10425FA4636D1BA0FBD9E2ACE86EA6AE83
Malicious:	false
Reputation:	low
Preview:	/* Open Sans Regular */....@font-face {.. font-family: 'Open Sans';.. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAAGEsABMAAAAAsTAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABqAAAABwAAAAcbEIkOkdERUYAAAHEAAAAHQAAAB4AJwDwR1BPUwAAAeQAAASiAAAJmCwaFlhHU1VCAAAGiAAAAIEAAACooF6Ikk9TLzIAAAcMAAAAXgAAAGCg5ZlGY21hcAAAB2wAAAGGAAAB2s9AWKBjdnQgAAAI9AAAAEYAAABGE1sNN2ZwZ20AAAk8AAABsQAAAmVTtC+nZ2FzcAAACvAAAAAIAAAACAAAABBnbHlmAAAK+AAATOAAAJGkMGdKhmhlYWQAAFfYAAAAMgAAADYJip5GaGhlYQAAWAwAAAAfAAAAJA9zBj9obXR4AABYLAAAAjcAAAOm2kNYqmxvY2EAAFpkAAABzAAAAdZ4GFVubWF4cAAAXDAAAAAgAAAAIAIHAZduYW1lAABcUAAAAgcAAASAUcWdxHBvc3QAAF5YAAAB7gAAAt15xIzucHJlcAAAYEgAAADaAAABfLpWDR93ZWJmAABhJAAAAAYAAAAG7JdVfgAAAAEAAAAA0WhVmAAAAADJNTGLAAAAANGknRZ42mNgZGBg4AFiMSBmYmAEwpdAzALmMQAADaEBGAAAAHjarZZLbFRVGMf/M51hxoKWqtH4CBoyNrUGjQ1J27GwatpaDZZpi4MOig/iAkJCY0hMExaFgbgwIQYrOTxqCkyh0FmQUpryMkxXLNzhaW3jyuVJV8QFIY6/c9sp4EjVxHz55dw597vf43/OPXMVklSpbn2qSEvru916/rOvenep5oveHTtVv+uTL3droyL4qFiU9/0316GdO3p3K+6vAiIKB2NcoXh

C:\Program Files\McAfee\Temp2863637682\wa-core.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26073
Entropy (8bit):	4.774476579925344
Encrypted:	false
SSDEEP:
MD5:	4C7B6F8674B7AB6F82D336DDA5EA7458
SHA1:	273346C8B26F0804D5D4AD8DB1382A2775FCB230
SHA-256:	7D6298561E441CF79CE9B698D1040FC19460E1AF44EA1216AA27E662247895C1
SHA-512:	58DDD8819F40D37BDD1236DC7C2CCAA28666C3DD84DE24F7C6A3F8B590AAFEEAF66AD609B3DFE97C452C19AAC0E6FA455FC1C2710BAE58B59AC017C27139B9F6
Malicious:	false
Reputation:	low
Preview:	/* Core */..(function (wa) {.. var core = wa.Core = wa.Core \|\| {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External;.... //Component.. core.Component = function (name, status, key) {.. this.name = name;.. this.status = status;.. this.key = key;.... this.isIgnored = function (key) {.. var isIgnored = false;.. var startIgnore = this.settings.get("startIgnoreDate" + (key \|\| this.key));.. var ignoreDuration = parseInt(this.settings.get("ignoreDuration"));.... if (startIgnore && ignoreDuration) {.. var today = this.settings.getToday();.. var startIgnoreDate = startIgnore.parseBasicDate();.. isIgnored = today >= startIgnoreDate && today <= startIgnoreDate.addDays(ignoreDuration);.. }.... return isIgnored;.. };.... this.isInFixGracePeriod = function (key) {.. var inGracePeriod = false;..

C:\Program Files\McAfee\Temp2863637682\wa-install.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5549
Entropy (8bit):	4.066110247641768
Encrypted:	false
SSDEEP:
MD5:	F537A07AE7D570F52EE50643365B1FC9
SHA1:	F3EB5BF057F2F981123FEBFCC568741E4E0F8FFB
SHA-256:	2518B71F18A08AF85F79A3947C975A098346346750F0136891279B803F369529
SHA-512:	1DCA227E358932ADEE77011F3E0A949E20A402FE99AA71B204A2E1936EF9C159D8DDB39F1DD36E2A974369232CA59D703334833DAE72F2DEEF12C8EC48553F0E
Malicious:	false
Reputation:	low
Preview:	body {.. background-color: #ffffff;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....img {.. -ms-interpolation-mode: bicubic;..}....#wa-installer {.. width: 455px;.. height: 378px;.. border: solid 1px #BBC7E7;..}.... #wa-installer .header {.. height: 50px;.. display: table;.. width: 100%;.. background-color: #F5F6FA;.. border-bottom: solid 1px #BBC7E7;.. }.... #wa-installer .header > div {.. display: table-cell;.. }.... #wa-installer .header .title {.. padding-left: 15px;.. vertical-align: middle;.. }.... #wa-installer .header .close .button img {.. float: right;.. position: relative;.. vertical-align: top;.. padding: 4px;.. cursor: pointer;.. }.... #wa-installer .header .close .button {.. float: right;.. position: relative;.. top: 2px;..

C:\Program Files\McAfee\Temp2863637682\wa-install.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1222
Entropy (8bit):	5.1935835170409215
Encrypted:	false
SSDEEP:
MD5:	52675F42F15FEF49BD83972DFB0BF87A
SHA1:	4582F2C4B969F278E341B2291690817E042F9568
SHA-256:	97D5EBA4BCD228D7F99F1E132DA57AD12F1AEDFA8C883CFE89E3CFD2787B6429
SHA-512:	1AE4D696542E48D279342F8846488CC3D2E42094310F7DD9DDC6CA1A0BE14D1F8DA96CB3A9108B82DBED990C19204E4B12EF25BD2C222AF82435B2771B553A59
Malicious:	false
Reputation:	low
Preview:	.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=8" />.. <link type="text/css" rel="stylesheet" href="wacore:wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:wa-install.css" />.. <script type="text/javascript" src="wacore:jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-install-#loc#.js" charset="utf-8"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js" charset="utf-8"></script>.. <script type="text/javascript" src="wacore:wa-utils.js"></script>.. <script type="text/javascript" src="wacore:wa-core.js"></script>.. <script type="text/javascript" src="wacore:wa-ui-install.js"></script>..</head>..<body onselectstart="return false">.. <div id="wa-installer">.. <div class="header">.. </div>.. <div class="content">..

C:\Program Files\McAfee\Temp2863637682\wa-ui-install.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19389
Entropy (8bit):	3.84079067044455
Encrypted:	false
SSDEEP:
MD5:	013999C3E34A01093530CB57DFAA82AB
SHA1:	1A596422E65CF0D6E725432D90DE2FFC01BF0E83
SHA-256:	5F34A5F6E926F8A15029FC82B975123CBCEDC3E6C799CDBCFC8CF6EF7136A8AA
SHA-512:	25D8E78297EEC091E85C93E538A58A6A5A4633250C95564CB51DA15523A7FB9644AB3EBE0E541B9621C0D2FDC7E4CACBD6518FB439E7EEBC71DB8D015B8118AB
Malicious:	false
Reputation:	low
Preview:	/* Installer UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.INSTALL).get,.. _window = wa.Core.Window,.. _external = window.external;.... ui.Installer = function () {.. var buttonId = "wa-installer-button",.. _this = this,.. RC_INSTALL_ERROR = -1,.. RC_INSTALL_DOWNGRADE = -2,.... open = function () {.. _window.ready(function () {.. //check preconditions.. var productName = wa.Core.WebAdvisor.getProductName();.. if (!_external.CheckDoWeMeetOSRequirements()) {.. _external.SetInstallResult(RC_INSTALL_ERROR);.. _external.ShowMessageBox(_l("ERROR_TITLE_CANT_CONTINUE"),.. _l("ERROR_OS_REQUIREMENTS"));.. _instrument.log("Installer",

C:\Program Files\McAfee\Temp2863637682\wa-utils.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15448
Entropy (8bit):	4.445434608553055
Encrypted:	false
SSDEEP:
MD5:	D83DA2A43B7160E76863E4D73A390C68
SHA1:	0C93A9B7CD8290C536ACFB1C98B86B2DB5A15FB7
SHA-256:	5D47BA4710B8DE34145DF1732FDEE9A5E7EB016322AD50DA1CCF56A21BCA752F
SHA-512:	0ECAACEBD247AEBB320CC96199B24F40EBACA6B9704F877069A97D1233F47CCF9528B1DC71EE568FBFB90C7DA91149586DC67A73CCE3451B2C5B4BE3367A6107
Malicious:	false
Reputation:	low
Preview:	/* Utilities */..var _langResources_ = {.. checklist: (typeof _lrCheckList_ !== "undefined") && _lrCheckList_,.. options: (typeof _lrOptions_ !== "undefined") && _lrOptions_,.. shared: (typeof _lrShared_ !== "undefined") && _lrShared_,.. uninstall: (typeof _lrUninstall_ !== "undefined") && _lrUninstall_,.. sstoast: (typeof _lrSecureSearchToast_ !== "undefined") && _lrSecureSearchToast_,.. install: (typeof _lrInstall_ !== "undefined") && _lrInstall_,.. webboost: (typeof _lrWebBoost_ !== "undefined") && _lrWebBoost_,.. waiff: (typeof _lrExtensionInstall_ !== "undefined" && _lrExtensionInstall_),.. ut: (typeof _lrUpsellToast_ !== "undefined" && _lrUpsellToast_),.. overlay: (typeof _lrOverlay_ !== "undefined" && _lrOverlay_),.. newTabToast: (typeof _lrNewTabToast_ !== "undefined" && _lrNewTabToast_),.. ssToastVariants: (typeof _lrSSToastVariants_ !== "undefined" && _lrSSToastVariants_),.. pscoreToast: (typeof _pscoreToast_ !== "undefined" && _pscoreTo

C:\Program Files\McAfee\Temp2863637682\wa_install_check.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	558
Entropy (8bit):	7.494810764492959
Encrypted:	false
SSDEEP:
MD5:	F8AF1796D709A69C3FBDD16822596FD6
SHA1:	D216CB9A49EF4223138BE20D027B3ABEEFAC7DB0
SHA-256:	055E07F760351C3F33E708E4720D5A34A60ABD8D13F2FE05A473DFD5ED9714C2
SHA-512:	FBD9C93490B818798F4614E6EEA7EF9FA05D535F50071806E763CD9EBEE478559F614EAC90720E4B5F88D803DB0AD459F1D1C67954C2C379B1BB435CCA74390A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............H-.....gAMA......a.....IDAT(.u..k.Q....1&.k..T..bO.K...DP....I..{.PRA..............QA..J/....eM.tS..7..v...y.7.7.f..R?......W.......N.....G...z.N.a._.X=.sg.5..r.k....Z...R....[..X..W....N....v...H.1x......L......R..@:v.w.....W........v.lc/F..b .C\.:.[Q.`..E`.L.J..!....<..m.q....R.&...""%F(^M.`..e.,N..q..y<.../.O:.mP..,A.QrZ}[u0..,3...S.K.\.EM5.!mH......}N.+j....p.O.E.......[..C.\x......nMi...~%.vv...\|8...y.xV..v<ZZu.....y]@.1......]..).6.M.'.'.%o.T..5.Rq8..l..;...Ha......5......IEND.B`.

C:\Program Files\McAfee\Temp2863637682\wa_install_check2.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 14 x 14, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	785
Entropy (8bit):	6.380231936591206
Encrypted:	false
SSDEEP:
MD5:	5367B11C1B0484E2B64AFFF761DB5B69
SHA1:	CA05EC2A55FAB6A4035920C38B6FF198044DA594
SHA-256:	1CAE0E0663BA559CA8FE7AD3A1E07AB23AB9E3DBADA1AA572AD9C2C5D51D5627
SHA-512:	322DF7AFB16185EB4D39AA4881A27E04B1D310773FCFBB77D0F1C83237A56D100F6567091E30BF0DC6A11EA29A22A52BF091B66C5863823596108C155C031588
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............(.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE...#..$..%..$..#..#..$..$..$..#..$..#..%..%..$..#..#..#..#..#..$..#..#..$..$..$..$..$..#..#..$..$..$..$..$..$..$..$..$..#..$..$..$..$..$..$..$..#..$..%..$..$..$..#..$..$..%..$..#..$..$..#..$..$..$..$..$..$..$..$..$..$..#..#..$..$..%..$.....p~.S...NtRNS........................T....L..........K..T...S.....JJ...O....r)1N.T......L...P.....bKGDOnfAI....pHYs.................tIME........l.-....IDAT..-.g..`.F..o.PISC.[.........\|..s.@.Jr.PM.3.Ah.&....dI.01..t...v.K.h.o[?..^.....Gc.&..8....A..<..r5...QY.F..n.8..@=A.l.u.....n.C.....>.o.4...&!.KUd.&R$>.e*o..T....:...~g....%tEXtdate:create.2022-02-16T15:21:59+00:00h......%tEXtdate:modify.2022-02-16T15:21:59+00:00..x.....IEND.B`.

C:\Program Files\McAfee\Temp2863637682\wa_install_close.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	327
Entropy (8bit):	7.1140535970703365
Encrypted:	false
SSDEEP:
MD5:	C0708D1E58F1EF1BAB621620F3B09130
SHA1:	0BEB49A1CC1E71F364BCF42B474890F35CB8CC3A
SHA-256:	834380BD8B6F9BFEF000A555541AEC2BEC01DC46C91DCB7F950D109B81BAE5C2
SHA-512:	241C93BC2677B1F0788C2C0DDD9A7FFCCC7A865DAD427EA8C89E437FC796FD12F80D2A962A8D02B1B2391E10CFF768F17E34BD45502A0E31D6E1C8F443C2AA34
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............Vu\.....gAMA......a.....IDAT(...On.@........=J.&....5....8A..M]{..s......Q#0.7...0.......yr).q8..s....sp.....W.u.q+..;\|.5&..n{..{.............>..".^S......#q.6B...4.t....~e.[@B.&...L.o...h..8.......Q....+..b.i..MhxRaG....Y..F....,......G.E....`(....V.v.4.b.$..S.O.....Sh.B....IEND.B`.

C:\Program Files\McAfee\Temp2863637682\wa_install_close2.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.591404605834916
Encrypted:	false
SSDEEP:
MD5:	F79A1953A8E6CC342847B4B00DDBD736
SHA1:	9AC411CADB6652F4FDBD854300ADCB5C21C04BAA
SHA-256:	4F8EF204C1884F868866D03B4D11DF1237480C1CAA38ADEC1C13444050105B88
SHA-512:	DFB54D3D20FF53B867328945FE3D69B56055D5861EFCE2A069653B1792A5477AB4C3B73A3DEE82DD1377D1573099AB70C2F6C285C694DDBD0B1EE9667CFC4F2A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............Vu\.....pHYs.................sRGB.........gAMA......a.....IDATx.u.... .DW>...>.RRYJq>).>\|E...!..3...t...a.?..w.!.P..../l....2....Q..ZS.%'.........y^.Q..H.T.V.D..W]..t.*X4t#9O;......=U%u0...f.......3`...[.S^..m..$..?[...{4.Y....IEND.B`.

C:\Program Files\McAfee\Temp2863637682\wa_install_error.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	428
Entropy (8bit):	7.367179920202989
Encrypted:	false
SSDEEP:
MD5:	0EF65600F5A2D01876B6F9EC668C9D2E
SHA1:	31F378D2D6BE62F3A426523B1AA3D61323B2B9AA
SHA-256:	17DC5C3BAA1D35CA60C7DEE7CC70B76446765769960FC5D4852E065478C871C4
SHA-512:	7D9EC74CECF8DF49D4F8E676053573798A029D889E8676CFE90891EB68E49A2FE9AE828F38BB99851888B25A76581EBE2B62694D3C66D193016B4446004A9271
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............H-.....gAMA......a....cIDAT(.uR.J.A..f..&Q..*....h..... ...(.........K...!Vib...B...qf..{.9....\|..3C............@..........5..8.b...z`-....s.ID..G....PEQ.;?1...p.h;..z6Z..4.X..c..$E3s.b..ry.\|..yVy...0.Rr..W..S.......A.1.....s./".j..g.H{l...Q....d................fE..;..'+.).j.F...J......~.s..Y./...6.v....\|......,...m..[m....n......D.E.OvU.n..W<.m..=h#.O..Zm.yj..@.tums.....IEND.B`.

C:\Program Files\McAfee\Temp2863637682\wa_logo.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 233 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5361
Entropy (8bit):	7.956335361585333
Encrypted:	false
SSDEEP:
MD5:	0D8F8EFEB474FC9B2C825D7F2A875471
SHA1:	ADBC30FD0131A01B3150753C7EBFD6EF648F0DE1
SHA-256:	ACC40FDA844EADDF65B9580C484F1FE2E17358B352D99BABC6865BF0C74D9B00
SHA-512:	90FEBC4B2165D37CBB1CF09295CF2F5B5713DD14A02CDC101318426CEB55D35B7C47B254D0F20CCB8297FC69EE77EAA5969FF98A0965D325C94AD81B6A56BA9E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............9B....gAMA......a.....IDATx...xTE....I .D..l,....(....Q.\..ftf...qA..D...?a..o.#.8..<.9:....A..."......KB...?7...M:......}7U..9..N.s.T..hZ"%$..@B...$$..@B...4!.UYY.E].Ln.%Qu.K.8....Z+I..m...m%v.6...K..]ki....W.}.y.%.O.1"dY..5...{...x.ef.X.~a..3K.u.l^.8'..?.z#%.._.}.yT..Z..k..b..3{.{.>W_.,x,J......LM.T.>.x.....^..c.'...8^..(]...z(..._.......&..w..9..)..W.,s1.>.):.0.4.Y...nq...7....;......7)Xk.a...O...g.l...c.^..)8.%.e...h....U..7.O.'$.....]K.r0.Y5u..K....tH?.NSzwl.o..IG6...........X.(.z-.X....ju.+.Jpd.j......t.>...../?TW.0u..7........@B.. ....yYZ.iZ..:s...}_X2.O.....1kJ..3..9+... ].4.Y.2.....r>hM....}..-..\|!d..i#U...F...Dr...5....D[..]..u._u....[.>.{5.xX...t.\|L........}?........J.H?P.....M.n....-.......d......pQ....3..[...;vT.dg....5.@..0...[.c..1...U....i........a...o..[.PB.....E..^......."\|........$..."V....tZ..`W...[...z.1..[~.Buu.[.........]/..x.(.`Z.A....`p...]RR.4u'u.]..u'...p..[sh..w.....g+

C:\Program Files\McAfee\Temp2863637682\wa_logo2.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	PNG image data, 232 x 23, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2938
Entropy (8bit):	7.909981061900822
Encrypted:	false
SSDEEP:
MD5:	65938FC9439B2307513A95D515BCA1F7
SHA1:	DDDFE8D64ED371E973C46B6726B60BB0C0810BF9
SHA-256:	B2703E2E2A404B90EDAB7A67B23037C32BE2780F20CB15FFA6F6E44666B8EFB5
SHA-512:	93F755F5E208CA08955684D7789F6B8AF49F542DD41AFD9D678EC417CB535734C9C8182B87EC2EA8B8AA9FA502AC8BA90E383A9977F7E01BFF393AF0D1F400BA
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............m......pHYs.................sRGB.........gAMA......a.....IDATx..\]R...o.T.yZ.'.8..y..f_"N.8.....`N.r... '.y...>,{..'.}....n..%[..!U.)..\|.t...G..O?.. .~....@.N...a;..e.....1}.?....>.Ma...>.?..u.}L...m.N. ..8.>fe.z..dr..u.D.1.R<.....T..J.......\.ZP..V}....M?...2..3.....)...T.yG.4...kO....t......b5...-....4F].q%c...-....v.2...O....g0...g.&R.2.n..<?P.q9.....+l3...X&T;...z."L).12..D..a.G3..OQ.Y....%..P.=.....2....%u.}4.(..N.!.)t....w...M.@.0.pt.a%..N...\|.\|\f+H.Rk.?..G..v.q.7.5.'..F}.....lm....rS[.4..F2..R.-..V......AU....!./.\S;...M/..K`..w...>.f'm..bf..y>..$D@......1....3.>...Cn!.:.........C..-.PE14....$&}..?..I...._2.m.<....L.<.........92.p......jT....%.~..Q.U...6.4/.U..4L+HK.\i.z...Au.@>Z..Y.....kk...pQ..!....\|..1g8...Uc$.....Y......9.....`0t..p..(...R.N....w`......\...<......M....-.95.f..W;xx>.7"..'..._z.REq.=e2..bg.S..r..VKcI.j.....\.O..T...q.>....H..6AE...{'?.....w.X.J...w.d.......O%..-%...1*.53..NPB.O.[M./.:..

C:\Program Files\McAfee\Temp2863637682\wataskmanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 2942853 bytes, 3 files, at 0x44 +A "\microsoftedgewebview2setup.exe" +A "\wataskmanager.dll", flags 0x4, number 1, extra bytes 20 in head, 170 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2964853
Entropy (8bit):	7.999835391713119
Encrypted:	true
SSDEEP:
MD5:	A9120CBCA8A683E101E61BD787A3355B
SHA1:	E0D8376ED24F95110CDB08E3A075243F25ACE126
SHA-256:	AD79E799C810DF7822C525E0091FFBB82C195D48715E51C41FE7216851373598
SHA-512:	4FA6D8DB590CE8319F6735D9A84AF00C529BF019A1084B5FBF6D02C7C0AA13ADB2C835E17E792EF41A3AE31743D03D4D16BBC080B4E1E704A7280D145633F0D9
Malicious:	true
Reputation:	low
Preview:	MSCF......,.....D.............................,..U.................. ?........SW.^ .\microsoftedgewebview2setup.exe.X.9. ?....SW._ .\wataskmanager.dll.Q...x.T...SW._ .\wataskmanager.manifest......I..[........."S`$..........XY.....$.$B9f.....0`..u$..V..w..g;`.......l.........d<.......@H..E..F..h....m.l.m...sy;3...r.....g....~.....ml..<hm.......@y.`7m66..-Vp...[Xm......b..`...Zq..7...f.....71K4..\......#.TD.U.E.{{..f..]...BeD0 d"...t@@..A....pr....B0"`Qy.rS..>a.5..@..u...n...D....7..W+=.W.h.~.[?..SQ}o..I4.........vQo..w.K.O.Uj./......Q.?....T.^...l..'P........>.1....-....../...~....y=.~e....c...nVX./..U....4.o....T..O.....;..R..!..`.{l.....Cr.?.7:.Q.....+5.....>Z...,j.\|.....-..L..+0.<L}..Ecc...V9s.kq..u.8.KUb...7.w..l..d?..`....K..+Kc.h.=F...~...\...\F.....j3.<.g..r.4.\zO..v.-..;..:.\..wdH&....AU...z.....0W\ X.'5W.J`>...z.......}..dr.."...V....H.EI..[.A`.$[.fS ...z...^.Ez.....9..h..'.....6../.ut..(.c....0.b*.....'.dz0.!.`.....F~Z.....y.

C:\Program Files\McAfee\Temp2863637682\webadvisor.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, single, 1209 bytes, 1 file, at 0x44 +A "\webadvisor.manifest", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1503 compression
Category:	dropped
Size (bytes):	23209
Entropy (8bit):	7.660058320276064
Encrypted:	false
SSDEEP:
MD5:	F3C3AC8816B1DC7C05278A3E891A24E3
SHA1:	C39A727DEF7B1527A0F58000F5EF56865AB2A4F5
SHA-256:	FE007A4744205AA6E37BB57F09573DE20AC86E1DD0FC42C895DD31EE19317958
SHA-512:	241E4B5308CA6230D9BD010AC9CC06F384F47355F178622EC4FDE01A764980E3108EEE602C6862F46E93309A0EE1DA1EF099B586A41350A9615C4E2BE6C87AA8
Malicious:	false
Reputation:	low
Preview:	MSCF............D................................U..........i.................SW._ .\webadvisor.manifest.:..SH...[......K..3.%C...v@...N%.... P.../\..f....m_.S/.n..)..p..@............m.m.w.7./\|..g....>w.....;.0.FoFp.6j$3c5..!W..............T2...e[.=..2E.M..t4MC.8.....:..fdx..V.j...z:u.t.J...h5....l..2.u,.`0..j....^...w...U..r...*..n.}.S...J......B.....w%o.CT...a&.FjG.9.a.....9.G..."...\..j2.s..L..0......F1D.S/.n...^<.x..5V.........QeFh...loZ6..K....E4.......Z.X.`..@...o...}.....X.. .....l....vv..>\......a;..".....k......G.0..n".P.. 5C..Qw.5{...N......1.8...tOw=./@G....L......n....0.l.U[Y%Z.`...7.i.>.Z.e8j.].A.z..Z.a.=...Zp......:.h......bS.&.-......e....w..%..v,.=.U.X..@...Lb..n.'...o.+.\|...F;:..jJ.(....-.....&.{\|;..\|...Ly..jZ.E..;7.....H[....vF.>........;.(..[].c.s..:......<...+.cQ!.sY......t.1....z_...h..;.5vX..o................~......& ..Up..`.(......C.$..+u..5...OxqIT...f....t..1.i...0;.......C`.1......pj...n../8.(C.y]._H0Bf..C.G@.xt...

C:\Program Files\McAfee\Temp2863637682\webadvisor.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	MS Windows icon resource - 11 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	99892
Entropy (8bit):	3.9749743269785345
Encrypted:	false
SSDEEP:
MD5:	236FC5ABB597615A608DAB7BE98D5FBC
SHA1:	18D3D1CF56898B264A24DE24DC13E4B9B7EED768
SHA-256:	06ADAB20CB028B5DC61762691E8C8A6157EB1199526F7C773338B9BF51BD63C6
SHA-512:	155766AA5659BB9E298AEDE4064832168002EEDEE836710C2259446FC35437AD70C04454DEF2D9EB40A83A029351EA1726D65ACBDB8FE8217C016FD4986F7F4E
Malicious:	false
Reputation:	low
Preview:	......00......h....... ......................(.......00.............. ......................h...~"........ .n....'........ .(...TC..00.... ..%..\|K.. .... .....$q........ .h......(...0...`...........................................................................................................p......................9Yx...................yyy9Y..................yyY.yy57...............s.....y.yy.............y9Y9Y5..9y.w.............9yyy.....................y.9qy....yy5............yyy.yqy.y.Y9yp...........y.xy....9yyY5....yY9.y.9.......yq....p....9yyqqyp......y.yy5.p...YyY9..p.......yy9Y.Y.........p..............p...Yyy.p...............p...99Yw............y9S.0...................yy..p....yY8............yyS.p...y9y.............y1......y.Y8............yYy.p...................y9yyp...................yyY.p...yyy.............y9yq....9Y.w............yyY9p...................y9yYp...................yyY9p...................y9q.....................yyYyp.......................p.............P.....

C:\Program Files\McAfee\Temp2863637682\wssdep.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 581039 bytes, 3 files, at 0x44 +A "\wssdep.manifest" +A "\win32\wssdep.dll", flags 0x4, number 1, extra bytes 20 in head, 46 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	603039
Entropy (8bit):	7.998659373142574
Encrypted:	true
SSDEEP:
MD5:	24080993552AFF33FD59C7C8D23DD3F8
SHA1:	EEC0A5CFFC8FC701D6338A67B6B1968843DDDBE3
SHA-256:	922F51C14ADD9EDDEB7A1B86F82C269DE96AE7E1F3D3626D632D611AD2771C59
SHA-512:	A36B0F8B38CC25420A67A5BCE55FF0962FEAAFFA4FEA259EA027DC91714A1D24E26DE3C3C6197E418A72D77E5A0A4C6D5CA3563928683E6E35A19B93180BDE55
Malicious:	true
Reputation:	low
Preview:	MSCF............D................................U............................SW._ .\wssdep.manifest...........BV.h .\win32\wssdep.dll......$....BV.h .\x64\wssdep.dll...q.<..[...4. ..."C`3..[....]..4.....F-.Ck..j...F$`Y.AHe.5G...C..O.;..w.......%.e.D..2HHF5..1..jg.Sf6".p.....}T?.y_.w..\|...8.:.u.s....o..;.d.....r%.}...K...;..%R...o..-..f..B(....(Y......IC......E.d-i..'$.....!......".3?+.....y.}..z.5..Yko..Y..e#.#.....B....p..H.....x. b.......q...?.....'t.Lb..A.z$..>}S.3..iu.L.$..h.?...].;...%.Qy..}.d%6.=K.T.S..F....?.Qi/=...^l...4..h..z..ZE......Z.-F\T.T.[f.%.P.[...v.W..n[..X....[.zl.H. :.H..]=........o...\|...s...@...D$.t..o.S...=..PK.....7...}.f6.L..nm..r..J.y.....U2..wr..t.C%..{.Z.V.8..U.b.ku...7I\..V.".[Q.OvFQ.K].9..&]t.i.7..^.-..O.d]3.p.WD7 ./..DjO.]......[..(..F.d..Z..N?.u.a...=;i..j&)Ev.l............N\|........[KK..UuR...^.0i..i..H/.....Z.H.J..f=.e.Ka../Zk..!1W....f..V.s.......0..-uZ')i...2.f0.IJJJSi.#7J..^...3rfz...6.F.r..z._..x...M

C:\ProgramData\AVG\Antivirus\gaming_mode\dnddetection.dat.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	data
Category:	dropped
Size (bytes):	555659
Entropy (8bit):	7.999646181497576
Encrypted:	true
SSDEEP:
MD5:	0BD42763975DC54AD5EFDCD321C750CB
SHA1:	24202455A58C7CED31240A90603C6489728BBFCE
SHA-256:	4845A0D7B287399933536C12AD5549FA4F4D49F42500C7311DC2C3C108480A7C
SHA-512:	9204678DDEF894657C0F6BD5451294E104FFDEA90DAE12FC3F642547DEBB80435B0CC9D08680F50482BC1236DAF5AE1CD79C322EADCDE7765E9E251231753E79
Malicious:	true
Reputation:	low
Preview:	]....a.;..=........y...>D.M..7.......4S.........l.+1.1..l]\|N...7...fx.).N.D.5.F.w......'..Af.>[.u\v........t..E..&.6.u...0...,.V@aI..w.......N`.........N"....c.ZLO.Q.3.>/.g.Xy9.a>..u.SY....c.(...3).j.w..U..G=.vX..C.;v...0.88.._3.......0)dZ...f..x....A#vWF4I.'.....Gk..!.......5.;..q.Dl.MJ..?.....^..;Ds<e...........)&+.."..N....y.....C.".)....C.C.w.Y3. ,.%1Z.J... .wi..S....I.vt\w.:....oN.K.e.\.........~...V)7....Z'.....}..-.,..).i..K..fp../.e.E.........@.~v....#..5...I6$.UJ.T...z.....tv...R...TN.(....q.M...F../G.o....R...(~.....y(....GT.{............qT*.^..6k.{. .F...U..{K1.....>...t.f.^F..x.L.........o.p.#o?.M..6..c5...x.<.u.B&.V.7...Qd$..I.{.6......cD..K..Z-.....A6..v..m.e<....p...a....L.8.A...S....P..].~}=.:T/XX....DcC_%...'.s.:...2.:...?.I..)....Ak...9...9..o5&..K[...`.T:r..5Ubm..u0$.M\A.\....G&..l..,j..g'.2.~.....af...6]xZ..{..B...9.f6.3E....o..O..W./7.+.`7...Q.).R....d..:......b....0..y.y..-..uis.!..J@By.v?..0.....1.aQ..'.$%&'.+...t

C:\ProgramData\AVG\Antivirus\gaming_mode\dnddetection.dat.ver.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	9BF31C7FF062936A96D3C8BD1F8F2FF3
SHA1:	F1ABD670358E036C31296E66B3B66C382AC00812
SHA-256:	E629FA6598D732768F7C726B4B621285F9C3B85303900AA912017DB7617D8BDB
SHA-512:	9A6398CFFC55ADE35B39F1E41CF46C7C491744961853FF9571D09ABB55A78976F72C34CD7A8787674EFA1C226EAA2494DBD0A133169C9E4E2369A7D2D02DE31A
Malicious:	false
Reputation:	low
Preview:	15

C:\ProgramData\AVG\Antivirus\gaming_mode\dndrules.dat.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	data
Category:	dropped
Size (bytes):	1250
Entropy (8bit):	7.812941980767714
Encrypted:	false
SSDEEP:
MD5:	1527C1FD5DA898C3BDB68B8A105937A4
SHA1:	D0F9FD4A698F91F54F78DD2043C1349A7E4AE7F3
SHA-256:	C269C9E66B2ACDACE62E8AB631F39C24801C4644193BB3934A8DEA3C43F669DF
SHA-512:	D574498392A55B47DC81276D63A33E9870232E77F60AC0D78C9BD29E3D419D015A19241E86A7963191643F6C0D0FD2DB613CA5290D559C3801358A60FD5CD27B
Malicious:	false
Reputation:	low
Preview:	]....&....=.=@P...m^<.`..`..>g)'_...!.......3/.....E^.".9?!..D....b..P....v.:h.hG..Ik....WT.F....b.1.....7...h........$.E..... = ..a...#.:.....[.fo:.oN..3Hv.o...]{...mz&."..n...S.S......K@...C...dPyi.\|....UP..aQ..U&7O.z6_)...7.B.v.V.i....M(.....0F...1..#Oj..GN....r.."...B......H6:Sn.k...#.....S...g.$....F.+`..o`.c:.3... ..CN.D..@.gr7.\....$....h.Ko6....`....$....Da^$...)..d.M.......l.......E..O....i.."..=2.....V\|.#C#.......3........n.........?...eD...2.....9..D..P#..K...o.!....-....E..OC..........V-d..b..Z.}C..%...+.$..i........Tg..8......%..#M.6.k......8.b.)....D......b...$n.V<3.o.19...iD..GS&.....Q..... 6...jJ...2c..(.\...U57&!..MM..P.{c.b.R..%d....%k.....F.5....6.w.0<.1'$q..H.Z'...Z..2....<..,.n...........[..E.....o..H.S.F..DW2g[..3n....e.j....r6.....#gZ..&.7..S5..?...sS..xp]..j..M>....h./(...S...q....L.....g8.'\h...Z......C.i5...Y.EI.......U...*U.J...I.>......2.a..1'K4d>C...w..Ie....f..i;.A...[].....p..[..C.5..V..+.E0....3..

C:\ProgramData\AVG\Antivirus\gaming_mode\dndrules.dat.ver.ipending.0699c975

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\ProgramData\AVG\Icarus\avg-av\icarus.ini

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.990202766082142
Encrypted:	false
SSDEEP:
MD5:	C043A3BEB23CC43CB3E9ACAE2AD9D8B4
SHA1:	F8A300A14643D9D2EF708839D882FA8FAE274F73
SHA-256:	3DF024F72A0BCDD90A7C140591E224492481EB7F32A940BFB9AF1CDB6472AF9E
SHA-512:	E5BAA81E296B7F06360ED20D9484A137CA49C0505D2C94947B978B09B277F13184E540098E21DAAD0A72D8DDD831A57D6AC0E67C0AA860D87A051B55C3C9FFF2
Malicious:	false
Reputation:	low
Preview:	...[avg-av]..company-install-path=C:\Program Files\AVG..company-reg-key=SOFTWARE\AVG..product-dir=Antivirus..product-reg-key=Antivirus..program-data-dir=Antivirus..

C:\ProgramData\AVG\Icarus\settings\proxy.ini

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	214
Entropy (8bit):	3.4031996566857923
Encrypted:	false
SSDEEP:
MD5:	D6DE6577F75A4499FE64BE2006979AE5
SHA1:	0C83A2008FA28A97EB4B01D98AEAB90A2E4C8E69
SHA-256:	87D882D37F63429088955A59B126F0D44FA728CE60142478004381A3604C9EA9
SHA-512:	CB4B42C07AA2DA7857106C92BC6860A29D8A92F00E34F0DF54F68C17945982BC01475C83B1A1079543404BB49342FC7CDC41D2AC32D71332439CEB27B5AD1C0C
Malicious:	false
Reputation:	low
Preview:	......[.P.r.o.x.y.S.e.t.t.i.n.g.s.].....A.u.t.h.o.r.i.z.a.t.i.o.n.=.0.....F.a.l.l.b.a.c.k.=.1.....P.o.r.t.=.8.0.8.0.....P.r.o.x.y.N.a.m.e.=.....P.r.o.x.y.T.y.p.e.=.0.....U.s.e.r.N.a.m.e.=.....U.s.e.r.P.a.s.s.=.....

C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00020052003E001D.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.001223265242884
Encrypted:	false
SSDEEP:
MD5:	1AB1D79D2BC42F5D72BD4CC8FC1BB2E5
SHA1:	5A771DA16C5014431A84236B18EDE40A7EF1AB3D
SHA-256:	901BFBB245997FB5FC3549D0B160CB58EC054FBF614F4077795040370C9AF5AE
SHA-512:	A3CCC5577B41FD01D33CE7075C16E0277D898C4A8D16DBA37874838A6AC45EAFA6531035F4677373D9B6F3C61C8FF28F31D7C115B0D21716103F154FFE00BEE7
Malicious:	false
Reputation:	low
Preview:	[ERR][20231115 09:52:50.215][ProcessUtils.cpp@185]: Failed to open process with id 6524. Error 0..[ERR][20231115 09:53:02.064][HttpsDownloadFile.cpp@200]: Unable to open HTTP transaction..

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.676048742462893
Encrypted:	false
SSDEEP:
MD5:	E94FB54871208C00DF70F708AC47085B
SHA1:	4EFC31460C619ECAE59C1BCE2C008036D94C84B8
SHA-256:	7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
SHA-512:	2E15B76E16264ABB9F5EF417752A1CBB75F29C11F96AC7D73793172BD0864DB65F2D2B7BE0F16BBBE686068F0C368815525F1E39DB5A0D6CA3AB18BE6923B898
Malicious:	false
Reputation:	low
Preview:	0..r0..Z.......vS..uFH....JH:N.0....H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...200318000000Z..450318000000Z0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450.."0....H.............0.........-.0.z.=.r.:K..a....g.7..~.....C..E..cW]....%..h.K..K.J...j..a'..D...?".O.....(..].Y.......,.3$.P:A..{.M.X8.........,..C...t...{.3..Yk....Z.{..U......L...u.o.a.tD....t..h.l&>.......0....\|U..p\$x %.gg...N4.kp..8...........;.gC....t./.....7=gl.E\.a.A.....w.FGs.....+....X.W..Z..%....r=....;D.&.........E.......Bng~B.qb...`.d....!N+.mh...tsg1z...yn\|..~FoM..+."D...7..aW...$..1s..5WG~.:E.-.Q.....7.e...k.w....?.0.o1..@........PvtY..m.2...~...u..J.,....+B..j6..L.............:.c...$d.......B0@0...U...........0...U.......0....0...U.........F...x9...C.VP..;0...*.H.............^+.t.4D_vH(@....n..%.{...=..v...0 ..`.....x.+.2..$.RR......9n....CA}..[.]...&..tr&....=;jR.<../.{.3.E.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe
File Type:	data
Category:	modified
Size (bytes):	264
Entropy (8bit):	3.0961158341916697
Encrypted:	false
SSDEEP:
MD5:	7F5E4A755C1CE604CAC482A498D94DB0
SHA1:	5692EE8D4C4724F537B3EDE717573BE4576AF28D
SHA-256:	F6E04FB9ACC5F322BBEB840CB88D5180E0856C7538100132FB4FF03F7D4597AA
SHA-512:	734FC7D06F9F144955D7CA120EF2CCAE34C108190588ABE6585E6BA9AEB3EFC90DBB6A65367425BEED0C25AB50B53F7D0BF5F86A41E34984E11D61FE91ACD83E
Malicious:	false
Reputation:	low
Preview:	p...... ....v..../.\|....(....................................................... .................(.............v...h.t.t.p.:././.s.e.c.u.r.e...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.a.c.e.r.t./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5...c.r.t...".6.2.f.a.3.3.e.5.-.5.7.6."...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6358C710-B89F-46B9-93F2-F6CAC44F5286

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	data
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	3.8884161333434353
Encrypted:	false
SSDEEP:
MD5:	598E5434103CDE770C8EF44D580CFD3A
SHA1:	F03FB862E0D1E93E5DD75E196405E2F8A8DF7D9B
SHA-256:	B32CCABC942182661FE507167F6F417F83F07B8A1BB996D9E97F5DCC8A6624F8
SHA-512:	C60F69E1326341806CAFA53092E1C2D22F6FB1F78EAB3C3AB42BA6A12538BFA39CED2465A0045F8C722981754366ED95432355A907F8104CF4A1B0AEAF087B05
Malicious:	false
Reputation:	low
Preview:	A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.F.i./.I./.i.m.N.K.E.e.O.q.F.n.Q.Q.g.O.T.W.w.Q.A.A.A.A.C.A.A.A.A.A.A.A.Q.Z.g.A.A.A.A.E.A.A.C.A.A.A.A.A.R.t.s.o.e.q.F.Y.Q.n.9.v.o.O.M.Q.1.F.Y.c.q.8.+.p.S.U.F.2.e./.B.3.H.S.5.p.f.N.V.Y.r.e.g.A.A.A.A.A.O.g.A.A.A.A.A.I.A.A.C.A.A.A.A.D.p.f.n.2.6.j.y.H.q.v.f.0.W.Y.X.r.a.n.Z.V.9.Y.8.Q.Z.j.G.b.r.L.G.S.I.J.7.o./.b.q.y.k.U.P.A.A.A.A.B.L.0.0.4.U.7.N.w.H.G.i.m.y.n.b.f.p.d.F.q.t.O.7.t.X.K.Y./.+.I.t.8.A.g.I.v.N.z.W.A.R.y.9.z.G.w.o.D.O.S.n.E.1.4.0.B.T.P.U./.L.F.C.C.g.y.o.q.A.s.J.R.4.3.P.r.C.Q.x.4.3.N.U.p.r.F.8.c.x.R.a.L.q.8.R.x.6.T.R.F.L.t.m.S.O.z.r.1.a.j.n.7.D.Z.R.O.j.w.3.H.v.b.B.x.x.P.O.i.N.5.G.9.W.y.w.M.e.b.l.u.P.q.m.J.5.L.6.6.v.w.L.M.y.X.R.t.E.5.V.J.+.o.6.X.f.h.X.s.e.z.m.3.B.z.z.G.0.4.Y.I.I.u.7.6.h.G.M.L.j.9.R.A.q.3.i.L.Y.X.Y.K.I.6.I.D.x.N.p.2.R.Z.B./.h.O.B.C.z.P.B.z.X.n.+.z.s.+.V.Y.E.9.o.p.U.9.t./.x.G.m.L.v.3.6.s.l.L.C.4.8.Y.e.m.w.3.l.C.T.l.C.f.C.Q.F.q.e.1.b.x.1.H.9.B.C.P.W.x.7.b.S.j.J.d.I.r.t.m.Q.Y.b.t.B.e.r.A.Y.v.M.h.X.2.0.3.I.M.1.

C:\Users\user\AppData\Local\Temp\7zS03140D36\postSigningData

Download File

Process:	C:\Users\user\Downloads\mozilla-firefox.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	249
Entropy (8bit):	4.459801270300294
Encrypted:	false
SSDEEP:
MD5:	005F1777D0861CBD64BD38E14729B6DE
SHA1:	BFC3878265A157297BE4E7A0AB7DB76973A89D6C
SHA-256:	F42504379A353FC779B0DC7D552539A0219A4C17949824D1F352F84232EAC537
SHA-512:	0815A984E412DDADF18F32895364881A65EB1321C243DFE5E0B3E4F36479A692D15CCF8F85A4713100CBAE900E7C05BACA2868A752651BEC0562DEC22F762FBF
Malicious:	false
Reputation:	low
Preview:	campaign%3D%2528not%2Bset%2529%26content%3D%2528not%2Bset%2529%26dltoken%3D1951e78d-224a-4b85-892b-94732047a07e%26experiment%3D%2528not%2Bset%2529%26medium%3D%2528direct%2529%26source%3D%2528other%2529%26ua%3Dchrome%26variation%3D%2528not%2Bset%2529

C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe

Download File

Process:	C:\Users\user\Downloads\mozilla-firefox.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	564568
Entropy (8bit):	6.220077478293055
Encrypted:	false
SSDEEP:
MD5:	A30EDC877E77C0A5CE37D5F93BC949DE
SHA1:	11FD6A5E1DEA454383F0409FBBE7C737C744B46B
SHA-256:	1181FC18201AD36CEAAE8E6626DE2AFF0DAB767B8BA725FE143E87BABF55EF9A
SHA-512:	72CA5FCDF65EBA9B8213EEDF82C93189C48BA265C0010EFFD0E35AAA6741FFE00501F8543EE0BF8B59378CC561CD7CA769D64524B2F64A48954B1C9A8009FB14
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...P..`.................h...........4............@..................................1....@.......................................... ...............s...)...........................................................................................text....g.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata.......`...........................rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS03140D36\zoneIdProvenanceData

Download File

Process:	C:\Users\user\Downloads\mozilla-firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.425304011613241
Encrypted:	false
SSDEEP:
MD5:	34B403D885EA677D9CF4D8C7F03058C3
SHA1:	254A416F6638D97BF968C2039784DBF89D90F58B
SHA-256:	046FADFBB74543D84BF5557FE7D7C11CD954014A0EA12E1C7034EE09865989D2
SHA-512:	AA9F9711B9474EB79D24CC8C4B3D0DC78DB6B41D8F8A98A805325C1F66D5258C06CA8C7562B28BCA4EB0FE665C4CE13EDCDBD6FDF11A3848ADC25AC064B78713
Malicious:	false
Reputation:	low
Preview:	[Mozilla].fileSystem=NTFS.readZoneIdError=openFile.readZoneIdErrorCode=2.

C:\Users\user\AppData\Local\Temp\D566D7D7-DCD6-471C-8109-BE0AD33199E3

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	2.7458646483360876
Encrypted:	false
SSDEEP:
MD5:	CDE3508ADFB1C2084EF9793486E614F3
SHA1:	BDAD15E3BE8207E51A8A13476CC8C1C65F37B0A2
SHA-256:	EC280D9D5F9EC1B577B6E6E7F7EB9370A196C2E41BC701EEFFFE464DF76EC758
SHA-512:	591192E677F169A2482CFC5A5EC0BFA79E757FBD62D7FD9EB2AA604EE1105F9F7ED9F177FF371AD08C386B332FEDEDE9562FD7E8268EA389B56C5FA2CB29D948
Malicious:	false
Reputation:	low
Preview:	1.7.1.F.0.A.7.B.F.2.F.0.5.2.D.7.8.E.F.3.0.E.3.5.0.8.F.F.B.C.3.7.

C:\Users\user\AppData\Local\Temp\F07D8C6A-04B6-4025-869C-70A788D7B5C0

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	2.73921454253253
Encrypted:	false
SSDEEP:
MD5:	A213E0BB1F9A09CCD2DAD206565E1361
SHA1:	DA165B99587F43BA694689453BFEAC7EE5B75B92
SHA-256:	F8202CAC4F2DA5AFEA5046C6E5703241F5719153CFA0163419C8145CCD6D8559
SHA-512:	2C355CE42213FE7ADA45315808070EDB13D46A74231D81EA56B679627434D1827B51776B7F4D9BB8CF6DD97D7390CA8E1C627CED5608EA6D048A901AA295F213
Malicious:	false
Reputation:	low
Preview:	1.2.2.1.6.c.7.1.-.2.7.3.7.-.4.5.4.0.-.a.0.2.c.-.a.6.a.7.0.f.c.6.5.2.5.4.

C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\file_qK5-VP1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3199488
Entropy (8bit):	6.325068577097297
Encrypted:	false
SSDEEP:
MD5:	1968CA694D9B1FB54EDF2A8380F1E0FE
SHA1:	85A5F52639167E7FEACF20146EEE51B725DC66FA
SHA-256:	43D461412CDCF836D6304848DD621B541193B0021AA29385DA4E0C50DC84DF46
SHA-512:	2C2AC03D73CC499D8B13300B29596E0D0175C927B5F3DB47E5BAB59FFEFDDDB069AF0DF2B8574864657B297DAD93D594317E99E8763C505929EF481CBE0A1F9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\is-EOSUU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-616IK.tmp\mozilla-firefox_qK5-VP1.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2541680
Entropy (8bit):	7.670383335074764
Encrypted:	false
SSDEEP:
MD5:	F709593FF1FB625B1D073724961F0956
SHA1:	90DDD0F3E846AD6C858A264578AB5055412ED5FD
SHA-256:	EDDE07449DFE986670DD3F7DE55293E2A3AE2509F8C118791D419B6139E59876
SHA-512:	C0F70072E1C8FCA793CD4876EA83952DBBD9E953B99C6D1621070A5DCCB8B3D30CB3C9B69F577C4CA77A1E77F7E672F3E54CFF525F017A3C4BC284D00CD0DF1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@.................................h.'...@......@...................@....... .......p..............x.&..-...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\Helper.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2058752
Entropy (8bit):	6.610135572277166
Encrypted:	false
SSDEEP:
MD5:	4EB0347E66FA465F602E52C03E5C0B4B
SHA1:	FDFEDB72614D10766565B7F12AB87F1FDCA3EA81
SHA-256:	C73E53CBB7B98FEAFE27CC7DE8FDAD51DF438E2235E91891461C5123888F73CC
SHA-512:	4C909A451059628119F92B2F0C8BCD67B31F63B57D5339B6CE8FD930BE5C9BAF261339FDD9DA820321BE497DF8889CE7594B7BFAADBAA43C694156651BF6C1FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........-..~..~..~.....~.....~....~......~.....~....~..~..~.....~.....~......~q....~q....~q.w~..~..~..~q....~Rich..~........................PE..L......b...........!.....d...J............................................................@......................... ..........T........A..........................4...p...............................@............................................text....c.......d.................. ..`.rdata..&I.......J...h..............@..@.data............Z..................@....rsrc....A.......B..................@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\botva2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	6.216405702855349
Encrypted:	false
SSDEEP:
MD5:	67965A5957A61867D661F05AE1F4773E
SHA1:	F14C0A4F154DC685BB7C65B2D804A02A0FB2360D
SHA-256:	450B9B0BA25BF068AFBC2B23D252585A19E282939BF38326384EA9112DFD0105
SHA-512:	C6942818B9026DC5DB2D62999D32CF99FE7289F79A28B8345AF17ACF9D13B2229A5E917A48FF1F6D59715BDBCB00C1625E0302ABCFE10CA7E0475762E0A3F41B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................r........................@.................................................................................................................................................................................................CODE.....p.......r.................. ..`DATA.................v..............@...BSS..................x...................idata...............x..............@....edata..............................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\error.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2422
Entropy (8bit):	7.8500590324389306
Encrypted:	false
SSDEEP:
MD5:	EA1797CF79BEA7C5D9946434EDAF980E
SHA1:	C340043CB4C147E31C79E94DDD699341AC303E4C
SHA-256:	9E1DB37C2E72427064DB09F39C1908053DCCCB7385312D63D2F6E80BA8820AED
SHA-512:	2955BD434F149150AEF0F3F87F9AFE5CEC08E60FE665F163E22539AFE00193B9D6F6DE3F511F3B6E80C7F39692EB3EE3BE878B96CA03B5F0EC2E03A425064B99
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@...@......iq.....pHYs..........+.....(IDATx..mlS.........$.$q.`+B(...mHPM.C)mi.U0.....l#...c.....D..V.(l.P..JUHE...e../.K...qmb...s.!N.H.$..$.x..9.....9..s.s..1...w....<.\|.....a....0..:.. D....8.......W.^__.n]..v....h-...G.....c+..KA...2$...Z!I.6[].........j...Z....}.b...b..{:..5.P,....J.... 1..../.....;..........+%8...c...........{VkuRcc...2..cW....`.... ...q.H..W...{.3.V..\.5...B...\f&.......,W.P....F.y.0.P.....v.4..4...&$.\|.c...#M9.@<....6.....?....4.0M8....L.:....R...[..../..\|....Q.....L.....n..hM"..f2..Oxc>.$..z......<...2...^M..N..@....@gn..]]G........u.nnn.......s..z...(Hp:.?..}C@.X,....bx....$.O.!4.s.I..B\|.0.6..O(1qj...}=....1.W:....L...f.n.^o.g...J.A..f....X.....?.rI+(..f..-.>.....32..\|....?..^.J...f....g...?....!.1..}Bo.....X..}.....G ...\ ...tk_x.../..1...0+.....G.....9s.d....@..T...T.S.o.@.......w~>..`.......#.........`rr.@...........p.@..2..f.....@B..*.0...rY.6.--.b6...C..}..x{.6...t:..8.\|....x........

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\finish.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2160
Entropy (8bit):	7.849847219042475
Encrypted:	false
SSDEEP:
MD5:	7AFAF9E0E99FD80FA1023A77524F5587
SHA1:	E20C9C27691810B388C73D2CA3E67E109C2B69B6
SHA-256:	760B70612BB9BD967C2D15A5133A50CCCE8C0BD46A6464D76875298DCC45DEA0
SHA-512:	A090626E7B7F67FB5AA207AAE0CF65C3A27E1B85E22C9728EEE7475BD9BB7375CA93BAAECC662473F9A427B4F505D55F2C61BA36BDA460E4E6947FE22EEDB044
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@...@......iq.....pHYs..........+....."IDATx..kl.......aw..Y.e......E...@.2.v..&V)RQ>ZqD"a,..".J+..D%..H.....U.P.JI]..w.v-..E.Dc....A...x.;.{.....]{.;.;.\|9......}..s.Rh.u..?..y..Tr..B.T@x...p..........;.d...Q..Z...s.../....#1:..+.tp.f....B...D!....V...MB.EF.........a......~..~.Cx...C.AJ....oT.GM!@Q....-\.C..FC..!Jh..l.>OR...(.}L...=...U........1..eO.]_hi. .g.2....b[...y.ru.....(.W.BW...N.A.J.Y.....M.J..N.!e#...#...;....L...3.Z.........K...#...........y...V?._.u(i.J....6......p+.....z.r",....z..m..../.p......z......w.a..1D..\|..R.1...N.A...a..d.D..Gj..q...nQ...@.t...a..VD;'DL....).....C...W..='b=..`4\|....9F..F./.-9....wH..'Sg.T{.cv.i......'[...b....'[.......CH.'m.\|.!9.g.'....~.a.G.q.3..L..K(..`.......)a.I-....}....0..U...XF.y.J..h.>.....L4.....oU...... ..'.#5.9......lf...h\]h......B....6.\|.H.v....+..u.?....P\|!.~=.2%E..7..o........o.jo!...W=9.Ou$.u.%G.Uu.....~..>..R>.O.'snQu..r..L..x.-#....>.VU....Jj7.....l......Q...-*....;.. ..

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\is-07QRQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	48743
Entropy (8bit):	7.952703392311964
Encrypted:	false
SSDEEP:
MD5:	4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA1:	0F4F73F0DDDC75F3506E026EF53C45C6FAFBC87E
SHA-256:	0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
SHA-512:	9D616F19C2496BE6E89B855C41BEFC0235E3CE949D2B2AE7719C823F10BE7FE0809BDDFD93E28735B36271083DD802AE349B3AB7B60179B269D4A18C6CEF4139
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a.....IDATx...eIu....(..Y31.}q....`...t....Z..8t;x3._@.3.0.{.E.".&.5.g.C..@..%.>r.5....B...O...^.*..s....{.7..{....r..+W...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(.n+.t.B.p.x.....^.?/....p,..7...{.P(...B.H...r.y..\|.....{l\tO.\|..<..P(....w......o..P(.<h...n[\tO..?......E...}...F.P83....<z.....W..7...w.....?..?.YW(.N.......?N[..E..A..z..[...'.$..'....8...?~.K.\|........[#.....6........;.......s.=...}.c...{.._..z....;w..........(../..n...?..??..?.........z.......~....[o.<.......x.).Z.(..s.N..Wb.....f....../.P8.\|.......?..#......2vO....F......@.\|..w7].\|..$..}?.L.Go...A.1..^...j...$.6....~..x...{..IwD`\|..?.....?...{..~~........).........`$.......tG....\|.n.2..........[..._....e.}.=..<........h.7\|?Kg....+

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\is-7EG7M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp
File Type:	PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	117272
Entropy (8bit):	7.9928375793958635
Encrypted:	true
SSDEEP:
MD5:	5EF5291810C454A35F76D976105F37CC
SHA1:	8CE0CC65AE1786CEF1C545D40D081EDA13239FA6
SHA-256:	03E69E8C87732C625DF2F628AC63BD145268F9DEA9C5F3DD3670B1CF349A995C
SHA-512:	3BEC461BB3CBBBDB3C05171FCC5AB7E648B2B60D7B811261662F14D35C3836148B14CDA1A3F2BE127C89CC732DE8CF1644D2E55E049EEEB2DA8E397C58CC919E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a....IDATx.....eGq'.W..fFa....#.0I.]c.d.......5...v.........v..q...M4`..$...."ym.6..HD.. ..i$........o......3..7......:.s.....DZ.......!.4....S.....5...i..M.M..0{8).,...X_Q..s...w;.$mk..M...<........F<jxL-..^..(pNm...Z4u.p.9..}.T=...6.....C:..R........Q...{....ca..D.O.g.....kp....f]x.8L.M.YS....?KN.4...x....1..H.4(v...)..6..rS.....Q.....ZZX^9c.0.........!D..G.....Z.4.....h..L...`0..(....^.....;...MC.......g........H..k...M;.EY......~S.t..0.?T.k..i:.@y5.C..HGn]..F...w.]~......f..x...e..P....r.....)...].#U....8.....N....k.:m...:(&.....2.6..f.Ty@.HT.=\._.{.....Lu......x...g<....}.O...{...(6hh../.......t.......r... iPx.k...&&;...b...;.gJ..x..3`.e.@........>..$..czY1...".......]Z,...s.....c....2;...........fTd)U.qLS`T<.E1.n..j..,...1.U.i...q......&....L@.{E.....ur..(_KY...sT.D.......'..,... ..cP..KPo.1.H...a.%..S.......D..1..z.....IeV.........a...{Oh..'g...~..X=.7....}j

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\is-N2C2N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	125405
Entropy (8bit):	7.996684823256823
Encrypted:	true
SSDEEP:
MD5:	56B0D3E1B154AE65682C167D25EC94A6
SHA1:	44439842B756C6FF14DF658BEFCCB7A294A8EA88
SHA-256:	434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
SHA-512:	6F7211546C6360D4BE8C3BB38F1E5B1B4A136AA1E15EC5AE57C9670215680B27FF336C4947BD6D736115FA4DEDEA10AACF558B6988196F583B324B50D4ECA172
Malicious:	false
Reputation:	low
Preview:	PK.........XQW.a..............avg_antivirus_free_setup.exe.].\|TG........Mj.RH-V..6.@.....Z.....%@-....;@K(..,..STPT.T.GT...H.%..BBQ.6Z.&...4.wf.......OZ..........}.}l..,I...#.I........4I....GK.7...Z..........~...Og>..g>.Y_...,..&...HA.?....F..9...>.\|.\sJ.....N.L~.OY.......)5.......;...,~7.&...LJ6?... ....w~.\|.7.>..Kx..d.{J./....j..>....."i...6..%..t.i.M.H...&...~.oV.qO...!Qy.)......&.8......I..../&I.83Y......%K%. .'Y..+I%?H.J."...g.&/)A...^...I.]..}.'6..l.%.../.?..W..1.cH.1..}<...'...G`..t"..#.<\|.\...$x.9....\.....q..'6.U..Wi..u..`.X.+i..K./...O..p.............s.G........3y.Hz.V...=-.I..\)..}.S.WW$}.\I....n.H.IR.E.{...C0...s..X'.z...W.J.iL..........i...l..$..........A$=.2=...4[J6.(..l$....f....y.g...o..:m.B...$....&...".}.r{......n&./.xdBA~d.D.....5p....g..... _Z..-b...jg.o.wMA$.2...=..5.&x.....,?..MF...2QVO,V.N..........R.^..o..o..4.hd.H..LE.SBE,.8\|Eo&d..D.Vq..NK.[.[.g.K.v..D".....og.m1....x..C....b..`?2...L...t..O.t.U..l..02.v.A.G2

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\is-O1UUD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	398800
Entropy (8bit):	7.940465899749841
Encrypted:	false
SSDEEP:
MD5:	8F4A7771AE6B62234B08572A6863CEDC
SHA1:	24DBE7C62A169F61005100E66B233B805B61E305
SHA-256:	60E254AE9184355CAFDB769CE21D9967156A8DA7B6924C352DFDF67865268E51
SHA-512:	0529F1E099706CF08C0D1EC2B8AE5E259B7EB200D45899BAF444AF708BD2ECA7DB86CC461AB2B9DD8A42021C4E335AE26A9C3049271477ED0772D3042A621C02
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../././.d...#.d.........=.....:.d...:.d...,./.............}...Y.........Rich/.........PE..L......c...............#.........@.......P........@..................................6....@.................................L...........L........... ....0...................................................................M......................UPX0.....@..............................UPX1.........P......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................3.95.UPX!....

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\is-P2AT2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp
File Type:	PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	14731
Entropy (8bit):	7.968248074094244
Encrypted:	false
SSDEEP:
MD5:	0887B48393FDACAFEFEE9D2BE8772DBE
SHA1:	52E8A52BAA4EF3622F77AB000B66EA45866BCB04
SHA-256:	66C27FEB1682B1B1C9DB471976A79CC9E2B21DE065ABCAFB7880A054C414759A
SHA-512:	BDCDC9AEEDFAF324286CED238CB3EEB92DE3FA90C0614CB37C76C41B823BACB548DDAF385E719A6DE56E2346AAAC15AAA4C95616906ECDB229266A1C87214293
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..9.IDATx.....n.}.......y...y....4.&[q...p....T.8..E.#...(......@\...l..xP.X.mI.%.%w[-.......{.....Z....-...93..2...l$c.."c..%S..]/o....B.W{...a..y[...6G......f..R...D.TE....w.b.z5X.8...EHrH."..!....D(D. .6?J.o<A.A.,.@.O..p.g........y....[N...1 ..`Y..G.$...V...q,1..b....0\|............v...4..{.c..l....F.....s.m2..b..[$...X.......B.eK.;......n}v..^....z..y@;.i.-Dp..G..Y...&.....g..A...#...A.%..Y.2..!s...R."d....3...w.9..(...>..{..0.Q{......d!...H..$~...a..6.@.... ..,.lK.. K.;.1.q.&.=.$..1.6qL .. ...6.8,.b.}.j+[.nEG....S.....p.a..hd8d[... .....d,.1.c.....dd,$c,.....h.$a.l.J.B...uJE..F0.c2U8I..;.)Q(..1.}~....{4..\f.....(9....aY....T.K..). ,............M...$........&..P...Uu..R^....1........`u..-.y.4.Q.%..pv...3...{..Z.".yu=>[.....,......F..N...w.rp..mTz2.P.9..H`..*.. ...2......[:0F.....S..aH.I..%Z..#.a.\|....z.[..o.\|........d.....1....Q.....G..?

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\is-T13O8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	511969
Entropy (8bit):	7.996152621854539
Encrypted:	true
SSDEEP:
MD5:	CD9C77BC5840AF008799985F397FE1C3
SHA1:	9B526687A23B737CC9468570FA17378109E94071
SHA-256:	26D7704B540DF18E2BCCD224DF677061FFB9F03CAB5B3C191055A84BF43A9085
SHA-512:	DE82BD3CBFB66A2EA0CC79E19407B569355AC43BF37EECF15C9EC0693DF31EE480EE0BE8E7E11CC3136C2DF9E7EF775BF9918FE478967EEE14304343042A7872
Malicious:	false
Reputation:	low
Preview:	PK.........Y.V..@I...h.......saBSI.exe..\......6i.%PJ..4.i.h....U.b...kZ...-.C.+U.pF.`..\....TT.i.J[.ie.......9.Ne..S....w...\(..>..........{....J/7..x..W_q\;G....lq.7s...\.W...J_...o......-W.h...n.\m..:.7.o..\\|...7W^wZb..<...-..../..I..7.W.9...@.Ov......W?.>...../....!,WW.'...~......>.F.........}.....}...vC......^.W..e....!.[..<....c5..M..T..nR....\w..U...O..g.....<....'.N.o.....CH..'...o..$...>....H..f..4p.....K.....C.,..c.....}5.3.E..V}]M5.,=.....+e...<mK...Ws.kS'.....}2......w?:.'q.....p..i.7 It.*....zC..[.\...mHle.H.[...............U...M\..u.q..uz....r.j8.'...M...-..m...EU.[......-..b]f3:n.@.p3R8.z.F..Y...../...X...C.p...Z=:..C ......b.X...T"<...@..\|1.......j..p<...0...,..p\|..C....O.a=.......X...Z.I.........aa..^...Zp"a.U.u......\|......A._.[.d.(,#..`.....;.a'V...Z...i .0.x...`.Z,...;.Xx:..A..\|...b.]X........n.a8..X....ba...D8... .......p'..j.R".... ......p?..ja...... ..~;.....0T._...I <.[Z?.D.....<...(..a.....>8.^l...

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29187936
Entropy (8bit):	7.992611077292814
Encrypted:	true
SSDEEP:
MD5:	58EB889F91B5133D5DB88612CA6E5887
SHA1:	13AE62947B7E8804227552A32647BB169F6567B6
SHA-256:	2170578D619B2CA143DB3E58BB367ACC64D691AB875FF449A40466B5CF4F40C6
SHA-512:	2BB69FA7AA07BA23449F21CF6B71AC3E7C27BE0DA5EED88EB589566FFA968D4CE99B41975CF10910BB48CFD64BFDE4A3AF2F35B0CC6D22D6CFB174176C19E26E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w...w...w.......w.......w.......w.......w.......w.......w..4....w.......w...w...w..l....w..l.o..w..l....w..Rich.w..........................PE..d....gbd..........".................D..........@.....................................o....`.....................................................(...........p..L2...X..`...............p.......................(.......8.......................`....................text............................... ..`.rdata..vz.......\|..................@..@.data...t1...0......................@....pdata..L2...p...4...6..............@..@_RDATA...............j..............@..@.rsrc..............l..............@..@.reloc...............L..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod0_extract\saBSI.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A83TO.tmp\file_qK5-VP1.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1162856
Entropy (8bit):	6.592896831755123
Encrypted:	false
SSDEEP:
MD5:	BB7CF61C4E671FF05649BDA83B85FA3D
SHA1:	DB3FDEAF7132448D2A31A5899832A20973677F19
SHA-256:	9D04462E854EF49BCD6059767248A635912CE0F593521A7CC8AF938E6A027534
SHA-512:	63798024E1E22975D1BE1E8BFF828040D046D63DF29F07D6161C868526D5F08451E44B5FA60BFB0C22CF7880ABC03AAEDAFA2C5C844C3AEFF640E6FAC9586AAB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$...............................:.................p................................;......e......D............e......;......;.r....;......Rich...................PE..L...]..d.....................d....................@..................................(....@.............................................p...............h.......8.......p...............................@...............(....... ....................text...L........................... ..`.rdata..............................@..@.data...$........~..................@....didat...............R..............@....rsrc...p............T..............@..@.reloc..8............X..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\CityHash.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55232
Entropy (8bit):	5.9644678589411875
Encrypted:	false
SSDEEP:
MD5:	2021ACC65FA998DAA98131E20C4605BE
SHA1:	2E8407CFE3B1A9D839EA391CFC423E8DF8D8A390
SHA-256:	C299A0A71BF57EB241868158B4FCFE839D15D5BA607E1BDC5499FDF67B334A14
SHA-512:	CB96D3547BAB778CBE94076BE6765ED2AE07E183E4888D6C380F240B8C6708662A3B2B6B2294E38C48BC91BF2CC5FC7CFCD3AFE63775151BA2FE34B06CE38948
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./.J.k.$.k.$.k.$..*.}.$.]...$.$...7.h.$.k.%.#.$.]./.h.$... .j.$.Richk.$.................PE..L...0..P...........!.....b...^..........................................................................................M.......(........................)......H....................................................................................text...Ba.......b.................. ..`.rdata...............f..............@..@.data....D...........r..............@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\InetBgDL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	6.852543793988596
Encrypted:	false
SSDEEP:
MD5:	97C607F5D0ADD72295F8D0F27B448037
SHA1:	DFB9A1AA1D3B1F7821152AFAAC149CAD38C8CE3C
SHA-256:	DC98ED352476AF459C91100B8C29073988DA19D3ADC73E2C2086D25F238544A5
SHA-512:	AD759062152869089558389C741876029198C5B98FA725E2D2927866DC8B416AE2DE871CB2479F614F6D29B6F646BF7191D02837C3CABC15B8185B563BC46268
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)tBQH..QH..QH..4...VH..QH..NH..g$..PH..g$..PH..g$..PH..g$..PH..RichQH..................PE..L...,3.\...........!................"........ ...............................`............@.........................@#..X....$..P....@...................)...P..\|... #............................................... ...............................text...F........................... ..`.rdata....... ......................@..@.data...T....0......................@....rsrc........@......................@..@.reloc..\|....P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22976
Entropy (8bit):	6.938678728000063
Encrypted:	false
SSDEEP:
MD5:	B361682FA5E6A1906E754CFA08AA8D90
SHA1:	C6701AEE0C866565DE1B7C1F81FD88DA56B395D3
SHA-256:	B711C4F17690421C9DC8DDB9ED5A9DDC539B3A28F11E19C851E25DCFC7701C04
SHA-512:	2778F91C9BCF83277D26C71118A1CCB0FB3CE50E89729F14F4915BC65DD48503A77B1E5118CE774DEA72F5CE3CC8681EB9CA3C55CF90E9F61A177101BA192AE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L...X..`...........!....."...........).......@...............................p.......7....@..........................B.......@..P....................0...)...`.......................................................@..X............................text...O .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\UAC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29120
Entropy (8bit):	6.7855111744622505
Encrypted:	false
SSDEEP:
MD5:	D23B256E9C12FE37D984BAE5017C5F8C
SHA1:	FD698B58A563816B2260BBC50D7F864B33523121
SHA-256:	EC6A56D981892BF251DF1439BEA425A5F6C7E1C7312D44BEDD5E2957F270338C
SHA-512:	13F284821324FFAEADAFD3651F64D896186F47CF9A68735642CF37B37DE777DBA197067FBCCD3A7411B5DC7976E510439253BD24C9BE1D36C0A59D924C17AE8E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......DH.".)lq.)lq.)lq.)mqP)lq.!1q.)lq./jq.)lqT.]q.)lq..hq.)lqRich.)lq........................PE..L...lKPJ...........!.....4...........:.......P.......................................-...............................B..J....:..x....`...............H...)...p..........................................................L............................text...Z3.......4.................. ..`.data........P.......8..............@....rsrc........`.......@..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\UserInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14784
Entropy (8bit):	6.870285434783437
Encrypted:	false
SSDEEP:
MD5:	610AD03DEC634768CD91C7ED79672D67
SHA1:	DC8099D476E2B324C09DB95059EC5FD3FEBE1E1E
SHA-256:	C6C413108539F141BEA3F679E0E2EF705898C51EC7C2607F478A865FC5E2E2DF
SHA-512:	18C3C92BE81AADFA73884FE3BDF1FCE96CCFBD35057600EF52788A871DE293B64F677351BA2885C6E9CE5C3890C22471C92832FFC13BA544E9D0B347C5D33BFD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..................[.........Rich..........................PE..L...^..`...........!................~........ ...............................P.......1....@.........................@"......l ..<........................)...@..p.................................................... ..L............................text............................... ..`.rdata....... ......................@..@.data...h....0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\WebBrowser.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105920
Entropy (8bit):	6.560453175695662
Encrypted:	false
SSDEEP:
MD5:	B53CD4AD8562A11F3F7C7890A09DF27A
SHA1:	DB66B94670D47C7EE436C2A5481110ED4F013A48
SHA-256:	281A0DC8B4F644334C2283897963B20DF88FA9FD32ACCA98ED2856B23318E6EC
SHA-512:	BB45D93ED13DF24A2056040C219CDF36EE44C8CDDB7E178FDAABCEC63AC965E07F679CA1FA42591BBA571992AF619AA1DC76E819A7901709DF79598A2B0CEF81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!...@.F.@.F.@.F.(.G.@.F.(.Gv@.F./.G.@.F./.G.@.F./.G.@.F.(.G.@.F.(.G.@.F.@.F.@.F7/.G.@.F7/.G.@.F7/PF.@.F.@8F.@.F7/.G.@.FRich.@.F................PE..L.....^...........!.................(...............................................Z....@..........................].......^..x.......`............t...)......0....R..............................0R..@............................................text............................... ..`.rdata..tg.......h..................@..@.data........p.......T..............@....rsrc...`............^..............@..@.reloc..0............b..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\bgstub.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1344x822, components 3
Category:	dropped
Size (bytes):	68315
Entropy (8bit):	7.71927040142712
Encrypted:	false
SSDEEP:
MD5:	C55F15CEEDC724D6C6E15D1DAF96B698
SHA1:	AF6BF647D708CA7A5377925D521097B67A269AE8
SHA-256:	4B7E441D51B790EE1C0BAFF19E4E968392A937877DFA8B84E74464F5BA7A4CF4
SHA-512:	05CCF388364D511CE3DA14C9013B9A9128C16044713F19BB752C053EC7EC25CB3B47600B23AE6DE7C8A62D817FA03EA4BD9C95FA6ABFB0714BB3DCBBA56DE75D
Malicious:	false
Reputation:	low
Preview:	......JFIF......................................................................................................................................................6.@.....................................................................NNNq....L.q.......NL.L..g'&8.rg''..'&g'8.rp.................<.d..d..L.q...L.........d.d.G.NNFdqL...Lq..?r .........>..Pl....(.............d"x.rrg'..'&g&x.2.?r .........><?).)...........9........8....,....)..?r .............\NNd.g..........dfDq.d..G.d......NL..FNLfL.FL.."...........p..O..Nd.G.NNL.O.NNL..q.ND.G.d.....NL......D.................zK..zs<q9993.S3..3..93.93...391.9399<q3..9.S9.93<S.'.D.............e.#.g'''8..fs&r8.rrfrc.'&g&x..3...s93.....3..Q99....K?..H............L..g&s&g.#'2fs.'&rg&8.'&g&8.&3'"8.rr38..rfg&8.s. ...g.n...Ox>.........8.'.b.9.\|s.999...9.9.q..........d"x.rrg'..'&g&x.?q.......z_...+....O....M>../.....>.}.............G.NNfL...NNFO.d.d.Lq.NL.O..L.NL.....Lqd..fLq~.>.....D~'~u}....%...6...F..Z.^.z...q.=.m

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\installing.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.9747185139122365
Encrypted:	false
SSDEEP:
MD5:	32DE55F44C497811DD7ED7F227F5C28D
SHA1:	C111BE08E7F3D268E7A2ED160D0C30833F25AE4A
SHA-256:	6259F3A41A703F13466503E6FBD37CA40E94F565A2F4B4087FBCD87A13BF3EE1
SHA-512:	48BB6F24B3EE2F4B7052205A3843EA34F917EE192B70261D2438C037B0E17D48BCE8BEB4C31BE4141E9618922A45B6B47745B797E5618F18FE00BFC1625309EF
Malicious:	false
Reputation:	low
Preview:	<!doctype html>.. This Source Code Form is subject to the terms of the Mozilla Public. - License, v. 2.0. If a copy of the MPL was not distributed with this. - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->..<html>.<head>..<meta charset="UTF-8">.<meta http-equiv="X-UA-Compatible" content="IE=8">..<link rel="stylesheet" href="stub_common.css">.<link rel="stylesheet" href="installing_page.css">..<script src="stub_common.js"></script>.<script src="installing.js"></script>..</head>.<body>..<img id="background" src="bgstub.jpg" alt="" role="presentation">..<div id="text_column">. <div id="text_column_container">. <h1 id="header"></h1>. <div id="content"></div>. </div>.</div>..<div id="installing">. <div id="label" tabindex="0"></div>. <div id="progress_background">. <div id="progress_bar" role="progressbar" aria-labelledby="label" aria-valuemin="0" aria-valuemax="100" aria-valuenow="0" tabindex="0"></div>. </div>.</div>..<div id="blurb"></div>..<div id="f

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\installing.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2313
Entropy (8bit):	4.945006967984332
Encrypted:	false
SSDEEP:
MD5:	DFA7861BCA754036AB853B3BB02B194D
SHA1:	46D7C5BA614B39CAA4857FCBA4BDEDBABB2C67C0
SHA-256:	2C286B6EEFD38F032A385F3AC6A1F794DEAB3BAC0FBFF71BD0BA21453F477878
SHA-512:	C58D96FB2496A84261A5E4B18CF4156A30F9AD161BBABC3652B6B5C24976F1AC432DCED31927A9443260CDCA0292524D1F691766B7C0731F926D37BE11FE0C64
Malicious:	false
Reputation:	low
Preview:	// This Source Code Form is subject to the terms of the Mozilla Public.// License, v. 2.0. If a copy of the MPL was not distributed with this.// file, You can obtain one at http://mozilla.org/MPL/2.0/...// Length of time (milliseconds) that one blurb stays up before we switch to.// displaying the next one..var BLURB_CYCLE_MS = 20000;..// How frequently we should update the progress bar state, in milliseconds..var PROGRESS_BAR_INTERVAL_MS = 250;..window.attachEvent("onload", function() {. // Set direction on the two components of the layout.. var direction = external.getTextDirection();. document.getElementById("text_column").style.direction = direction;. document.getElementById("installing").style.direction = direction;.. // Get this page's static strings.. var label = document.getElementById("label");. label.innerText = external.getUIString("installing_label");. document.getElementById("header").innerText = external.getUIString(. "installing_header". );. document.getEleme

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\installing_page.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	4.85011089032564
Encrypted:	false
SSDEEP:
MD5:	6582E207592B60A995B4510CF959EB03
SHA1:	08AFDEBDE481B653E04F89BEDAD0CBA6C8DBD999
SHA-256:	43C38801C1746880625F97EEE3FE37FE94D1300ADF812BFE26E47B094B87523B
SHA-512:	0A5A5CE944B89F552A38300674C44CC9DE4920E87C2AA2C3C63BBCEEDFF1D80AB35AB31274BFA89E0ACC518470F466A2D67D483147F2CA8061D68B770E2EBE48
Malicious:	false
Reputation:	low
Preview:	/* This Source Code Form is subject to the terms of the Mozilla Public. * License, v. 2.0. If a copy of the MPL was not distributed with this. * file, You can obtain one at http://mozilla.org/MPL/2.0/. /..body {. color: black;.}../. * We want to treat the two pieces of text in the left column as one unit and. center that unit vertically in the window. In order to make IE8 do that,. we have to wrap the two bits of text in a container and make that a. table-cell (which means we need an outer container that's display: table).. So that's what this mess is doing.. */.#text_column {. position: fixed;. height: 100%;. margin-left: 30px;. width: 40%;. display: table;.}..#text_column_container {. display: table-cell;. vertical-align: middle;. padding-top: 60px;.}..#header {. font-size: 24px;. font-weight: 800;. margin-top: 0;.}..#content {. font-size: 22px;.}..#installing {. position: fixed;. right: 30px;. bottom: 55%;. margin-top: auto;. margin-bottom: auto;. width:

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\stub_common.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	684
Entropy (8bit):	4.895598755144928
Encrypted:	false
SSDEEP:
MD5:	544B51F11AD19DF720669478D28F129D
SHA1:	D238B604FD3FA37DFD552EACDC6AACC474FCDDAD
SHA-256:	4D9495B6F0E18331659993B79440E414A6E607FCDAEACBC7477E0683CC0FA98B
SHA-512:	BBBB0F31839316C51464CFD225166145F968CE38995DC2748DF5402B7E109FF6119D65B6774FC4738638AD4C9D89776516B00AB5A700097D9D74E1824A11DC5E
Malicious:	false
Reputation:	low
Preview:	/* This Source Code Form is subject to the terms of the Mozilla Public. * License, v. 2.0. If a copy of the MPL was not distributed with this. * file, You can obtain one at http://mozilla.org/MPL/2.0/. /..body {. height: 100%;. width: 100%;. margin: 0;. padding: 0;. overflow: hidden;.. font-family: "Segoe UI", sans-serif;.}../ This is an <img> rather than using background-image because IE8. * does not support background-size. */.#background {. min-height: 100%;. min-width: 100%;.. width: 100%;. height: auto;.. position: fixed;. top: 0;. left: 0;.. z-index: -1;.}..body.high-contrast #background {. display: none;.}...no-focus-outline {. outline: none;.}.

C:\Users\user\AppData\Local\Temp\nsd852C.tmp\stub_common.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS03140D36\setup-stub.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	817
Entropy (8bit):	4.930061365317776
Encrypted:	false
SSDEEP:
MD5:	58B8AC894C64370CFA137F5848AEB88D
SHA1:	6A1AC1F88A918A232B79FE798B2DE69CF433945F
SHA-256:	0E28AA770B0AFADE30BE85C6DC1E50344DB8F8CDD3FA01989D81A9E20A4990BD
SHA-512:	AE309518E0F926021E4D9378950C1A375263247D4F79D8A8CC09464CD01653AE5E707D52A4B0C36D532E649C246F4BE6B5BA8648F58FB0E3E40C495AE63180AB
Malicious:	false
Reputation:	low
Preview:	// This Source Code Form is subject to the terms of the Mozilla Public.// License, v. 2.0. If a copy of the MPL was not distributed with this.// file, You can obtain one at http://mozilla.org/MPL/2.0/...window.attachEvent("onload", function() {. if (parseInt(external.getIsHighContrast())) {. document.body.className += " high-contrast";. } else {. document.body.className += " normal-contrast";. }.. document.body.style.fontFamily = external.getFontName() + ", sans-serif";.. // All pages have the global footer (or don't, depending on the branding).. document.getElementById("footer").innerText = external.getUIString(. "global_footer". );.. // Disallow dragging of the "background" image.. document.getElementById("background").attachEvent("ondragstart", function() {. return false;. });.});.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 15 06:22:18 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9753662704052664
Encrypted:	false
SSDEEP:
MD5:	1404D54FED72058BFADBCFF182096792
SHA1:	923FEB79EEB87F4B2690F109006DEBA0338B1230
SHA-256:	03201DBDFA80638D7ABEDA854EFC0591AA9153C14A1A1AB871D45902CE76E7B1
SHA-512:	ACF72E076F873AF89197BB683D4D9A6E3615263C24C3FD3502A536FDB153B202827314F0AF6F61B3C24867AC31451AECD1FC09A90E50D93C80AE8C0A021F2F9A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...._.w....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IoW.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoW.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoW.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoW.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoW.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 15 06:22:18 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9921710352106707
Encrypted:	false
SSDEEP:
MD5:	C5FB047CDEEB2FB44AFB557100182F96
SHA1:	B9B016DD793877C7CCC544F8D0D467A5DA1B63B3
SHA-256:	2FD917D5D1362530B1CB044C42107201505037D3D26DA01B2DCC2261EEF3D3F9
SHA-512:	FBC520DAACF323EF09592635F5CCB55FE8D71F3935296C0E345F1C8D258BB758135F5051A14B67DDFC267AE86A6A58AB4AD7047DA510BE3C0FA6F26434279BB0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....ww....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IoW.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoW.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoW.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoW.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoW.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	3.998605372461328
Encrypted:	false
SSDEEP:
MD5:	90F4AE7E64B2BA8DCFED8544B53528CF
SHA1:	984F0D3B46F12B7F13FDEB1A5D4DFE0BDB290901
SHA-256:	EA98E2AF28217E2FF5261B71191571C63C2EE0BDF18B794E4CF181FA34D1F213
SHA-512:	5931B6898DA3D2F46209EEE631D5A4098F34FC8EB224B87E67B7F3B943C98B2C27F33C956B0840D45A1428BBF43A8A8A9ADF818B5697A87D3CF09470131F1823
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IoW.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoW.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoW.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoW.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 15 06:22:18 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.988859567201412
Encrypted:	false
SSDEEP:
MD5:	4C61B9337A93BAE2A6991E23135725CC
SHA1:	2BA1D32A22E333253FFAD83AA7F8C4DA498661A9
SHA-256:	205869FE3E87DA72723240303995C33E8FC521A042C11411EED87E2E0D052144
SHA-512:	5919AE31B5B2E859A720A707F08B4A45EC25EB4B517A1F90590E4CC1301D188C455679B5AA3C1F338EABBE7EC1DC4BD71F3C792899B0026F45286EF16120E60B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....."nw....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IoW.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoW.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoW.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoW.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoW.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 15 06:22:18 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9792888538434648
Encrypted:	false
SSDEEP:
MD5:	E91259AF89B0B5AAD736C953F04A9B57
SHA1:	083178C6334F61D9737DC5FFD8B5E4C2E13A01AE
SHA-256:	DCDDCFFC3D9830A45707DDEEFEE4C7F095EA58DD04AF91F9EB85BBEFD473CAA2
SHA-512:	E13EB90E00428C0B2377B27ED7DA2339AE910D5E4A696613A3C2E249F7CE4E32F7CBD1CAEE40D9770E4C5FACF6839315A017E092AD34BE9AEB2E38D9283CA047
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......w....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IoW.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoW.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoW.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoW.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoW.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 15 06:22:18 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9875278088961172
Encrypted:	false
SSDEEP:
MD5:	DBC8BDC2D8608DC65D47FA04A1A3E1AA
SHA1:	59BAFC2F65E7B24B17E63488218797AF11B330D2
SHA-256:	C66F9FB45D02CA78BA4E5201C5D875B36FF31EAE3980057C936DEAF5B6B157C9
SHA-512:	BB5A2BCEDBE24C360AB5B61C3510A773BE31262A68B61CE5EBC1521EA887E1E33A0F561D91D87D95CD1B306496C53E2838ADCA852E0BFB28E36289638418370C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......_w....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IoW.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoW.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoW.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoW.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoW.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\System32\icarus_rvrt.exe

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	50048
Entropy (8bit):	6.7242310270979555
Encrypted:	false
SSDEEP:
MD5:	4E7236C6B0250F15CD2A7B6C0837E96F
SHA1:	A6292B400D48B48D5A6C9D399916A79860D1F408
SHA-256:	478DCF15F9BD7A3470971C05CCF0E53ED3418D5236E1FDB9DE39BCB1F1B588E5
SHA-512:	56B30DFD29F2BCAE85D3A43B0FCD49175E8E7FD63A31B3419EA25B8B902AB69DEB8FECBC32217A2FE19C6733675DFF6DC47A8108F2683B9F22F6F57524F6B05E
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............s..s..s...r..s..r..s...z..s.....s....s...q..s.Rich.s.................PE..d....t.d.........."......J...(...... ..........@..........................................`.................................................Hu..(.......8............t...O...........l...............................................`.. ............................text....I.......J.................. ..`.rdata.......`.......N..............@..@.data...............................@....pdata...............h..............@..@.rsrc...8............n..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\config.def

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	491
Entropy (8bit):	5.408164067699979
Encrypted:	false
SSDEEP:
MD5:	12D680412C874917E9A904D96465E292
SHA1:	FAF8AC65A69F1DADA875C515E061E0420E778AB3
SHA-256:	DB097628CA78881CCDD46C43B0B2ABB115388D3153F76BAEB038EF16B4F0F3BC
SHA-512:	AFF5CC5CD17D25C018032B72DF4B2198040CA7405F2993DC02129DE4710F9E279EB7B2DEF14B87FD881515A1101A019E103E20C2A55BC05B76F12A5D95271A2C
Malicious:	false
Reputation:	low
Preview:	[ui.offer.actions]..url=https://ipm.avcdn.net/..[ui.offer.welcome]..url=https://ipm.avcdn.net/..[common]..config-def-url=https://shepherd.avcdn.net/..report-url=https://analytics.avcdn.net/v4/receive/json/25..[ui]..enable_survey=1..[updating]..conceal_hours=1..fraction=100.0..updatable=1..[CrashGuard]..FullDumpFraction=0..[Signature]..Signature=ASWSig2A38775A8F949A9FAC7D5917BE6AF833E6AA31C12E93137C1C2D97831179BF16233D944184738C812D2C62D08B2939D0C9F85B43C4FFCE744082249F3984369FC1ASWSig2A

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus_product.dll

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	868800
Entropy (8bit):	6.567765769116416
Encrypted:	false
SSDEEP:
MD5:	C47882F94B945D696B14481D25F78468
SHA1:	50115B56470411A6E8025656006EC11D0135B0E9
SHA-256:	08042DE5D40937F1692D2F760A749226AAEEC6FF4CBBF54D003292BD2AF344FF
SHA-512:	02BA807F5ED9CFF1505246E623AEC43EAF597BA25773A786AEB86A5CB940313285A3338AFFD608B5981006AB3B9548FDCD3F2F110CEB2CCAF1A7DDFE838CACF7
Malicious:	true
Reputation:	low
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$......../..Nb..Nb..Nb.]<g.CNb..1...Nb..1f..Nb..1g..Nb..1a..Nb.]<a..Nb.]<f..Nb.. a..Nb.. f..Nb..6.Nb..;f..Nb..Nb..Nb..;g..Nb.]<d..Nb.L;f..Nb.]<c..Nb..Nc..Lb...k..Ob...b..Nb.....Nb..N...Nb...`..Nb.Rich.Nb.........PE..d...G.Ie.........." ...%.....h......`...............................................h.....`A.........................................P.......Q..........x........k..H...x)...........W.......................X..(....V..@............................................text...L........................... ..`.rdata...a.......b..................@..@.data........p...J...J..............@....pdata...k.......l..................@..@_RDATA..\....p......................@..@.rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus_product.dll.lzma

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	LZMA compressed data, non-streamed, size 868800
Category:	dropped
Size (bytes):	320653
Entropy (8bit):	7.999407316043076
Encrypted:	true
SSDEEP:
MD5:	5A5B590059F923B1685FF16ACC4D3C74
SHA1:	35DF74C588466E3BD44A62F184D7E74340AB7955
SHA-256:	4BDA0C3E856B95AA336D1BA960F89FDA7B660C8C72C418EF455A9D6ADD8F23A7
SHA-512:	AC0B72B085321B9906EF1FF77E623EB772BEA9B4E28143AD09984E1A848CA072318CC41A300675807A4C508C6FBC0CB3241DA775AF09ACDE3190F75D3913D023
Malicious:	true
Reputation:	low
Preview:	]..@..A.......&..p.........../D.\|......e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg.h.ph.....h.'....u....v.....hp.z.5b...B.}$R?..o8.^...0.._C..=Y..}....."..W.u..f">..iu.?.}..:.e.vr.-.O...O.`0...;.UJ.:.....cU"..........F...t.7...N{......Yq.R&aU......\....8y.h......4..H....pg......]...E.V.T......t?_.6A.H.....iD{..p@. b.x..S...O..t.lC.s..k>..U.H4t.-.=...Di~{..M..0...o...._......>._....hQ$.A7N......vb'...A..i3<E.gR.D";.{.... ..k+..[8y.......z.4V..%`.....#.4..J..}..L...\._b.A`.v......K.n.g..+f..t.8..).Z:8y.....`.D........[Z.&.f..5.d...p...u.5.<J&q..e.\|.\.!F.7.dcPW.....^.A./...c..l.Jq.}.n.......wK.!@.....}.yl.N.....bZ]....1.5....mt.~.dnO..y..D........v......t.-Zh..............y/....P9.....T.;...^.}..2-.78........1f$.u.%}.5.&..S{....>......E..g....x.`o..&....d7.H...z.}....P1..8_bvh%'.&1j....\~....%..Y..et....v.B......m#...}...;..}j...v..wV.....E.`.n....hs....U.....25.j.....\<...g.f..l...w`[....`..=:.......2.?s/...(

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\icarus_rvrt.exe.lzma

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	LZMA compressed data, non-streamed, size 50048
Category:	dropped
Size (bytes):	26103
Entropy (8bit):	7.993771307079847
Encrypted:	true
SSDEEP:
MD5:	5EA78A3959501E4FA1924B3EA9E1B244
SHA1:	AC80A6CE1431A847BEF6368082CFBF55A78C8536
SHA-256:	264182E7566F82B33845911D769F7EC3150EFDA17799450FF0C151FA1E6D16E4
SHA-512:	B35F00F0F07E42CC77977BF1CD8B26A86758666F0E7A6F4F0EF2EFD6F25D240DEED07C86F267E29CD376A7001423F519BE6E393BD360680A4D05468054134AF9
Malicious:	true
Reputation:	low
Preview:	]..@..........&..p.........../D.\|.........{...cl..KN......TS;...p....."...gW.....~...~....oF~;.6I\&...A...@...b!~h.7...iXOo..4.m%.......".61..B.....Y...UPt..,....-.-..)...f7Rv..#~O..G..c....b..d.#sw...xj0UeA.]Q.e.A..Ja..?.n..gC.....&.....^,?N......;.X.....l..Fxg.'P.$N.5..Ty.l-S.i..8g..P<-...w.L......xgK...(Tm...n.s..H.e.^.h.......R..Q]..1...h\|..dJ....o...._...^...........EV...~...........k...C...Cr.q.'.q.@..x.w...6!.9pu.D%.......?.#M.........a.w&..H<x .....Rp...(O..&W=.q=..`..f.......tv."....(...F.R..Nz...B...xx..qC{'..`..P.h.'p.U..a}...Z..[....}t.9..W.x$i;..\|P.lf.M.T.u../.P..?..0...9..Zv.\|...0.N..rl.].DSl.......=In..).>.? Q....SA...].....\.f.:........o.U.Ky.;wr.].V.[.:........Q...f../.D..9.<\...d...K.U.....Y^.9E......R....."O.....L.w.B=..... ...mW.<....)fv<[.S\|'B....o......T\'..e...3.\|YW.4.a..p.i....$m.%\|..c..=V,..Y.n.._8}q.@.'....JO...#O...m.i.s...e(.1{.z...v8.6..).;Y?.q..`.3.MU.b*...:..Q.....q....0G.....i4v.k...#..[B.\T.._..k.o..R.v..

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\product-def.xml

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	58041
Entropy (8bit):	5.1392497086077205
Encrypted:	false
SSDEEP:
MD5:	E35DD226D71E9D3B129315900E92F3E0
SHA1:	AF6FA7D1999861AB70F889C2D4656BF61CACA907
SHA-256:	6742B9A1147BFDBCD779794637669BD6DF51E0C5946D3CC2FFF0DB43FE4E7CA9
SHA-512:	B84E159B97A6ADB32123797284AD649B462687AA1E30D8808B582E56F77748783E0B4489FDBF67306A2E5B1A2DB5351B8C8D21AA5FF214561D471F5927C31514
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" ?>.<product name="avg-av-vps">..<product-defs>...<config>....<install-folder name="AvVps"/>....<full-name name="AVG Antivirus Vps"/>...</config>..</product-defs>..<group-defs>...<group name="base" mandatory-selected="true">....<action-list op="install">.....<delete-pending-files/>.....<commit-extracted-files>......<important>true</important>.....</commit-extracted-files>.....<expand-vps-version order-base="commit-extracted-files" order="+1">......<important>true</important>.....</expand-vps-version>.....<copy-path order-base="set-property" order="-2">......<post-condition>.......<directory path="%PRODUCT_INST[avg-av]%" exists="true"/>......</post-condition>......<src>%PRODUCT_INST%\*</src>......<dest>%PRODUCT_INST[avg-av]%\defs\%VPS_VERSION%</dest>......<ignore-same-files>true</ignore-same-files>......<move-type>Immediately</move-type>.....</copy-path>.....<copy-path order-base="set-property" order="-2">......<post-condition>.......<directory path="%PRODUCT_INST[avg

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\product-def.xml.lzma

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	LZMA compressed data, non-streamed, size 58041
Category:	dropped
Size (bytes):	13003
Entropy (8bit):	7.983880261429894
Encrypted:	false
SSDEEP:
MD5:	089C2F97337B718266A2A6EFB6DACBBA
SHA1:	E082B943A42A27362F425D3761CC9B75D86B842F
SHA-256:	16461899CF177138DE3C38699E8C48987C42E1E8D4C1EC13D33B8ACB2A9A9048
SHA-512:	094A0FB2D0D8631487C8563A1546FDBAC99F522FB6C113BDBF9CAFFB232A2EDC9526E44331F244B8700A2ACCA4891702D315D3B2F03EC9B7FFB8E5F4A9F08567
Malicious:	false
Reputation:	low
Preview:	]..@................f......{3....&.7d..>$....`K...H......8..:_..~...\......>./........%..H.......o...Y....9-.f.P!....p...tC.k.....[...j...7^..1......N8...2....`..D.X.....h.TXhJk]......k...3...J_..@[...URa.nK'.9W.a..Z.3k/.1e..gF6?.t...~.3e.=........BD....v...G7=..C.zM[B9d^..A...!....3BN3.(`..5T.....ZY&#AM.JA.......lnm.L.`x.......b@.`!...:...ZV.M~.P.%,.p.....Y..X2.oa.\.....}^....>.....7.{R=...3m>......I40Bua......[.q..Fn3j1....V6Wr..i9=P.'..a.y...\|...\i&..EP..x.[y....Y5z<...dI..e..D..6.G..5..%i^y\...O..:.....{...]/..%.[.......I+R...<\So...tPXA......?.T.+H.I.u.....~.cU.yTUq..pO....&=9.....X........RG...?b,....JY....8q.n.f/.<.@.... i;.@D.r/..-.r?.b-...]..g..e...wj.o...Ux"........6.o4...w.b......u.!j&<..`.M..?......._D}.~...@...eM...VJ..6>.....c.........%.q..6N0......!C..A..,o7..;.r.kE..>...aX.w..;p.!*{.6P.H........`o......-.n.\|.O.\.=]g^b.'.rU..........2.......6.r&.%......O.U.s?V....m..U.....A7..}.fk...)J........-.x.....ML.09...5=.F.Q....".B....'.7

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av-vps\product-info.xml

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5931
Entropy (8bit):	5.102599602211959
Encrypted:	false
SSDEEP:
MD5:	2DBEC3D1E120B0EA8544DE00B220FB78
SHA1:	012B04550403D5C37A660658B323BA350DC7F45D
SHA-256:	5CBCAEF8036EFC1E4B988275EA9E1F3B91DBAAF16075EC9B57C27E29065671AB
SHA-512:	BAD037A93DA945754A93B88DED6F057553765DB287E1B7F5A03468BB12B9B44B7958B79786C05727D25B56BEBB690D947640CE28613A27555684B79578B0F920
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av-vps</name>..<version>23.11.1302.3865</version>..<build-time>1699885801</build-time>..<inner-version>23111302</inner-version>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>8639967dfe4310d2c942052a45e0c47d7ab4ef6a0ec245aa67df3a01e81e07a9</sha-256>....<timestamp>1699885607</timestamp>....<size>6656440</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>9aacb21993e4e40a503c34fb2fa0e5fc315902b76ebb902c2eea340d84d17b33</sha-256>....<timestamp>1699885606</timestamp>....<size>7523256</size>...</file>...<file>....<conditions>.....<o

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\aswOfferTool.exe

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2375608
Entropy (8bit):	6.788210829063378
Encrypted:	false
SSDEEP:
MD5:	0880D2B9EAC0ED02F45EE45FBECC6F79
SHA1:	0A3259974922D9153BF90B6EB424703B959D47CE
SHA-256:	866371A1E681D19618F46F7AFAE6FB1DA36966289F7424B43853908F15B90959
SHA-512:	C19B659AFEC950F45744FEC2D595B5B31E7A30C6C918E20AD056E7AF767603A65632CAFA29C18AD4D41A6318AAB93D1C0E9786111C56E3FC4B5785E3EA63095D
Malicious:	true
Reputation:	low
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......XSn..2...2...2...@...2...@...2...M...2...M...2...M...2...M..C2...@...2...J...2..JG...2...2...2...\...2...@...2...2...3..%...p2..%....2..%....2...2...2..%....2..Rich.2..........................PE..L.....Ie...............%.L...................`....@..........................p$.....f.$...@..........................u.......v......................H.$.p)....#.............................@...........@............`..h............................text...JK.......L.................. ..`.rdata...0...`...2...P..............@..@.data....m.......H..................@....rsrc...............................@..@.reloc........#......b#.............@..B........................................................................................................................................................................................................................................

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\aswOfferTool.exe.lzma

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	LZMA compressed data, non-streamed, size 2375608
Category:	dropped
Size (bytes):	895025
Entropy (8bit):	7.999801818623886
Encrypted:	true
SSDEEP:
MD5:	A22CDF50AA1E3ABDA833FDEFC71D7457
SHA1:	E401F550A00D5313E03558D0255E230D5F12EE09
SHA-256:	488FBF9778ACF5FAE88BAFAD192D0FAEFAFE6DD2DED2D6EEDE1389836A8F8B8E
SHA-512:	5C6FA8B1C75B386975E43A6C73A7CC4B445962A2D02D26B1498ACB8511AAB07C8DF5BFADBCCBEC5AAFA4547766248A1CA79FACDE64804698AC71741FE0012732
Malicious:	true
Reputation:	low
Preview:	]..@..?$......&..p.........../D.\|..b..6>..p.}#......G...)p{` ..i=`...k.<....G..7.p..C..K.N...........'..w8...Q...Y...o..mi.#.../._(z..k.R.].....B..S....o.4`> ....x.c..Y.{F...^....7Yt-..{G.....\|..q..I.....p.7.$..B......bIb......y/...M.e{..5O.-...X...VO..2..g..I.....{....M../..l.{.M..+Cj.{..._..1.q.S.....q.8W}.....~..\|.\..........MJ...R...8..`V.>.Vn.f(....;IH.FF.TDC...X...O)E.k..~...t.1...'...w..x.T..,..r.mw.OV.Z....JU.4z.U.6...;.,]..x.\|..c.OjK0!.pd../.....Vq......0.kI..J:.#".M...iF..I(..WE.^..v...E<....DrlG.bV#0.....K...[.Od.d.....r....S.Kf.....(IWx..v4.H..$.;....;xQ......^.....R..+.=..I..F.....$........J.j5...;.+..B.......f..I........t. n.......".U'^.$.H.........tL.N.........N..h.Q...Q..iC=0..tjUx.:.....1[ES.v1.......E.bu..Y.23\|f......0....3...5MpY.. z........<...Z....."..V..R.{....,"..#.../.@...Nh..c....h..f/.&d!1;.y..nGA0.@.\.}....WQ/...Y..r+.w.r.....r...z..[........5.&.............{.4...Y.....vv.-h..g.Y.G*...D......',=..!.'.N...i.<.+.

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\config.def

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	661
Entropy (8bit):	5.390310578152796
Encrypted:	false
SSDEEP:
MD5:	C42BD28E844392DCBBA978CCD7119BCE
SHA1:	01B4390B52CC05C49B53A303D0839ABBF493A5E8
SHA-256:	A51EDDFD03A2411A3D0A380C6CA8EA23C41ED417CE4F9BA0E0DDCAC65867B567
SHA-512:	28FE72BD7678A2EC4419EDBA7036DB75D2860F0F3BC6C2FE6D49B702BFF598F548F9D40618EA838939E2D52497AECC3D7B86B435CF0123146DF300258CFA0F62
Malicious:	false
Reputation:	low
Preview:	[ui.offer.actions]..url=https://ipm.avcdn.net/..[ui.offer.welcome]..url=https://ipm.avcdn.net/..[bugreport]..product_finished_errors=45005..[common]..config-def-url=https://shepherd.avcdn.net/..report-url=https://analytics.avcdn.net/v4/receive/json/25..[ui]..enable_survey=1..[updating]..conceal_hours=1..fraction=100.0..updatable=1..[offer.browser.asb]..decision_type=2..download_url=https://cdn-av-download.avgbrowser.com/avg_secure_browser_setup.exe..enable=1..priority=1..ui.offer=welcome..[Signature]..Signature=ASWSig2A7267BD0512FD6DBC79DA524D9B380A646CC2DA5AE80AFB415E58AD6F6A606F852CE9F5B49820237E7DDC7261F2ACDCF4AD288837E019FF2FCC0E20B83C126DC3ASWSig2A

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\config.def.edat

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	ASCII text, with very long lines (2194), with CRLF line terminators
Category:	dropped
Size (bytes):	18271
Entropy (8bit):	5.645258877192454
Encrypted:	false
SSDEEP:
MD5:	40E291A25D7EBE5AB93ED33947A6DA45
SHA1:	1E5790FFC68A8FC699D5204EB12996F27CB16F33
SHA-256:	1D5E26D0BBC8486E987F53CC5E6BAE5CABC5EF470C3949246C4AB4467C3ECE0A
SHA-512:	67B2CBDBD34BF37A61FBB436E4582270C75F965D12AA5C662DF868EFF743EF6054D68D059EDAAB28D8B06F6CD9A25BA064DDE31A227ED88FAE575D0C9C04EB6E
Malicious:	false
Reputation:	low
Preview:	[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[Settings.UserInterface]..ShellExtensionFileName=0..[WebmailSignature]..GmailEnabled=0..MaxRequestSize=16384..OutlookEnabled=0..YahooEnabled=0..[WebShield.NXRedirect]..Redirect=0..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=2..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=1..[Settings.{D93EF81A-B92F-27FE-AF54-9278EA8BF910}.const]..ScanAreas=*RTK-SUPERQUICK;QuickStartup;QuickMemory..[AntiTrack]..Enabled=0..[FileSystemShield.FileSystem]..EngineLdrModuleFlags=0..[Fmwlite]..License_check_interval=16..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_fw=2..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicensed_period=3600..LicensedClean=1..UseGF1License=1..[StreamFilter.HttpPlugin]..ATisON=0..DohMode=3..Pinning=0..[OPM]..def_base=e

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus_product.dll

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6076352
Entropy (8bit):	6.470414355090496
Encrypted:	false
SSDEEP:
MD5:	503B4E0DCFF2FE2B21938181A203E7C3
SHA1:	576C8CB5165EDCC0D5B3066F7DF43EA881FE70CC
SHA-256:	CD56DFF96EE650C6840B60ED17A0ECD8B8A5CDB2724139580BD591B791E57B70
SHA-512:	30F863CDDE4C6367BC32ABD4C71E1CCC54187875BC52101533ABE8BE107C00D1FE9A8288A5B4E39FDD033B949DB9A3CC23D706AD7C62CF9FDA25507C45FFB935
Malicious:	true
Reputation:	low
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$..........#.p.p.p1.q<..p;.q...p..\|p.p..q.p..q...p..q.p1.q.p...p...p...q\|..p...q..p.p.p1.q.p ..q.px..q...px..q.p1.q..p.p...p1.q..p...q..p...q.p..~p.p..p.p...q.pRich.p................PE..d.....Ie.........." ...%..<..f .......#.......................................].......\...`A.........................................P......P.h.....\.h.... Z....H.\.x)....\.T....WH......................XH.(....VH.@.............<..............................text.....<.......<................. ..`.rdata........<.......<.............@..@.data....$....P..n....P.............@....pdata...... Z......FY.............@..@_RDATA..\.....\.......[.............@..@.rsrc...h.....\.......[.............@..@.reloc..T.....\.......[.............@..B........................................................................................................

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\icarus_product.dll.lzma

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	LZMA compressed data, non-streamed, size 6076352
Category:	dropped
Size (bytes):	1691537
Entropy (8bit):	7.999895705642368
Encrypted:	true
SSDEEP:
MD5:	67BA9B86CCF1741AEC3B11B0DDEA0291
SHA1:	7BEE40B9019B783A955AC8264CA53734913CB20D
SHA-256:	7AF127CD627006EEE31DD12E7AC925AEBFDEAFD4C061F968085C0A3487553C24
SHA-512:	830FD9FCD8897B70BA4732DE9ED90A5620BC7177D1069AA7F3DE2A280804CF1E8B6F18AA703F432971FB3AD2BE9EA5EF678FB18FF1A871A1CCCDDEF02862AD23
Malicious:	true
Reputation:	low
Preview:	]..@...\......&..p.........../D.\|......I0..y.]n.u......i...7.....B]......F2$1..../e.Y.....f...=.$..P.....,........p....<Hf..8..7..?K.. .^{ .H.ixm.z..r<..d#.....%d....K.....]q@...,..2..=.[....<.Ys......u-........d.....i.T.\..a.._r5..S.Z.n..U<w..vB/Pe..%.N.F....`.mz.K....xp[...!..g.#..`.M.Dlid.8v./.i.1.@>...)S...t..O..}......b.....0..3#..8.........F...E.FE....UQ#.......N~...)..6FC.u'u.`..o....?.N..Aad.qr...E..$....eL5.)...A.$S...4.T.KB.J..b.=....;(............X....=`n>..l.........jZ.g.z..8.S..q...O{.....'...?z.g......U..".vE.?.E.......9...9.\1{.j...[..r.gJ..._..c%...u....>(...a...5...<.ru..8.t".~...C..f6......O....._..KC6Os......fF.#R}.4n.=..A.z...w...>...\\|..@r.l...x.(...\.o...w....E9]5.Lh.{p.~}..UW4.8.bgY=I.]-.....M< .&?I_%.g..6..P..{....=>..a..e.D.....VL[.....]$.$z..Q... .g6....[..-.d..".4K.6>..XJO {...O<..Y.r}7j..8....Vw...g....kU....vB..1..uE..d.....#!..SF9w.$.G.*..H...0.W...d.E...%..I.o..g.....wb..F'......h>G..K..i.D..D...cM<B

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\product-def.xml

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1273885
Entropy (8bit):	5.395263786564599
Encrypted:	false
SSDEEP:
MD5:	15FA4420CA17AB6594958844CF6B5D0D
SHA1:	F67467EA0CCC29798A7A0724EC263F4A3D064273
SHA-256:	DB2DD8C222635077C0229B21762FFE52EF8E5A7DFDC11636DF82053CE488DEA7
SHA-512:	22D9B1D411EE8B215FD66657E87B296E04CF35D214B1AEC933D8E658A202B99BA779B8846EEF2B007EE89982915DF874E88996333236E0153BF78D8F8017013F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" ?>.<product name="avg-av">..<product-defs>...<config>....<install-folder name="Antivirus"/>....<program-data-folder name="Antivirus"/>....<registry-key name="Antivirus"/>....<full-name name="AVG Antivirus"/>....<languages>.....<lang>en-us</lang>.....<lang>cs-cz</lang>.....<lang>da-dk</lang>.....<lang>de-de</lang>.....<lang>es-es</lang>.....<lang>fi-fi</lang>.....<lang>fr-fr</lang>.....<lang>hu-hu</lang>.....<lang>id-id</lang>.....<lang>it-it</lang>.....<lang>ja-jp</lang>.....<lang>ko-kr</lang>.....<lang>ms-my</lang>.....<lang>nb-no</lang>.....<lang>nl-nl</lang>.....<lang>pl-pl</lang>.....<lang>pt-br</lang>.....<lang>pt-pt</lang>.....<lang>ru-ru</lang>.....<lang>sk-sk</lang>.....<lang>sr-sp</lang>.....<lang>sv-se</lang>.....<lang>tr-tr</lang>.....<lang>zh-cn</lang>.....<lang>zh-tw</lang>....</languages>...</config>...<vars>....<var name="%V_PRODUCT_PREFIX%">.....<desc lang="en-us">avg</desc>....</var>....<var name="%V_AV_SVC_MODULE%">.....<desc lang="en-us">AVGSvc.ex

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\avg-av\setupui.cont (copy)

Download File

Process:	C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7523256
Entropy (8bit):	6.460723535404394
Encrypted:	false
SSDEEP:
MD5:	00F3158AA3CAC845A8DDBCE86CF20560
SHA1:	8A4F81C33DE9DF0B93408035E7F3B01549775299
SHA-256:	9AACB21993E4E40A503C34FB2FA0E5FC315902B76EBB902C2EEA340D84D17B33
SHA-512:	F3BF4729DDE81FB99A501725376FBDD57EB05F3290D314A5F9742C4DA7E794D3EA85B6BAD6C07F1103707261EF78B38D0A9AFD2FB75FC62ABFC27A59FF533A6E
Malicious:	true
Reputation:	low
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........Q.[.0...0...0..rB..w0...OL..0...O...0...O...0...O...0..rB...0..rB...0..;^...0..;^...0...H"..0...E...0...0...0...E...0..rB...0..cE...0..rB...0...0...2......M1.......0....N..0...0&..0.......0..Rich.0..........PE..d.....Ie.........."....%..N...$.......+........@..............................s.....2Qs...`...........................................d.....d.d.\|.....r.......n.\| ..H.r.p)... s.......[.......................[.(.....R.@.............O.......d......................text.....N.......N................. ..`.rdata...7....O..8....N.............@..@.data...`\|...@e......,e.............@....pdata..\| ....n.."....m.............@..@.didat..p.....q.......q.............@..._RDATA..\.....r.......q.............@..@.rsrc.........r.......q.............@..@.reloc....... s.......r.............@..B................................................................................

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\35629e3b-c85e-4581-a75c-9aa7dbcac5d5

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 1214392
Category:	dropped
Size (bytes):	467612
Entropy (8bit):	7.999636345062246
Encrypted:	true
SSDEEP:
MD5:	BB8A675566D317C0724C47DCE085DD81
SHA1:	F4AF3F6C85C2E149597CF4D898740946A961361B
SHA-256:	083C39A778DA81D23317EBD195BA281A7322B9A7E1C7F6F6908F08F40A63BDFA
SHA-512:	6BE5F4C8B11980D69E6B4B812FEE8F3CEAFCBD6E1EC8FA2D50D24AF8A3C1C546CA56CDBE7E77B2DB6571747C5F94C56A30DE4EF6E9F2476E5C86C6EEBB328140
Malicious:	true
Reputation:	low
Preview:	]..@..........&..p.........../D.\|..N...mx...6.`....U....U6.2..}.a.Ys..NY..T..:D.0Ww..N...X...ara.I........[Hq......5C.{....rMl;.$...1.......M..)[.1..=....G.....,..2. ..Z.<......... ,`;...E.?.z...X.l.=...8p9z>..."7.3..l~-.''..J.=....q.".C.wfG......J0s/.,.&J..-.%...7.T.aT.@..f.I.O..mV..1S......./.}.y..'&....(..5.FL?h.K.7...\|/........+.GF....d....w+!R..an....9.j.....`R .q.`....F.3.U{."I....7.Y........A..!.K. .?.7.g})...Z.SS.L...L.s..........d.<.l.\.Z.......j.Dr>.A..>.4.k.._X.x..'y..QA=.9...y......N.n^..\|[0.....$,...q.4-....U......(cX].}.........Q......Z ..a.x.G..A'r^..>m.....{$L....m.....O..u......"p#hg.O......%..\|..../{...K...mY`\|.S.[R...f..qj...e..V.%..[w...a.C.}.`w83.dt5...O.....'z"........9..j.........E..h.g(8.>u...Y.1.j...p.d[..`k..U...C.O@.~ed....u..\|.... ......t...T.h..pW)...L..k......%..t#...Gu...e..Iny.....R..r.n).O`......`..t. "..9.%.l+>...q.........m.....K..RA..g8.......Q2U5...Yb..U.b)..l.}.z..f.Bq.h.EQ..R........#n.x.....7.

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\54887df2-d3ac-45fc-9c02-400e5761c668

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 11635640
Category:	dropped
Size (bytes):	3770192
Entropy (8bit):	7.999948420411957
Encrypted:	true
SSDEEP:
MD5:	365FDBA69862880DCB1677A01C632E80
SHA1:	96CA44968BE75B563B12D41335CE973039E7B479
SHA-256:	6B4BE06AE95842FE7F25EE3F82A777466597476BA16C6B4218D1B609A27133CE
SHA-512:	BCF6838F0FEA102FD4D3BC20157E902F178FBD9C71A0085517D55DF59B0C3DE138994DA7C076E03C7B7F6D0E3B0188C9C0056A71A36819CE2A754C09FA534437
Malicious:	true
Reputation:	low
Preview:	].............&..p.........../D.\|....o.e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg..S...$R..O.^...@...2a......l........@.xqk..\.H..3......<A.6.....l...G.....BN...>..=..P..j[..........h..~soT..r...A..WG.Hs.........,.[..E.k..<K.....d.q.LCis.xs.z&.{......F...whNtn.1.o.u.E.N...T.h..E...."q.._..e...3k(.................w..>/.."..3!.n1H..,0"............B.YY.8q.t...Md0.........J.N....N.)...FuN.P.].....6[.4'b..Y..k-.16.~...U.g.+.Q..m.v..s.q"uH...xi\|.......V....m..b.W0b.....l...x.A.u..1#=.s.A..5.....p>,.IR.c.......q.{.6q..-F./...m....9Z\.N..&B.......N...K..+a.g..z...+.....#.j7...s.$l .5C..\...,...$-.e....W;......b.zC.."..7....hl3..os4.....)f..}...U..P\..M.6....5.>......P...YEn...........jT.y.5Uo.....XO..~@.+Z..:n..... `.. .S...,Q.4..wv.\|..<.J.k..4E..t.U.._h.f.......@..B.)pd..d]9...v.;n....Mp.E..&A...,.=..QS.m..:^!..`.*.#Z.[.HqE.@'U@.J5Y.E..?W.._=/...8.~.....r...52.ef.b:...`.#.e...p70h]1...X...?..q...]`_.K .?.?.........{.1.6

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\a90d63d5-51c9-4bdb-92db-a76eeeff3ae2

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 15296
Category:	dropped
Size (bytes):	9552
Entropy (8bit):	7.98045251015447
Encrypted:	false
SSDEEP:
MD5:	5751F90923D39573F3847A28A6EE4EEE
SHA1:	130EF41B16B7735C1F45EFA81331EA8E81B9A18E
SHA-256:	67C3B970F86558F3C769BCB301A89102616E19549DAFDA74E0EF201F023792BF
SHA-512:	231E356693A1A3C4C2A8F67B7580015387575A83F72E7A180E414C17887DA97537120A63CE81903D8F00287A8D0E737C7D196F788006DD91AB82658E7CE011F2
Malicious:	false
Reputation:	low
Preview:	]..@..;.......&..p.........../D.\|........{...cl..KN......TS;...p....."...gW.....~...~....oF~;...l..f.MP.%.B.d...w%.6g.T./........9....8../..}.??.j.O.<U\|.;.=wm.uz(._`h.f...];..N..k.{...PE.@'.u...h..d^2.l._..Ni=...cU...].m...q5.........n.......#.(l....s.,W....k.g .=;.v.W5.."Q.I$>.)..}..."7.}...$.........\.HW....RN=....\|_P.c.".x...5.z....p.j.`.$0.q...F...}..#Y....W..8....?"-Wc^R...F.5.-.a.7.`...2...V.!..>.a.rr.)5kq..U..e".Ji.Yk.T"..%...7.....;A+..7U.U/..>..$'..`.v......+....8:7...Y......W..#..K<....\|$....V?8..b.Z`..~..J.f.m^8T;...E.....lw;..c.H... .3R..j[..0{..EA..Z...J...7.t/Zmd%.P2./c......-w=...c...1N....JR....i.E....l.#.y.b...........{[..v..!..,...w.`.0Cm.......W....<.....%.:.... ..."....y...~....}!.D..I...b...."Q=?..xq..<..C(..I%.............{^$.]..\R.w`.S...C...2.d..=e_..<>n...lnKj.d....2.u..f0.....@..o..Q..a....R5.....GR.UN2.j.I..?.zzdvh0..N/.;z..2]MSZ,....1l.{7.ksz..Sz.\|D..]=.'.A..O...;...m.,..//......}R..gF...(]S.....y.h$@[.....

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\b1a48d96-62d9-4a02-9e4e-df840d3f50e8

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 7523256
Category:	dropped
Size (bytes):	2257817
Entropy (8bit):	7.999930357134181
Encrypted:	true
SSDEEP:
MD5:	643453FAB6F5EE70CF09B21E872D552C
SHA1:	382162FED581CEF0B8BFDC832BE244C50EFDCA8F
SHA-256:	6F1F8669BE6B32D4935B5100698DF587E28D4631F3C7CD8378A8A6E0DFBB23A9
SHA-512:	3027FE46466F7FD39C2A251ADC9BBAB13D18F09A96A3F25F1C83795EEA46A0839FCACF4A9AB1B8401F3B9E9A418239EBB75C7E1DCA7C01D735F2EE3790027451
Malicious:	true
Reputation:	low
Preview:	]..@...r......&..p.........../D.\|......e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg.:.;..@.U.-s.T-..~hH.....6..+C.;..y._.E..0xq_....H2..... .vx....[Nvg..}j.<p.jR\|.....N..k.J.^7...{x..B.jb...~..f.3.........;..FX..B.... ..f..)....{2.....q..m.........6.f..o..}...\.H....\l..yS...W..S.....X...._Ns..+..'..J....`..{r.b..%\.j....k+.,...}.....5.>..).y$....v..X..C.{9/CT..I....W}+^........rn....0..86._........?.E...~ng.C7.....)+..,d.(....3.J...%.f..W{...b1.........{.........H.....Kz..?7.#.c.{......E...g.(....E......3@d.{.X.7.;~..?...O../N..,3...=[Q.............M.asw...'-.YP... ..2..T,Qcct...1./....[-=.X...B`..w.3...M8.fTb.$..z+.......)....D..+..#..7!@.:.-..3..nw4....?\...[.."..U.'..........-.....x8o}.].T....I.c0.$.j..Mt2......$...l.>......9.w....X...]..P..b#..X...H~...m{.C.T.....%..?..(1c..F.Q..W....f.w0...?d.[..6ga.:J.!........eb.....L..Ygy....ck.D...#...........Xp....HvF)O......Fne6i.jhx.d.G...w.h\....`..L>r....b...R.+..%I.

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\b6c2f478-64f6-4ffb-a288-1ee9a291a6ff

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 337132
Category:	dropped
Size (bytes):	341899
Entropy (8bit):	7.99938086548515
Encrypted:	true
SSDEEP:
MD5:	E596094168938D6242C8C2266B47CB4E
SHA1:	8C864CFDA9FF4F2AF88D19CAF43ABDC7AF674F4E
SHA-256:	CAA65B7CE6C9728A01140C07027698B8C84FDED1108E095D9B90AC1D4E16BEA3
SHA-512:	77094540562C6313EEBDF274D2B9911464B3EF526453EABCC92703B97213F3DD1F4A79AA028DAD825E1446FE2C62553A8E75DA14CE1A458C867345049A62B3E0
Malicious:	true
Reputation:	low
Preview:	]..@..$.......~..E..8... .rZ.~0..9.I...JU...m.......u;bR.#.)w.`.d.........f....&.I.............I....mV...E_s......./.h3D`(.=....]q..\|......`\|H....4....V;Bf0..W@..(.)mcPe.=..]..D....$.H`.s....N...(.........Ax...N..cHU..3i..V...wt0O&.....m.{._.gR..Ie.5......<..3...LcG.._...c..~....5,....J..T....\|L...y.../.!....^J...g.c............%RP.n.A.......T.?.D..\.g..]..I...U....o....x.4B...<........D...s.$d...F.P.t~..^.....=.g@......B\...1d2.X...g..S....o...-...w\|.ub.U..x.}&...h,.v..i;5.q...G.j'...I.....>8.rj..9BD.,'-...9^f.....XV.....x.v.6!...>.n.a....9.C...~..;....Qx..p......T...C..._....4.Y.k...m....Tx..d....N,N.i.".4..H.'.8..LoP.C.a.G..I.....]/.!?;A.a&.q..B3$9.i.....!r..(Y#....a1...N.....(.'F.P?R.^.]A1K.O.%WRM.(@.x..~.`...t0.i....uwx..F(..6.....]Q..M..."o.#.... $...r.@.^......Q.X...l...ea.7\ne..z..s....L...w...]...6og4.<L.....D..&.\ru.R;.\|......]..- .5...vV.t.`........[.T...)..J.' ..>.`v.....\.%..@.v....=z....+.......y..cDq.&SS.....f...

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\bug_report.exe

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4883384
Entropy (8bit):	6.514490815961128
Encrypted:	false
SSDEEP:
MD5:	F0AD6609B15FBA048671A46959B34D12
SHA1:	02EA65D9FB66AB8684215C388C04F496E570FFE3
SHA-256:	9522B2B05DC88174518CC635909BD39EA1AD017B972FC0B84C0B2C66FE20C7FA
SHA-512:	A86634798C703685F66E562E79BADD768BC168A6182CBDA4DF9A740177B3ACAB8BD5A33B31DE3FD77501ADFBB81FAB71796F76B678CC455B3D3061FD1E1CA4AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......x.\.<.2.<.2.<.2..7...2.)...0.2.).6./.2..7.5.2.).7.K.2.).1.6.2..1.,.2.5...>.2..6.:.2.j.6..2.<.2.0.2.j.7...2...6.=.2..6...2..3...2.<.3.h.2..e;.d.2..e2.=.2..e..=.2.<..>.2..e0.=.2.Rich<.2.........PE..d...Q.Ie.........."....%..1..>.................@.............................PK.......J...`.........................................P~@.....8.@.,.....J.P....pH..L..HZJ.p)....J..g..P.9.......................9.(.....9.@.............1.h............................text...J.1.......1................. ..`.rdata..p.....1.......1.............@..@.data...@.....@.......@.............@....pdata...L...pH..N....G.............@..@_RDATA..\.....J.......I.............@..@.rsrc...P.....J.......I.............@..@.reloc...g....J..h....I.............@..B................................................................................................................................

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\cd423ba8-8e08-4b9d-bb30-e4dbda938cd2

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 1273885
Category:	dropped
Size (bytes):	137205
Entropy (8bit):	7.998577280392648
Encrypted:	true
SSDEEP:
MD5:	B8FA33AF93005609A0E96C5D5BE12306
SHA1:	4B0F22B11484F58AA46181233318AAC96F4E020A
SHA-256:	F42F79B0EEAC5415B8093857FAD9C0DC6EB6700790BF89CF623800708018DDB7
SHA-512:	35CAF4AEA861007834581B87E0DE0AE1D81EC2C8852F9D20A17D9F65DB1A7D2E1F066E695A510C6965498FDC2DAC048EC536F92361124E3F4C158F7351D47518
Malicious:	true
Reputation:	low
Preview:	]..@..p.............f......{3....&.7d..>$....`K...H.......4...^.a.)....0C:.6..n.f.c...j...$Px...........X.PMf$5.B....O..DN....[.d..s..s..M..:B..(.N..L.?7=~Rg.[...N!."..8......1uW.#....;u<Q..MC..Kl.#.9!U.3N..N...^....Gp..a.@....-.m..Q...c.6.....]..vK..I..(.<..s.1h.r..)y.]!J9%.../.(]X...%."....Y.,.J.......Z..T,....u1.&......n..&.!E$Dn<..;."....@..90H$Jk4..{i%.@^...q;.%.t!......Md..fJp) m.0..>3......hs...Y.4..<...Q8.$.@.n...u..N..X..ia.f..o.."....b<...^X...z.U;..[..[....A.`.W.0.X..l...v.GfM.9..y..q... $.....4E..Xd..[l.>..R...z../KjCd..9J...!.O..U.^.l..].S).zLS.[90....O."0...kX[$V!...b{...1&.@a{....\|.Bg.....d0K.KGS.....r.h.]m.9..}.>Y.Ha..Sh.\.UgmX.......Hm.!8.?..k..r)..z.M........bc0:...N9?Qf.w78.....j.C y...;...V8.8..'....HE.Ur..A.,.4.....k.:'Vm.M.J.`..V.....`.U#...\.8.T....C.K.H..#UD.?..#..;..#......P.!...(.QS..v*...>..T.....T...65.vX{l..8.G..E......A.....+.Q...G.<..!k.....f."._...&.t...Dm....wZ.-..W..uX.zb.....Ru..h.-.OV..c.^.l..`..

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\dump_process.exe

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1214392
Entropy (8bit):	6.594069750858168
Encrypted:	false
SSDEEP:
MD5:	753B023DC1463ECD7B3F8807D2C5EFC9
SHA1:	EC45BED427E799844154D008BEE2AA9D7B07715B
SHA-256:	C2295B9476901AE35FDC80DFD888AA056D15D1EF8DE6DE4A3E85F583AD65A5E0
SHA-512:	59BDA01E96C0E3EFDA02DFB9ACE0EA5E962BB117BCA83F0AF0A02DF04A609BD755FD538BC1B960E154CCD23D596AFA6A46088E274CD96ECF239900505A0B9DB2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......6.9.r.W.r.W.r.W..T.u.W..R..W..S.c.W.g..p.W.g.S.`.W.g.T.x.W..R.{.W.g.R...W.{...p.W.r.W.q.W..V.}.W.r.V...W.K.^./.W.K.W.s.W.K...s.W.r...p.W.K.U.s.W.Richr.W.........................PE..d...0.Ie.........."....%............P..........@..........................................`..........................................................p..`Y......$...H^..p)..........$...........................(...P;..@............ ......<...@....................text...l........................... ..`.rdata....... ......................@..@.data........ ...^..................@....pdata..$............b..............@..@.didat..P....P......................@..._RDATA..\....`......................@..@.rsrc...`Y...p...Z..................@..@.reloc...............H..............@..B........................................................................................................

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\f7598da6-300b-4836-84a4-2e66e663877a

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	LZMA compressed data, non-streamed, size 4883384
Category:	dropped
Size (bytes):	1425824
Entropy (8bit):	7.999861038873463
Encrypted:	true
SSDEEP:
MD5:	3BC7FFD88AC7AF9413B613E0296AF775
SHA1:	4375F225A5CA303E2BDCBC6D8FC241D42295D015
SHA-256:	C32A7FD20A2A0FA4287AFF42C10FEFB2E43F9E8AC0F211695871B542083D78F0
SHA-512:	6A2285227650FCF3F52178A036E1958E82A12CC9F7058491A7B206C6F3E940BE791B28982082D4D196D81D5C2D1D11BC6FFAF5E5B5BDC7B2A4D1970D44E2F64C
Malicious:	true
Reputation:	low
Preview:	]..@...J......&..p.........../D.\|..y..:.}.._..G...5mA..aQ..c5t ..+........w.uRl.,E.u9....r....dV.....B.2.M...T0..C...SG.(....c...3..ln...O..5Z..F.....&cZ..z.H....H..M...+m.L.k..r..b1.!.I.W..F...P\......1..}.T.F.........9,1]P^.....p.U......0...P.t....gp..........[b.a...N....;...._.D...$...i..uu..[@..o.gWcL.U.....u....\..`^.....19.m5s..[...Y..Z.6z.'......(..<..R..`U..q..\|..<D...l:..e.(v..`0wx.j#.3.%...0p"c."5...j.n.8....&.4.C..v.....A>.wV.\|.0S-.)3.f.Nc.mx..d..D.V..)...YP..rLe.3.J.A...Y..$.../..f.%.h.4.K{f,sW.....j.....B'...`.9.~..0.....i..P"...h2T.k............!...5.t.....yp.....nQ.JA&.B.d6..S.J}..P$.i...A?...qvg.<..T.E....0..j74.......+e%..N..4vg.......Hs...`>K-.C.)....X....6..m..lR......8...5.U...3.oo.2....].d...8W.9..[...z..Ha .tQ\...x.J..rk.....PXU..9h.....}Z......._/m&.....oe.).<..s.......G...?.u......V.5....=n./.w.m.XO.+.H,..`....FF. b.^K?.N.H,WJ..o........9.,..N..v......?&g....P.x.\|i..(.A.M.v..n>.(..se.....)...[..1.A...SV;...K...

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus.exe

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7523256
Entropy (8bit):	6.460723535404394
Encrypted:	false
SSDEEP:
MD5:	00F3158AA3CAC845A8DDBCE86CF20560
SHA1:	8A4F81C33DE9DF0B93408035E7F3B01549775299
SHA-256:	9AACB21993E4E40A503C34FB2FA0E5FC315902B76EBB902C2EEA340D84D17B33
SHA-512:	F3BF4729DDE81FB99A501725376FBDD57EB05F3290D314A5F9742C4DA7E794D3EA85B6BAD6C07F1103707261EF78B38D0A9AFD2FB75FC62ABFC27A59FF533A6E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........Q.[.0...0...0..rB..w0...OL..0...O...0...O...0...O...0..rB...0..rB...0..;^...0..;^...0...H"..0...E...0...0...0...E...0..rB...0..cE...0..rB...0...0...2......M1.......0....N..0...0&..0.......0..Rich.0..........PE..d.....Ie.........."....%..N...$.......+........@..............................s.....2Qs...`...........................................d.....d.d.\|.....r.......n.\| ..H.r.p)... s.......[.......................[.(.....R.@.............O.......d......................text.....N.......N................. ..`.rdata...7....O..8....N.............@..@.data...`\|...@e......,e.............@....pdata..\| ....n.."....m.............@..@.didat..p.....q.......q.............@..._RDATA..\.....r.......q.............@..@.rsrc.........r.......q.............@..@.reloc....... s.......r.............@..B................................................................................

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus_mod.dll

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15296
Entropy (8bit):	6.94739231872254
Encrypted:	false
SSDEEP:
MD5:	D82C7E7541B0FB4BCC07230A464110F3
SHA1:	0A87229BCE0C54F6397CC27F77AF0CCC5455687D
SHA-256:	787F09B46F996C1835532A9A0BD03D3D02BA200655F59D09067AEA164E581FF7
SHA-512:	862FD12C2D73C5BA9795B4EA8017F32AB920DBC37A3993C9F8245168765856C2D868184915013D6A26BF6E40CF408EADB94B1F128AE4DEC3FD7F28C7E76C55E5
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I..I..I.....L..I..O..p..H..p..H..p.*.H..p..H..RichI..........PE..L.....Ie...........!...%..................... ...............................P............@E........................ !..\....#..<....0..............H...x)...@..(.... ............................................... .. ............................text...U........................... ..`.rdata....... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\icarus_ui.exe

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11635640
Entropy (8bit):	6.579272954760448
Encrypted:	false
SSDEEP:
MD5:	9E6DA0FFEC832DCB2BB0626E2FAB333D
SHA1:	A89F931B7C7FDC69D6255C4D7291EA3506A1B93E
SHA-256:	3746C214ADCC94110A99A9839C57CB1CB4B2CFD0F461909252BFE3AD2A0AD7D6
SHA-512:	B6553729876D1B80416470AC409EA72D6EB35EED6D858A9485ADE0DBB2A35A228DFF5A1046CFBD31D99BA3F5A49284B23DB102292728A9D2F90B10A50821A680
Malicious:	true
Reputation:	low
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......{^tO??..??..??...M...?..@..6?..@..+?..@..N?..@..3?...M.. ?...M..p?...C...?...C...?..6G..=?..??..9?..iJ..<?...J..>?...Q..=?...Q../?...M...?..??...<.......?......>?......>?..??..=?......>?..Rich??..................PE..d...z.Ie.........."....%..}...]..... ..........@.....................................G....`..........................................0.......0.......`.......p......Hb..p)...p..T....V.......................W..(....U..@.............}.x............................text....}.......}................. ..`.rdata...."...}..."...}.............@..@.data.....3......p...n..............@....pdata.......p.....................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc..T....p.....................@..B................................................................................................................

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\product-info.xml

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	9649
Entropy (8bit):	5.278159979082773
Encrypted:	false
SSDEEP:
MD5:	99E057887AE3F79F25A67DC5310CBAD1
SHA1:	D8279985D5EA20F650B7FCA1AAE06C5986FB4459
SHA-256:	78C1C0CF2BB4B724E7B2C9795FD3A396495408EFFD1B574BE5BD79736E06603B
SHA-512:	E523C34E32A9E23358CD1E67CB9A7E8EA14CB7A615B11FE831E17505EFB10283DB5A7031AC424C569B48B2F9E5FBE8A015F5ED7F96180C315756F82E34898E0A
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av</name>..<version>23.11.8635.1292</version>..<build-time>1699445908</build-time>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>8639967dfe4310d2c942052a45e0c47d7ab4ef6a0ec245aa67df3a01e81e07a9</sha-256>....<timestamp>1699445789</timestamp>....<size>6656440</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>9aacb21993e4e40a503c34fb2fa0e5fc315902b76ebb902c2eea340d84d17b33</sha-256>....<timestamp>1699445789</timestamp>....<size>7523256</size>...</file>...<file>....<conditions>.....<os platform="arm64"/>....</conditions>....<nam

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\common\setupui.cont

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	XZ compressed data, checksum CRC32
Category:	dropped
Size (bytes):	337132
Entropy (8bit):	7.999469820311664
Encrypted:	true
SSDEEP:
MD5:	CAEC84795D36C4FEE0531BD5909CD57F
SHA1:	11F80D629261CFB83FC8A25692231FF372B32478
SHA-256:	20BE6A7EC202B19F740F397C6BEF348851560FB3CCD60B0B2F0DF90A8E5C192F
SHA-512:	FEBD68EBACAD81A512798ECA24458CA56969A979110DC8251C5A6D495868F9081E410923C13C724B6E6A20491AD85BA1729E4F12122199FBBB833A2B650B58D6
Malicious:	true
Reputation:	low
Preview:	.7zXZ...i".6..!.....#..,.8..].0...?..Lm.K%. .6.X.....L.@#.....n......0.iz..,.z...s...$..fI.>.i......h...#..gL.t.\|z..(b.\|.l..J%..n0..~..-.:.+..".+^>Wt...Kb..#=.3#..q...........Fo.ed.....#.3..A%..}L.A.Bk-.]...S.>.AP..rz....8V..........?.v(..B...i....\.>...&..S..........wS...8...e.D.~._..#o.P6....e<Xs.1..vP..{.>.v..%.r2p..I..q..d..3}&.%+..p.;....7.>...qj.Y....#.y.A.~.......m.N.H!..q.Lxp&\i.F..o..}.l.!1..9.9p<.....9\|..J.n.T..R...8(.B.6..4.SM.)..P%c=^..6...Q7.....JBoo.[..h..A0....4_a...D......,!._[5(./....{..n8E....u...\..^.eZ.E.@...#k..6.A=.[.h}R.........Y..&.........8......[.5h..c^/..3..+..a.V=F.j.G.`e.>m...J.a.4..bQ...5/Ox..\..].....;.H.U.1....XD....5...G..'.1.k.4..r...7..4..v..u.;jJ..T.e.~x.%V.W..=.ul...42e.rxN.c.a...sT\...9M.A..0.8`.\|.G..hS.4...)...b..m.5%..%2.w......5~jP.g.$.GT...w/Pb;H..\_....4'v......I.a...W....c.B...'F.u.....D.m....,..'K..tQ2.eI.&..7......v....A.....>.D.y*`.".R......xaFx....3....F6.N.i{.3.j.{.;...z..q.}..\|..N..i..4.d%.&..f.......R

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\ecoo.edat (copy)

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.422577995321604
Encrypted:	false
SSDEEP:
MD5:	3F44A3C655AC2A5C3AB32849ECB95672
SHA1:	93211445DCF90BB3200ABE3902C2A10FE2BAA8E4
SHA-256:	51516A61A1E25124173DEF4EF68A6B8BABEDC28CA143F9EEE3E729EBDC1EF31F
SHA-512:	D3F95262CF3E910DD707DFEEF8D2E9DB44DB76B2A13092D238D0145C822D87A529CA58CCBB24995DFCF6DAD1FFC8CED6D50948BB550760CD03049598C6943BC0
Malicious:	false
Reputation:	low
Preview:	mmm_irs_ppi_902_451_o

C:\Windows\Temp\asw-5df2d909-5b4b-480a-bf74-871bd5941ba0\icarus-info.xml

Download File

Process:	C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1910
Entropy (8bit):	5.415577268169904
Encrypted:	false
SSDEEP:
MD5:	42F1C8B5292BD31AD59789EA620CD400
SHA1:	4DF4B67A592B1DB48986AF3E8AFF9C0C2F933990
SHA-256:	678172035775BFBA631B6C4368B5A72AECAF1CB5305F90FDCAA671F021863450
SHA-512:	7F7050A5C03DA8091DCE93C1D7855CA459342A583842D4FA3FED0E0ED1FF56EB626E6E45B85F9D5634C14C3208308836CEE676BD44BE90D109640826FF04D20C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.<icarus-info xmlns:xs="http://www.w3.org/2001/XMLSchema-instance">..<file-list>...<file>....<alias>sfx-info.xml</alias>....<sha-256>a08cfac305d3933e888e294552576340a6f9564fdfe10884b581de76e5da915c</sha-256>....<offset>1446982</offset>....<size>722</size>....<timestamp>1699961778</timestamp>....<flags>0</flags>...</file>...<file>....<alias>avg-av\edition.edat</alias>....<sha-256>e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb</sha-256>....<offset>1447781</offset>....<size>2</size>....<timestamp>1699961779</timestamp>....<flags>0</flags>...</file>...<file>....<alias>avg-av\config.def.edat</alias>....<sha-256>1d5e26d0bbc8486e987f53cc5e6bae5cabc5ef470c3949246c4ab4467c3ece0a</sha-256>....<offset>1447863</offset>....<size>7153</size>....<timestamp>1699961578</timestamp>....<flags>1</flags>...</file>..</file-list>..<file-mapping-sfx>...<handle>260</handle>...<size>1465760</size>..</file-mapping-sfx>..<sfx-cmd>/silent /ws /psh:92pTtVrLPUz

C:\Windows\Temp\asw.bde788a01c0620e3\avg_antivirus_free_online_setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1465760
Entropy (8bit):	6.810005292068387
Encrypted:	false
SSDEEP:
MD5:	3771842CBB051810EA827C3855934A32
SHA1:	08E3DE8B62366C8E7EB54CCDFA77337AACA3DB24
SHA-256:	C46572AE6FAD7569E626CEB3F807542ED57769A756EA88BD06B996878EAA2EF5
SHA-512:	F12920756A74602E224E3D1BBFF82C9EDA5E3ECB5E3E98497E9561831A925BB704EA7035A7C694382E7A4EF262D0FE2FA8345F96B74374524297A920B7A1F39A
Malicious:	true
Reputation:	low
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$................?....?..R.....x.......................?......v..................?....?........^....6..z....6.....6z.........6....Rich..........................PE..L.....Ie...............%.`...j......@........p....@.................................j.....@..........................5.......6.......@...r..........04..p)..................................@........v..@............p..l....3.......................text....^.......`.................. ..`.rdata..b....p.......d..............@..@.data...@....`.......F..............@....didat..T....0......................@....rsrc....r...@...t..................@..@.reloc...............X..............@..B........................................................................................................................................................................................

C:\Windows\Temp\asw.bde788a01c0620e3\ecoo.edat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-T7S36.tmp\prod1_extract\avg_antivirus_free_setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.422577995321604
Encrypted:	false
SSDEEP:
MD5:	3F44A3C655AC2A5C3AB32849ECB95672
SHA1:	93211445DCF90BB3200ABE3902C2A10FE2BAA8E4
SHA-256:	51516A61A1E25124173DEF4EF68A6B8BABEDC28CA143F9EEE3E729EBDC1EF31F
SHA-512:	D3F95262CF3E910DD707DFEEF8D2E9DB44DB76B2A13092D238D0145C822D87A529CA58CCBB24995DFCF6DAD1FFC8CED6D50948BB550760CD03049598C6943BC0
Malicious:	false
Reputation:	low
Preview:	mmm_irs_ppi_902_451_o

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.999842772173318
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip
File size:	1'192'377 bytes
MD5:	5e6ccbae7e98529febf929d16266987f
SHA1:	5f70c4d02eeb8c2ccfc1e55bb1c20561f4a99dd2
SHA256:	f5efe4bd130acb6905088afb7ebfa1ec3de6aa4f2bcd6cb6605abf4484956634
SHA512:	11be48bb104885b29efd6e688da292121f3669b069b019a133d89e54cd41d1021cafbea6aebe5e2978b8ebcef10542f81e5dd85014afd1376d1461742326fcbf
SSDEEP:	24576:IOG34t/380sE2UvB6jrbuS41iD1smRXemlDmV/mCHchOSl61jt:JEUp6juS41csp+DMuCHcgSl61p
TLSH:	C3453380BD861944D7876FD3CC6E85FC55A65BC263EF3D65B1266CA40047E382EBC2B8
File Content Preview:	PK........;{nW5..1.0........$.mozilla-firefox_qK5-VP1.exe.. ..........Y,......Y,......Y,............Z..B...x'..0~........,<..........R.i.Nm!....~^...I.l.l44..GI..rc).$Uz!..]L.HMMpa.,3u. .8.eo..mp/Bc`Y._.O...=.e[[.ZV..2.}6....5..:jNfS.&....3..r..5.._-.q..F

File Icon


Icon Hash:	1c1c1e4e4ececedc

Source: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\is-EOSUU.tmp	Avira: detection malicious, Label: PUA/OfferCore.Gen
Source: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\is-EOSUU.tmp	Avira: detection malicious, Label: PUA/OfferCore.Gen
Source: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\is-EOSUU.tmp	Avira: detection malicious, Label: PUA/OfferCore.Gen
Source: C:\Users\user\AppData\Local\Temp\is-O8FHU.tmp\is-EOSUU.tmp	Avira: detection malicious, Label: PUA/OfferCore.Gen

Source: (copy)	ReversingLabs: Detection: 29%
Source: (copy)	Virustotal: Detection: 25%			Perma Link

Source: https://www.fileplanet.com/windows	HTTP Parser: No favicon
Source: https://www.fileplanet.com/windows	HTTP Parser: No favicon

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

(copy)

C:\Program Files\AVG\Antivirus\BrowserCleanup.ini.ipending.0699c975

C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsdriver.sys.ipending.0699c975

C:\Program Files\AVG\Antivirus\TuneupSmartScan.dll.ipending.0699c975

C:\Program Files\AVG\Antivirus\aswidpm.dll.ipending.0699c975

C:\Program Files\AVG\Antivirus\dnd_helper.dll.ipending.0699c975

C:\Program Files\AVG\Antivirus\gaming_hook.exe.ipending.0699c975

C:\Program Files\AVG\Antivirus\hns_tools.dll.ipending.0699c975

C:\Program Files\AVG\Antivirus\setup\aswd2a3a6766f965e6a.tmp (copy)

C:\Program Files\AVG\Antivirus\setup\config.def.ipending.0699c975

C:\Program Files\AVG\Antivirus\x86\aswhook.dll.ipending.0699c975

C:\Program Files\AVG\Antivirus\x86\dnd_helper.dll.ipending.0699c975

C:\Program Files\AVG\Antivirus\x86\gaming_hook.exe.ipending.0699c975

C:\Program Files\McAfee\Temp2863637682\analyticsmanager.cab

C:\Program Files\McAfee\Temp2863637682\analyticstelemetry.cab

C:\Program Files\McAfee\Temp2863637682\balloon_safe_annotation.png

C:\Program Files\McAfee\Temp2863637682\browserhost.cab

C:\Program Files\McAfee\Temp2863637682\browserplugin.cab

C:\Program Files\McAfee\Temp2863637682\downloadscan.cab

C:\Program Files\McAfee\Temp2863637682\eventmanager.cab

C:\Program Files\McAfee\Temp2863637682\icon_complete.png

C:\Program Files\McAfee\Temp2863637682\icon_failed.png

C:\Program Files\McAfee\Temp2863637682\icon_laptop.png

C:\Program Files\McAfee\Temp2863637682\installer.exe

C:\Program Files\McAfee\Temp2863637682\jquery-1.9.0.min.js

C:\Program Files\McAfee\Temp2863637682\jslang\eula-cs-CZ.txt

C:\Program Files\McAfee\Temp2863637682\jslang\eula-da-DK.txt

Windows Analysis Report
MDE_File_Sample_bacdeece4458ac1ee50cb505bd775588c4616b45.zip

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).
Tactics:	Reconnaissance
Data Sources:	Internet Scan: Response Content
Platforms:	PRE
Url:	Open detailed description by Mitre